From 3371d2b65c63d574bde33c2bc2cc345c4abfaa06 Mon Sep 17 00:00:00 2001 From: Richard Zowalla Date: Sat, 22 Aug 2026 20:03:13 +0200 Subject: [PATCH] Authorize createStateInZookeeper requests like the other blob operations --- .../auth/authorizer/SimpleACLAuthorizer.java | 1 + .../authorizer/SimpleACLAuthorizerTest.java | 5 +++++ .../apache/storm/daemon/nimbus/Nimbus.java | 1 + .../storm/daemon/nimbus/NimbusTest.java | 22 +++++++++++++++++++ 4 files changed, 29 insertions(+) diff --git a/storm-client/src/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizer.java b/storm-client/src/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizer.java index 1e088752f72..6cff51f5713 100644 --- a/storm-client/src/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizer.java +++ b/storm-client/src/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizer.java @@ -38,6 +38,7 @@ public class SimpleACLAuthorizer implements IAuthorizer { protected Set userCommands = new HashSet<>(Arrays.asList( "submitTopology", "fileUpload", + "createStateInZookeeper", "getNimbusConf", "getClusterInfo", "getLeader", diff --git a/storm-client/test/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizerTest.java b/storm-client/test/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizerTest.java index 15f4b9bbeed..6b61af31336 100644 --- a/storm-client/test/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizerTest.java +++ b/storm-client/test/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizerTest.java @@ -63,6 +63,11 @@ public void SimpleACLUserAuthTest() { assertTrue(authorizer.permit(new ReqContext(userA), "fileUpload", new HashMap<>())); assertTrue(authorizer.permit(new ReqContext(userB), "fileUpload", new HashMap<>())); + assertTrue(authorizer.permit(new ReqContext(adminUser), "createStateInZookeeper", new HashMap<>())); + assertFalse(authorizer.permit(new ReqContext(supervisorUser), "createStateInZookeeper", new HashMap<>())); + assertTrue(authorizer.permit(new ReqContext(userA), "createStateInZookeeper", new HashMap<>())); + assertTrue(authorizer.permit(new ReqContext(userB), "createStateInZookeeper", new HashMap<>())); + assertTrue(authorizer.permit(new ReqContext(adminUser), "getNimbusConf", new HashMap<>())); assertFalse(authorizer.permit(new ReqContext(supervisorUser), "getNimbusConf", new HashMap<>())); assertTrue(authorizer.permit(new ReqContext(userA), "getNimbusConf", new HashMap<>())); diff --git a/storm-server/src/main/java/org/apache/storm/daemon/nimbus/Nimbus.java b/storm-server/src/main/java/org/apache/storm/daemon/nimbus/Nimbus.java index ecf7dd2a24e..58806053b44 100644 --- a/storm-server/src/main/java/org/apache/storm/daemon/nimbus/Nimbus.java +++ b/storm-server/src/main/java/org/apache/storm/daemon/nimbus/Nimbus.java @@ -4137,6 +4137,7 @@ public int updateBlobReplication(String key, int replication) @Override public void createStateInZookeeper(String key) throws TException { try { + checkAuthorization(null, null, "createStateInZookeeper"); IStormClusterState state = stormClusterState; BlobStore store = blobStore; NimbusInfo ni = nimbusHostPortInfo; diff --git a/storm-server/src/test/java/org/apache/storm/daemon/nimbus/NimbusTest.java b/storm-server/src/test/java/org/apache/storm/daemon/nimbus/NimbusTest.java index 2380d49a809..6544fce39c1 100644 --- a/storm-server/src/test/java/org/apache/storm/daemon/nimbus/NimbusTest.java +++ b/storm-server/src/test/java/org/apache/storm/daemon/nimbus/NimbusTest.java @@ -45,6 +45,7 @@ import org.apache.storm.scheduler.resource.strategies.scheduling.DefaultResourceAwareStrategy; import org.apache.storm.scheduler.resource.strategies.scheduling.GenericResourceAwareStrategyOld; import org.apache.storm.scheduler.resource.strategies.scheduling.RoundRobinResourceAwareStrategy; +import org.apache.storm.security.auth.IAuthorizer; import org.apache.storm.security.auth.IGroupMappingServiceProvider; import org.apache.storm.testing.TestWordSpout; import org.apache.storm.thrift.TException; @@ -176,6 +177,27 @@ void testCreateStateInZookeeper() throws TException { verify(stormClusterState).setupBlob(eq(BLOB_FILE_KEY), eq(nimbusInfo), any()); } + @Test + void testCreateStateInZookeeperIsNotAllowedWhenTheAuthorizerDeniesIt() throws Exception { + IAuthorizer authorizer = mock(IAuthorizer.class); + when(authorizer.permit(any(), eq("createStateInZookeeper"), any())).thenReturn(false); + nimbus.setAuthorizationHandler(authorizer); + + assertThrows(AuthorizationException.class, () -> nimbus.createStateInZookeeper(BLOB_FILE_KEY)); + verify(stormClusterState, never()).setupBlob(eq(BLOB_FILE_KEY), eq(nimbusInfo), any()); + } + + @Test + void testCreateStateInZookeeperIsAllowedWhenTheAuthorizerPermitsIt() throws Exception { + IAuthorizer authorizer = mock(IAuthorizer.class); + when(authorizer.permit(any(), eq("createStateInZookeeper"), any())).thenReturn(true); + nimbus.setAuthorizationHandler(authorizer); + + nimbus.createStateInZookeeper(BLOB_FILE_KEY); + + verify(stormClusterState).setupBlob(eq(BLOB_FILE_KEY), eq(nimbusInfo), any()); + } + @Test void testCreateStateInZookeeperWithoutLocalFsBlobStoreInstanceShouldNotCreate() throws Exception { BlobStore blobStore = mock(BlobStore.class);