Java Code Examples for org.apache.hadoop.hdfs.security.token.delegation.DelegationTokenIdentifier#readFields()
The following examples show how to use
org.apache.hadoop.hdfs.security.token.delegation.DelegationTokenIdentifier#readFields() .
You can vote up the ones you like or vote down the ones you don't like,
and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: TestDelegationTokenForProxyUser.java From hadoop with Apache License 2.0 | 6 votes |
@Test(timeout=20000) public void testDelegationTokenWithRealUser() throws IOException { try { Token<?>[] tokens = proxyUgi .doAs(new PrivilegedExceptionAction<Token<?>[]>() { @Override public Token<?>[] run() throws IOException { return cluster.getFileSystem().addDelegationTokens("RenewerUser", null); } }); DelegationTokenIdentifier identifier = new DelegationTokenIdentifier(); byte[] tokenId = tokens[0].getIdentifier(); identifier.readFields(new DataInputStream(new ByteArrayInputStream( tokenId))); Assert.assertEquals(identifier.getUser().getUserName(), PROXY_USER); Assert.assertEquals(identifier.getUser().getRealUser().getUserName(), REAL_USER); } catch (InterruptedException e) { //Do Nothing } }
Example 2
Source File: TestDelegationTokenForProxyUser.java From big-c with Apache License 2.0 | 6 votes |
@Test(timeout=20000) public void testDelegationTokenWithRealUser() throws IOException { try { Token<?>[] tokens = proxyUgi .doAs(new PrivilegedExceptionAction<Token<?>[]>() { @Override public Token<?>[] run() throws IOException { return cluster.getFileSystem().addDelegationTokens("RenewerUser", null); } }); DelegationTokenIdentifier identifier = new DelegationTokenIdentifier(); byte[] tokenId = tokens[0].getIdentifier(); identifier.readFields(new DataInputStream(new ByteArrayInputStream( tokenId))); Assert.assertEquals(identifier.getUser().getUserName(), PROXY_USER); Assert.assertEquals(identifier.getUser().getRealUser().getUserName(), REAL_USER); } catch (InterruptedException e) { //Do Nothing } }
Example 3
Source File: DataNodeUGIProvider.java From hadoop with Apache License 2.0 | 5 votes |
private UserGroupInformation tokenUGI() throws IOException { Token<DelegationTokenIdentifier> token = params.delegationToken(); ByteArrayInputStream buf = new ByteArrayInputStream(token.getIdentifier()); DataInputStream in = new DataInputStream(buf); DelegationTokenIdentifier id = new DelegationTokenIdentifier(); id.readFields(in); UserGroupInformation ugi = id.getUser(); ugi.addToken(token); return ugi; }
Example 4
Source File: JspHelper.java From hadoop with Apache License 2.0 | 5 votes |
private static UserGroupInformation getTokenUGI(ServletContext context, HttpServletRequest request, String tokenString, Configuration conf) throws IOException { final Token<DelegationTokenIdentifier> token = new Token<DelegationTokenIdentifier>(); token.decodeFromUrlString(tokenString); InetSocketAddress serviceAddress = getNNServiceAddress(context, request); if (serviceAddress != null) { SecurityUtil.setTokenService(token, serviceAddress); token.setKind(DelegationTokenIdentifier.HDFS_DELEGATION_KIND); } ByteArrayInputStream buf = new ByteArrayInputStream(token.getIdentifier()); DataInputStream in = new DataInputStream(buf); DelegationTokenIdentifier id = new DelegationTokenIdentifier(); id.readFields(in); if (context != null) { final NameNode nn = NameNodeHttpServer.getNameNodeFromContext(context); if (nn != null) { // Verify the token. nn.getNamesystem().verifyToken(id, token.getPassword()); } } UserGroupInformation ugi = id.getUser(); ugi.addToken(token); return ugi; }
Example 5
Source File: TestDelegationToken.java From hadoop with Apache License 2.0 | 5 votes |
@Test public void testDelegationTokenSecretManager() throws Exception { Token<DelegationTokenIdentifier> token = generateDelegationToken( "SomeUser", "JobTracker"); // Fake renewer should not be able to renew try { dtSecretManager.renewToken(token, "FakeRenewer"); Assert.fail("should have failed"); } catch (AccessControlException ace) { // PASS } dtSecretManager.renewToken(token, "JobTracker"); DelegationTokenIdentifier identifier = new DelegationTokenIdentifier(); byte[] tokenId = token.getIdentifier(); identifier.readFields(new DataInputStream( new ByteArrayInputStream(tokenId))); Assert.assertTrue(null != dtSecretManager.retrievePassword(identifier)); LOG.info("Sleep to expire the token"); Thread.sleep(6000); //Token should be expired try { dtSecretManager.retrievePassword(identifier); //Should not come here Assert.fail("Token should have expired"); } catch (InvalidToken e) { //Success } dtSecretManager.renewToken(token, "JobTracker"); LOG.info("Sleep beyond the max lifetime"); Thread.sleep(5000); try { dtSecretManager.renewToken(token, "JobTracker"); Assert.fail("should have been expired"); } catch (InvalidToken it) { // PASS } }
Example 6
Source File: TestDelegationToken.java From hadoop with Apache License 2.0 | 5 votes |
@SuppressWarnings("unchecked") private void checkTokenIdentifier(UserGroupInformation ugi, final Token<?> token) throws Exception { Assert.assertNotNull(token); // should be able to use token.decodeIdentifier() but webhdfs isn't // registered with the service loader for token decoding DelegationTokenIdentifier identifier = new DelegationTokenIdentifier(); byte[] tokenId = token.getIdentifier(); DataInputStream in = new DataInputStream(new ByteArrayInputStream(tokenId)); try { identifier.readFields(in); } finally { in.close(); } Assert.assertNotNull(identifier); LOG.info("A valid token should have non-null password, and should be renewed successfully"); Assert.assertTrue(null != dtSecretManager.retrievePassword(identifier)); dtSecretManager.renewToken((Token<DelegationTokenIdentifier>) token, "JobTracker"); ugi.doAs( new PrivilegedExceptionAction<Object>() { @Override public Object run() throws Exception { token.renew(config); token.cancel(config); return null; } }); }
Example 7
Source File: TestDelegationTokensWithHA.java From hadoop with Apache License 2.0 | 5 votes |
@Test(timeout = 300000) public void testDelegationTokenDFSApi() throws Exception { final Token<DelegationTokenIdentifier> token = getDelegationToken(fs, "JobTracker"); DelegationTokenIdentifier identifier = new DelegationTokenIdentifier(); byte[] tokenId = token.getIdentifier(); identifier.readFields(new DataInputStream( new ByteArrayInputStream(tokenId))); // Ensure that it's present in the NN's secret manager and can // be renewed directly from there. LOG.info("A valid token should have non-null password, " + "and should be renewed successfully"); assertTrue(null != dtSecretManager.retrievePassword(identifier)); dtSecretManager.renewToken(token, "JobTracker"); // Use the client conf with the failover info present to check // renewal. Configuration clientConf = dfs.getConf(); doRenewOrCancel(token, clientConf, TokenTestAction.RENEW); // Using a configuration that doesn't have the logical nameservice // configured should result in a reasonable error message. Configuration emptyConf = new Configuration(); try { doRenewOrCancel(token, emptyConf, TokenTestAction.RENEW); fail("Did not throw trying to renew with an empty conf!"); } catch (IOException ioe) { GenericTestUtils.assertExceptionContains( "Unable to map logical nameservice URI", ioe); } // Ensure that the token can be renewed again after a failover. cluster.transitionToStandby(0); cluster.transitionToActive(1); doRenewOrCancel(token, clientConf, TokenTestAction.RENEW); doRenewOrCancel(token, clientConf, TokenTestAction.CANCEL); }
Example 8
Source File: DataNodeUGIProvider.java From big-c with Apache License 2.0 | 5 votes |
private UserGroupInformation tokenUGI() throws IOException { Token<DelegationTokenIdentifier> token = params.delegationToken(); ByteArrayInputStream buf = new ByteArrayInputStream(token.getIdentifier()); DataInputStream in = new DataInputStream(buf); DelegationTokenIdentifier id = new DelegationTokenIdentifier(); id.readFields(in); UserGroupInformation ugi = id.getUser(); ugi.addToken(token); return ugi; }
Example 9
Source File: JspHelper.java From big-c with Apache License 2.0 | 5 votes |
private static UserGroupInformation getTokenUGI(ServletContext context, HttpServletRequest request, String tokenString, Configuration conf) throws IOException { final Token<DelegationTokenIdentifier> token = new Token<DelegationTokenIdentifier>(); token.decodeFromUrlString(tokenString); InetSocketAddress serviceAddress = getNNServiceAddress(context, request); if (serviceAddress != null) { SecurityUtil.setTokenService(token, serviceAddress); token.setKind(DelegationTokenIdentifier.HDFS_DELEGATION_KIND); } ByteArrayInputStream buf = new ByteArrayInputStream(token.getIdentifier()); DataInputStream in = new DataInputStream(buf); DelegationTokenIdentifier id = new DelegationTokenIdentifier(); id.readFields(in); if (context != null) { final NameNode nn = NameNodeHttpServer.getNameNodeFromContext(context); if (nn != null) { // Verify the token. nn.getNamesystem().verifyToken(id, token.getPassword()); } } UserGroupInformation ugi = id.getUser(); ugi.addToken(token); return ugi; }
Example 10
Source File: TestDelegationToken.java From big-c with Apache License 2.0 | 5 votes |
@Test public void testDelegationTokenSecretManager() throws Exception { Token<DelegationTokenIdentifier> token = generateDelegationToken( "SomeUser", "JobTracker"); // Fake renewer should not be able to renew try { dtSecretManager.renewToken(token, "FakeRenewer"); Assert.fail("should have failed"); } catch (AccessControlException ace) { // PASS } dtSecretManager.renewToken(token, "JobTracker"); DelegationTokenIdentifier identifier = new DelegationTokenIdentifier(); byte[] tokenId = token.getIdentifier(); identifier.readFields(new DataInputStream( new ByteArrayInputStream(tokenId))); Assert.assertTrue(null != dtSecretManager.retrievePassword(identifier)); LOG.info("Sleep to expire the token"); Thread.sleep(6000); //Token should be expired try { dtSecretManager.retrievePassword(identifier); //Should not come here Assert.fail("Token should have expired"); } catch (InvalidToken e) { //Success } dtSecretManager.renewToken(token, "JobTracker"); LOG.info("Sleep beyond the max lifetime"); Thread.sleep(5000); try { dtSecretManager.renewToken(token, "JobTracker"); Assert.fail("should have been expired"); } catch (InvalidToken it) { // PASS } }
Example 11
Source File: TestDelegationToken.java From big-c with Apache License 2.0 | 5 votes |
@SuppressWarnings("unchecked") private void checkTokenIdentifier(UserGroupInformation ugi, final Token<?> token) throws Exception { Assert.assertNotNull(token); // should be able to use token.decodeIdentifier() but webhdfs isn't // registered with the service loader for token decoding DelegationTokenIdentifier identifier = new DelegationTokenIdentifier(); byte[] tokenId = token.getIdentifier(); DataInputStream in = new DataInputStream(new ByteArrayInputStream(tokenId)); try { identifier.readFields(in); } finally { in.close(); } Assert.assertNotNull(identifier); LOG.info("A valid token should have non-null password, and should be renewed successfully"); Assert.assertTrue(null != dtSecretManager.retrievePassword(identifier)); dtSecretManager.renewToken((Token<DelegationTokenIdentifier>) token, "JobTracker"); ugi.doAs( new PrivilegedExceptionAction<Object>() { @Override public Object run() throws Exception { token.renew(config); token.cancel(config); return null; } }); }
Example 12
Source File: TestDelegationTokensWithHA.java From big-c with Apache License 2.0 | 5 votes |
@Test(timeout = 300000) public void testDelegationTokenDFSApi() throws Exception { final Token<DelegationTokenIdentifier> token = getDelegationToken(fs, "JobTracker"); DelegationTokenIdentifier identifier = new DelegationTokenIdentifier(); byte[] tokenId = token.getIdentifier(); identifier.readFields(new DataInputStream( new ByteArrayInputStream(tokenId))); // Ensure that it's present in the NN's secret manager and can // be renewed directly from there. LOG.info("A valid token should have non-null password, " + "and should be renewed successfully"); assertTrue(null != dtSecretManager.retrievePassword(identifier)); dtSecretManager.renewToken(token, "JobTracker"); // Use the client conf with the failover info present to check // renewal. Configuration clientConf = dfs.getConf(); doRenewOrCancel(token, clientConf, TokenTestAction.RENEW); // Using a configuration that doesn't have the logical nameservice // configured should result in a reasonable error message. Configuration emptyConf = new Configuration(); try { doRenewOrCancel(token, emptyConf, TokenTestAction.RENEW); fail("Did not throw trying to renew with an empty conf!"); } catch (IOException ioe) { GenericTestUtils.assertExceptionContains( "Unable to map logical nameservice URI", ioe); } // Ensure that the token can be renewed again after a failover. cluster.transitionToStandby(0); cluster.transitionToActive(1); doRenewOrCancel(token, clientConf, TokenTestAction.RENEW); doRenewOrCancel(token, clientConf, TokenTestAction.CANCEL); }
Example 13
Source File: ImageLoaderCurrent.java From hadoop with Apache License 2.0 | 4 votes |
/** * Process the Delegation Token related section in fsimage. * * @param in DataInputStream to process * @param v Visitor to walk over records */ private void processDelegationTokens(DataInputStream in, ImageVisitor v) throws IOException { v.visit(ImageElement.CURRENT_DELEGATION_KEY_ID, in.readInt()); int numDKeys = in.readInt(); v.visitEnclosingElement(ImageElement.DELEGATION_KEYS, ImageElement.NUM_DELEGATION_KEYS, numDKeys); for(int i =0; i < numDKeys; i++) { DelegationKey key = new DelegationKey(); key.readFields(in); v.visit(ImageElement.DELEGATION_KEY, key.toString()); } v.leaveEnclosingElement(); v.visit(ImageElement.DELEGATION_TOKEN_SEQUENCE_NUMBER, in.readInt()); int numDTokens = in.readInt(); v.visitEnclosingElement(ImageElement.DELEGATION_TOKENS, ImageElement.NUM_DELEGATION_TOKENS, numDTokens); for(int i=0; i<numDTokens; i++){ DelegationTokenIdentifier id = new DelegationTokenIdentifier(); id.readFields(in); long expiryTime = in.readLong(); v.visitEnclosingElement(ImageElement.DELEGATION_TOKEN_IDENTIFIER); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_KIND, id.getKind().toString()); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_SEQNO, id.getSequenceNumber()); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_OWNER, id.getOwner().toString()); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_RENEWER, id.getRenewer().toString()); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_REALUSER, id.getRealUser().toString()); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_ISSUE_DATE, id.getIssueDate()); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_MAX_DATE, id.getMaxDate()); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_EXPIRY_TIME, expiryTime); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_MASTER_KEY_ID, id.getMasterKeyId()); v.leaveEnclosingElement(); // DELEGATION_TOKEN_IDENTIFIER } v.leaveEnclosingElement(); // DELEGATION_TOKENS }
Example 14
Source File: TestDelegationTokensWithHA.java From hadoop with Apache License 2.0 | 4 votes |
/** * Test if StandbyException can be thrown from StandbyNN, when it's requested for * password. (HDFS-6475). With StandbyException, the client can failover to try * activeNN. */ @Test(timeout = 300000) public void testDelegationTokenStandbyNNAppearFirst() throws Exception { // make nn0 the standby NN, and nn1 the active NN cluster.transitionToStandby(0); cluster.transitionToActive(1); final DelegationTokenSecretManager stSecretManager = NameNodeAdapter.getDtSecretManager( nn1.getNamesystem()); // create token final Token<DelegationTokenIdentifier> token = getDelegationToken(fs, "JobTracker"); final DelegationTokenIdentifier identifier = new DelegationTokenIdentifier(); byte[] tokenId = token.getIdentifier(); identifier.readFields(new DataInputStream( new ByteArrayInputStream(tokenId))); assertTrue(null != stSecretManager.retrievePassword(identifier)); final UserGroupInformation ugi = UserGroupInformation .createRemoteUser("JobTracker"); ugi.addToken(token); ugi.doAs(new PrivilegedExceptionAction<Object>() { @Override public Object run() { try { try { byte[] tmppw = dtSecretManager.retrievePassword(identifier); fail("InvalidToken with cause StandbyException is expected" + " since nn0 is standby"); return tmppw; } catch (IOException e) { // Mimic the UserProvider class logic (server side) by throwing // SecurityException here throw new SecurityException( SecurityUtil.FAILED_TO_GET_UGI_MSG_HEADER + " " + e, e); } } catch (Exception oe) { // // The exception oe caught here is // java.lang.SecurityException: Failed to obtain user group // information: org.apache.hadoop.security.token. // SecretManager$InvalidToken: StandbyException // HttpServletResponse response = mock(HttpServletResponse.class); ExceptionHandler eh = new ExceptionHandler(); eh.initResponse(response); // The Response (resp) below is what the server will send to client // // BEFORE HDFS-6475 fix, the resp.entity is // {"RemoteException":{"exception":"SecurityException", // "javaClassName":"java.lang.SecurityException", // "message":"Failed to obtain user group information: // org.apache.hadoop.security.token.SecretManager$InvalidToken: // StandbyException"}} // AFTER the fix, the resp.entity is // {"RemoteException":{"exception":"StandbyException", // "javaClassName":"org.apache.hadoop.ipc.StandbyException", // "message":"Operation category READ is not supported in // state standby"}} // Response resp = eh.toResponse(oe); // Mimic the client side logic by parsing the response from server // Map<?, ?> m = (Map<?, ?>)JSON.parse(resp.getEntity().toString()); RemoteException re = JsonUtil.toRemoteException(m); Exception unwrapped = ((RemoteException)re).unwrapRemoteException( StandbyException.class); assertTrue (unwrapped instanceof StandbyException); return null; } } }); }
Example 15
Source File: ImageLoaderCurrent.java From big-c with Apache License 2.0 | 4 votes |
/** * Process the Delegation Token related section in fsimage. * * @param in DataInputStream to process * @param v Visitor to walk over records */ private void processDelegationTokens(DataInputStream in, ImageVisitor v) throws IOException { v.visit(ImageElement.CURRENT_DELEGATION_KEY_ID, in.readInt()); int numDKeys = in.readInt(); v.visitEnclosingElement(ImageElement.DELEGATION_KEYS, ImageElement.NUM_DELEGATION_KEYS, numDKeys); for(int i =0; i < numDKeys; i++) { DelegationKey key = new DelegationKey(); key.readFields(in); v.visit(ImageElement.DELEGATION_KEY, key.toString()); } v.leaveEnclosingElement(); v.visit(ImageElement.DELEGATION_TOKEN_SEQUENCE_NUMBER, in.readInt()); int numDTokens = in.readInt(); v.visitEnclosingElement(ImageElement.DELEGATION_TOKENS, ImageElement.NUM_DELEGATION_TOKENS, numDTokens); for(int i=0; i<numDTokens; i++){ DelegationTokenIdentifier id = new DelegationTokenIdentifier(); id.readFields(in); long expiryTime = in.readLong(); v.visitEnclosingElement(ImageElement.DELEGATION_TOKEN_IDENTIFIER); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_KIND, id.getKind().toString()); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_SEQNO, id.getSequenceNumber()); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_OWNER, id.getOwner().toString()); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_RENEWER, id.getRenewer().toString()); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_REALUSER, id.getRealUser().toString()); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_ISSUE_DATE, id.getIssueDate()); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_MAX_DATE, id.getMaxDate()); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_EXPIRY_TIME, expiryTime); v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_MASTER_KEY_ID, id.getMasterKeyId()); v.leaveEnclosingElement(); // DELEGATION_TOKEN_IDENTIFIER } v.leaveEnclosingElement(); // DELEGATION_TOKENS }
Example 16
Source File: TestDelegationTokensWithHA.java From big-c with Apache License 2.0 | 4 votes |
/** * Test if StandbyException can be thrown from StandbyNN, when it's requested for * password. (HDFS-6475). With StandbyException, the client can failover to try * activeNN. */ @Test(timeout = 300000) public void testDelegationTokenStandbyNNAppearFirst() throws Exception { // make nn0 the standby NN, and nn1 the active NN cluster.transitionToStandby(0); cluster.transitionToActive(1); final DelegationTokenSecretManager stSecretManager = NameNodeAdapter.getDtSecretManager( nn1.getNamesystem()); // create token final Token<DelegationTokenIdentifier> token = getDelegationToken(fs, "JobTracker"); final DelegationTokenIdentifier identifier = new DelegationTokenIdentifier(); byte[] tokenId = token.getIdentifier(); identifier.readFields(new DataInputStream( new ByteArrayInputStream(tokenId))); assertTrue(null != stSecretManager.retrievePassword(identifier)); final UserGroupInformation ugi = UserGroupInformation .createRemoteUser("JobTracker"); ugi.addToken(token); ugi.doAs(new PrivilegedExceptionAction<Object>() { @Override public Object run() { try { try { byte[] tmppw = dtSecretManager.retrievePassword(identifier); fail("InvalidToken with cause StandbyException is expected" + " since nn0 is standby"); return tmppw; } catch (IOException e) { // Mimic the UserProvider class logic (server side) by throwing // SecurityException here throw new SecurityException( SecurityUtil.FAILED_TO_GET_UGI_MSG_HEADER + " " + e, e); } } catch (Exception oe) { // // The exception oe caught here is // java.lang.SecurityException: Failed to obtain user group // information: org.apache.hadoop.security.token. // SecretManager$InvalidToken: StandbyException // HttpServletResponse response = mock(HttpServletResponse.class); ExceptionHandler eh = new ExceptionHandler(); eh.initResponse(response); // The Response (resp) below is what the server will send to client // // BEFORE HDFS-6475 fix, the resp.entity is // {"RemoteException":{"exception":"SecurityException", // "javaClassName":"java.lang.SecurityException", // "message":"Failed to obtain user group information: // org.apache.hadoop.security.token.SecretManager$InvalidToken: // StandbyException"}} // AFTER the fix, the resp.entity is // {"RemoteException":{"exception":"StandbyException", // "javaClassName":"org.apache.hadoop.ipc.StandbyException", // "message":"Operation category READ is not supported in // state standby"}} // Response resp = eh.toResponse(oe); // Mimic the client side logic by parsing the response from server // Map<?, ?> m = (Map<?, ?>)JSON.parse(resp.getEntity().toString()); RemoteException re = JsonUtil.toRemoteException(m); Exception unwrapped = ((RemoteException)re).unwrapRemoteException( StandbyException.class); assertTrue (unwrapped instanceof StandbyException); return null; } } }); }