Closed DomGarguilo closed 1 year ago
Overall the changes look good. Was it discussed somewhere else as to why these tests are removed versus fixing?
Yea good point, sorry. There has been an effort to remove the use of multiple users in the proxy to reduce complexity. Most of that was taken care of in #59
Overall the changes look good. Was it discussed somewhere else as to why these tests are removed versus fixing?
Yea good point, sorry. There has been an effort to remove the use of multiple users in the proxy to reduce complexity. Most of that was taken care of in #59
I think the previous comment by @Manno15 still had a point. Some of those tests probably needed fixing, rather than removal. For example, the permissions test could be changed so that the permissions are added/removed by the root user using the minicluster API directly, and the Proxy instance could be used to check the regular user's permissions are appropriately enabled/restricted.
Similarly, the conditional writer test was doing some checks with the authorizations, which could have been manipulated in minicluster. Multiple proxy instances for separate users (using separate proxy config files for each separate user) would have also worked.
For example, the permissions test could be changed so that the permissions are added/removed by the root user using the minicluster API directly, and the Proxy instance could be used to check the regular user's permissions are appropriately enabled/restricted.
@ctubbsii, what do you mean by "regular user" here? In the tests when using the minicluster, the only user that is created/used is the root user.
For example, the permissions test could be changed so that the permissions are added/removed by the root user using the minicluster API directly, and the Proxy instance could be used to check the regular user's permissions are appropriately enabled/restricted.
@ctubbsii, what do you mean by "regular user" here? In the tests when using the minicluster, the only user that is created/used is the root user.
Look for lines that say client.createLocalUser
. Those created an unprivileged user whose permissions were manipulated to verify that the permissions worked as expected in the proxy. There are a few things that were being verified by those tests:
We still want to make sure we have proxy test coverage for 1 and 3. We could rely on Accumulo's own enforcement testing for 4, since the proxy now only has one user... and there's no risk of it using the wrong user's permissions now, but if we want the same coverage as before, we'll need to do some alternative to item 2, which we no longer need to test, as it is not supported.
This PR: