org.apache.hadoop.security.alias.CredentialProviderFactory Java Exaples

Source File: SecurityUtil.java From atlas with Apache License 2.0

7 votes

/**
 * Retrieves a password from a configured credential provider or prompts for the password and stores it in the
 * configured credential provider.
 * @param config application configuration
 * @param key the key/alias for the password.
 * @return the password.
 * @throws IOException
 */
public static String getPassword(org.apache.commons.configuration.Configuration config, String key) throws IOException {

    String password;

    String provider = config.getString(CERT_STORES_CREDENTIAL_PROVIDER_PATH);
    if (provider != null) {
        LOG.info("Attempting to retrieve password for key {} from configured credential provider path {}", key, provider);
        Configuration c = new Configuration();
        c.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, provider);
        CredentialProvider credentialProvider = CredentialProviderFactory.getProviders(c).get(0);
        CredentialProvider.CredentialEntry entry = credentialProvider.getCredentialEntry(key);
        if (entry == null) {
            throw new IOException(String.format("No credential entry found for %s. "
                    + "Please create an entry in the configured credential provider", key));
        } else {
            password = String.valueOf(entry.getCredential());
        }

    } else {
        throw new IOException("No credential provider path configured for storage of certificate store passwords");
    }

    return password;
}

Source File: TestSentryStore.java From incubator-sentry with Apache License 2.0

6 votes

@BeforeClass
public static void setup() throws Exception {
  conf = new Configuration(false);
  final String ourUrl = UserProvider.SCHEME_NAME + ":///";
  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, ourUrl);
  CredentialProvider provider = CredentialProviderFactory.getProviders(conf).get(0);
  provider.createCredentialEntry(ServerConfig.
      SENTRY_STORE_JDBC_PASS, passwd);
  provider.flush();

  dataDir = new File(Files.createTempDir(), "sentry_policy_db");
  conf.set(ServerConfig.SENTRY_VERIFY_SCHEM_VERSION, "false");
  conf.set(ServerConfig.SENTRY_STORE_JDBC_URL,
      "jdbc:derby:;databaseName=" + dataDir.getPath() + ";create=true");
  conf.set(ServerConfig.SENTRY_STORE_JDBC_PASS, "dummy");
  conf.setStrings(ServerConfig.ADMIN_GROUPS, adminGroups);
  conf.set(ServerConfig.SENTRY_STORE_GROUP_MAPPING,
      ServerConfig.SENTRY_STORE_LOCAL_GROUP_MAPPING);
  policyFilePath = new File(dataDir, "local_policy_file.ini");
  conf.set(ServerConfig.SENTRY_STORE_GROUP_MAPPING_RESOURCE,
      policyFilePath.getPath());
  sentryStore = new SentryStore(conf);
}

Source File: LdapRealm.java From zeppelin with Apache License 2.0

6 votes

static String getSystemPassword(String hadoopSecurityCredentialPath,
    String keystorePass) {
  String password = "";
  try {
    Configuration configuration = new Configuration();
    configuration.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH,
        hadoopSecurityCredentialPath);
    CredentialProvider provider = CredentialProviderFactory.getProviders(configuration).get(0);
    CredentialProvider.CredentialEntry credEntry = provider.getCredentialEntry(keystorePass);
    if (credEntry != null) {
      password = new String(credEntry.getCredential());
    }
  } catch (IOException e) {
    throw new ShiroException("Error from getting credential entry from keystore", e);
  }
  if (org.apache.commons.lang3.StringUtils.isEmpty(password)) {
    throw new ShiroException("Error getting SystemPassword from the provided keystore:"
        + keystorePass + ", in path:" + hadoopSecurityCredentialPath);
  }
  return password;
}

Source File: S3MapReduceCpCopier.java From circus-train with Apache License 2.0

6 votes

private S3MapReduceCpOptions parseCopierOptions(Map<String, Object> copierOptions) {
  String defaultCredentialsProviderString = conf.get(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH);
  URI defaultCredentialsProvider = null;
  if (defaultCredentialsProviderString != null) {
    defaultCredentialsProvider = URI.create(defaultCredentialsProviderString);
  }

  URI replicaDataLocationUri = toURI(replicaDataLocation);
  S3MapReduceCpOptionsParser optionsParser = null;
  if (sourceDataLocations.isEmpty()) {
    LOG.debug("Will copy all sub-paths.");
    optionsParser = new S3MapReduceCpOptionsParser(Arrays.asList(sourceDataBaseLocation), replicaDataLocationUri,
        defaultCredentialsProvider);
  } else {
    LOG.debug("Will copy {} sub-paths.", sourceDataLocations.size());
    conf.set(SimpleCopyListing.CONF_LABEL_ROOT_PATH, sourceDataBaseLocation.toUri().toString());
    optionsParser = new S3MapReduceCpOptionsParser(sourceDataLocations, replicaDataLocationUri,
        defaultCredentialsProvider);
  }
  return optionsParser.parse(copierOptions);
}

Source File: SecureEmbeddedServer.java From incubator-atlas with Apache License 2.0

6 votes

/**
 * Retrieves a password from a configured credential provider or prompts for the password and stores it in the
 * configured credential provider.
 * @param config application configuration
 * @param key the key/alias for the password.
 * @return the password.
 * @throws IOException
 */
private String getPassword(org.apache.commons.configuration.Configuration config, String key) throws IOException {

    String password;

    String provider = config.getString(CERT_STORES_CREDENTIAL_PROVIDER_PATH);
    if (provider != null) {
        LOG.info("Attempting to retrieve password from configured credential provider path");
        Configuration c = new Configuration();
        c.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, provider);
        CredentialProvider credentialProvider = CredentialProviderFactory.getProviders(c).get(0);
        CredentialProvider.CredentialEntry entry = credentialProvider.getCredentialEntry(key);
        if (entry == null) {
            throw new IOException(String.format("No credential entry found for %s. "
                    + "Please create an entry in the configured credential provider", key));
        } else {
            password = String.valueOf(entry.getCredential());
        }

    } else {
        throw new IOException("No credential provider path configured for storage of certificate store passwords");
    }

    return password;
}

Source File: SSLTest.java From atlas with Apache License 2.0

5 votes

protected void setupCredentials() throws Exception {
    Configuration conf = new Configuration(false);

    File file = new File(jksPath.toUri().getPath());
    file.delete();
    conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, providerUrl);

    CredentialProvider provider = CredentialProviderFactory.getProviders(conf).get(0);

    // create new aliases
    try {

        char[] storepass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(KEYSTORE_PASSWORD_KEY, storepass);

        char[] trustpass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(TRUSTSTORE_PASSWORD_KEY, trustpass);

        char[] trustpass2 = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry("ssl.client.truststore.password", trustpass2);

        char[] certpass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(SERVER_CERT_PASSWORD_KEY, certpass);

        // write out so that it can be found in checks
        provider.flush();
    } catch (Exception e) {
        e.printStackTrace();
        throw e;
    }
}

Source File: RangerCredentialProvider.java From ranger with Apache License 2.0

5 votes

List<CredentialProvider> getCredentialProviders(String url) {
	if (url != null) {
		try {
			Configuration conf = new Configuration();
			conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, url);
			return CredentialProviderFactory.getProviders(conf);
		} catch (Exception ie) {
			LOG.error("Unable to get the Credential Provider from the Configuration", ie);
		}
	}
	return null;
}

Source File: JDBCInterpreter.java From zeppelin with Apache License 2.0

5 votes

private String getPassword(Properties properties) throws IOException, InterpreterException {
  if (isNotEmpty(properties.getProperty(PASSWORD_KEY))) {
    return properties.getProperty(PASSWORD_KEY);
  } else if (isNotEmpty(properties.getProperty(JDBC_JCEKS_FILE))
      && isNotEmpty(properties.getProperty(JDBC_JCEKS_CREDENTIAL_KEY))) {
    try {
      Configuration configuration = new Configuration();
      configuration.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH,
          properties.getProperty(JDBC_JCEKS_FILE));
      CredentialProvider provider = CredentialProviderFactory.getProviders(configuration).get(0);
      CredentialProvider.CredentialEntry credEntry =
          provider.getCredentialEntry(properties.getProperty(JDBC_JCEKS_CREDENTIAL_KEY));
      if (credEntry != null) {
        return new String(credEntry.getCredential());
      } else {
        throw new InterpreterException("Failed to retrieve password from JCEKS from key: "
            + properties.getProperty(JDBC_JCEKS_CREDENTIAL_KEY));
      }
    } catch (Exception e) {
      LOGGER.error("Failed to retrieve password from JCEKS \n" +
          "For file: {} \nFor key: {}", properties.getProperty(JDBC_JCEKS_FILE),
              properties.getProperty(JDBC_JCEKS_CREDENTIAL_KEY), e);
      throw e;
    }
  }
  return null;
}

Source File: SecureEmbeddedServerTestBase.java From incubator-atlas with Apache License 2.0

5 votes

protected void setupCredentials() throws Exception {
    Configuration conf = new Configuration(false);

    File file = new File(jksPath.toUri().getPath());
    file.delete();
    conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, providerUrl);

    CredentialProvider provider = CredentialProviderFactory.getProviders(conf).get(0);

    // create new aliases
    try {

        char[] storepass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(KEYSTORE_PASSWORD_KEY, storepass);

        char[] trustpass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(TRUSTSTORE_PASSWORD_KEY, trustpass);

        char[] certpass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(SERVER_CERT_PASSWORD_KEY, certpass);

        // write out so that it can be found in checks
        provider.flush();
    } catch (Exception e) {
        e.printStackTrace();
        throw e;
    }
}

Source File: BaseSSLAndKerberosTest.java From incubator-atlas with Apache License 2.0

5 votes

protected void setupCredentials() throws Exception {
    Configuration conf = new Configuration(false);

    File file = new File(jksPath.toUri().getPath());
    file.delete();
    conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, providerUrl);

    CredentialProvider provider = CredentialProviderFactory.getProviders(conf).get(0);

    // create new aliases
    try {

        char[] storepass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(SecurityProperties.KEYSTORE_PASSWORD_KEY, storepass);

        char[] trustpass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(SecurityProperties.TRUSTSTORE_PASSWORD_KEY, trustpass);

        char[] trustpass2 = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry("ssl.client.truststore.password", trustpass2);

        char[] certpass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(SecurityProperties.SERVER_CERT_PASSWORD_KEY, certpass);

        // write out so that it can be found in checks
        provider.flush();
    } catch (Exception e) {
        e.printStackTrace();
        throw e;
    }
}

Source File: SSLTest.java From incubator-atlas with Apache License 2.0

5 votes

protected void setupCredentials() throws Exception {
    Configuration conf = new Configuration(false);

    File file = new File(jksPath.toUri().getPath());
    file.delete();
    conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, providerUrl);

    CredentialProvider provider = CredentialProviderFactory.getProviders(conf).get(0);

    // create new aliases
    try {

        char[] storepass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(KEYSTORE_PASSWORD_KEY, storepass);

        char[] trustpass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(TRUSTSTORE_PASSWORD_KEY, trustpass);

        char[] trustpass2 = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry("ssl.client.truststore.password", trustpass2);

        char[] certpass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(SERVER_CERT_PASSWORD_KEY, certpass);

        // write out so that it can be found in checks
        provider.flush();
    } catch (Exception e) {
        e.printStackTrace();
        throw e;
    }
}

Source File: CredentialProviderUtility.java From incubator-atlas with Apache License 2.0

5 votes

/**\
 * Returns a credential provider for the entered JKS path.
 * @param textDevice the system console.
 * @return the Credential provider
 * @throws IOException
 */
private static CredentialProvider getCredentialProvider(TextDevice textDevice) throws IOException {
    String providerPath = textDevice.readLine("Please enter the full path to the credential provider:");

    if (providerPath != null) {
        Configuration conf = new Configuration(false);
        conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, providerPath);
        return CredentialProviderFactory.getProviders(conf).get(0);
    }

    return null;
}

Source File: KeyStoreTestUtil.java From big-c with Apache License 2.0

5 votes

public static void provisionPasswordsToCredentialProvider() throws Exception {
  File testDir = new File(System.getProperty("test.build.data",
      "target/test-dir"));

  Configuration conf = new Configuration();
  final Path jksPath = new Path(testDir.toString(), "test.jks");
  final String ourUrl =
  JavaKeyStoreProvider.SCHEME_NAME + "://file" + jksPath.toUri();

  File file = new File(testDir, "test.jks");
  file.delete();
  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, ourUrl);

  CredentialProvider provider =
      CredentialProviderFactory.getProviders(conf).get(0);
  char[] keypass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
  char[] storepass = {'s', 't', 'o', 'r', 'e', 'p', 'a', 's', 's'};

  // create new aliases
  try {
    provider.createCredentialEntry(
        FileBasedKeyStoresFactory.resolvePropertyName(SSLFactory.Mode.SERVER,
            FileBasedKeyStoresFactory.SSL_KEYSTORE_PASSWORD_TPL_KEY),
            storepass);

    provider.createCredentialEntry(
        FileBasedKeyStoresFactory.resolvePropertyName(SSLFactory.Mode.SERVER,
            FileBasedKeyStoresFactory.SSL_KEYSTORE_KEYPASSWORD_TPL_KEY),
            keypass);

    // write out so that it can be found in checks
    provider.flush();
  } catch (Exception e) {
    e.printStackTrace();
    throw e;
  }
}

Source File: KeyStoreTestUtil.java From hadoop with Apache License 2.0

5 votes

public static void provisionPasswordsToCredentialProvider() throws Exception {
  File testDir = new File(System.getProperty("test.build.data",
      "target/test-dir"));

  Configuration conf = new Configuration();
  final Path jksPath = new Path(testDir.toString(), "test.jks");
  final String ourUrl =
  JavaKeyStoreProvider.SCHEME_NAME + "://file" + jksPath.toUri();

  File file = new File(testDir, "test.jks");
  file.delete();
  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, ourUrl);

  CredentialProvider provider =
      CredentialProviderFactory.getProviders(conf).get(0);
  char[] keypass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
  char[] storepass = {'s', 't', 'o', 'r', 'e', 'p', 'a', 's', 's'};

  // create new aliases
  try {
    provider.createCredentialEntry(
        FileBasedKeyStoresFactory.resolvePropertyName(SSLFactory.Mode.SERVER,
            FileBasedKeyStoresFactory.SSL_KEYSTORE_PASSWORD_TPL_KEY),
            storepass);

    provider.createCredentialEntry(
        FileBasedKeyStoresFactory.resolvePropertyName(SSLFactory.Mode.SERVER,
            FileBasedKeyStoresFactory.SSL_KEYSTORE_KEYPASSWORD_TPL_KEY),
            keypass);

    // write out so that it can be found in checks
    provider.flush();
  } catch (Exception e) {
    e.printStackTrace();
    throw e;
  }
}

Source File: S3MapReduceCp.java From circus-train with Apache License 2.0

5 votes

/**
 * Loads properties from s3mapreducecp-default.xml into configuration object
 *
 * @return Configuration which includes properties from s3mapreducecp-default.xml
 */
private static Configuration getDefaultConf(S3MapReduceCpOptions options) {
  Configuration config = new S3MapReduceCpConfiguration();
  config.addResource(S3MAPREDUCECP_DEFAULT_XML);
  if (options.getCredentialsProvider() != null) {
    config.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, options.getCredentialsProvider().toString());
  }
  return config;
}

Source File: SecureEmbeddedServerTestBase.java From atlas with Apache License 2.0

5 votes

protected void setupCredentials() throws Exception {
    Configuration conf = new Configuration(false);

    File file = new File(jksPath.toUri().getPath());
    file.delete();
    conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, providerUrl);

    CredentialProvider provider = CredentialProviderFactory.getProviders(conf).get(0);

    // create new aliases
    try {

        char[] storepass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(KEYSTORE_PASSWORD_KEY, storepass);

        char[] trustpass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(TRUSTSTORE_PASSWORD_KEY, trustpass);

        char[] certpass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(SERVER_CERT_PASSWORD_KEY, certpass);

        // write out so that it can be found in checks
        provider.flush();
    } catch (Exception e) {
        e.printStackTrace();
        throw e;
    }
}

Source File: BaseSSLAndKerberosTest.java From atlas with Apache License 2.0

5 votes

protected void setupCredentials() throws Exception {
    Configuration conf = new Configuration(false);

    File file = new File(jksPath.toUri().getPath());
    file.delete();
    conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, providerUrl);

    CredentialProvider provider = CredentialProviderFactory.getProviders(conf).get(0);

    // create new aliases
    try {

        char[] storepass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(SecurityProperties.KEYSTORE_PASSWORD_KEY, storepass);

        char[] trustpass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(SecurityProperties.TRUSTSTORE_PASSWORD_KEY, trustpass);

        char[] trustpass2 = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry("ssl.client.truststore.password", trustpass2);

        char[] certpass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
        provider.createCredentialEntry(SecurityProperties.SERVER_CERT_PASSWORD_KEY, certpass);

        // write out so that it can be found in checks
        provider.flush();
    } catch (Exception e) {
        e.printStackTrace();
        throw e;
    }
}

Source File: CredentialProviderUtility.java From atlas with Apache License 2.0

5 votes

/**\
 * Returns a credential provider for the entered JKS path.
 * @param textDevice the system console.
 * @return the Credential provider
 * @throws IOException
 */
private static CredentialProvider getCredentialProvider(TextDevice textDevice) throws IOException {
    String providerPath = textDevice.readLine("Please enter the full path to the credential provider:");

    if (providerPath != null) {
        Configuration conf = new Configuration(false);

        conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, providerPath);

        return CredentialProviderFactory.getProviders(conf).get(0);
    }

    return null;
}

Source File: TestWebAppUtils.java From big-c with Apache License 2.0

4 votes

protected Configuration provisionCredentialsForSSL() throws IOException,
    Exception {
  File testDir = new File(System.getProperty("test.build.data",
      "target/test-dir"));

  Configuration conf = new Configuration();
  final Path jksPath = new Path(testDir.toString(), "test.jks");
  final String ourUrl =
  JavaKeyStoreProvider.SCHEME_NAME + "://file" + jksPath.toUri();

  File file = new File(testDir, "test.jks");
  file.delete();
  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, ourUrl);

  CredentialProvider provider =
      CredentialProviderFactory.getProviders(conf).get(0);
  char[] keypass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
  char[] storepass = {'s', 't', 'o', 'r', 'e', 'p', 'a', 's', 's'};
  char[] trustpass = {'t', 'r', 'u', 's', 't', 'p', 'a', 's', 's'};

  // ensure that we get nulls when the key isn't there
  assertEquals(null, provider.getCredentialEntry(
      WebAppUtils.WEB_APP_KEY_PASSWORD_KEY));
  assertEquals(null, provider.getCredentialEntry(
      WebAppUtils.WEB_APP_KEYSTORE_PASSWORD_KEY));
  assertEquals(null, provider.getCredentialEntry(
      WebAppUtils.WEB_APP_TRUSTSTORE_PASSWORD_KEY));

  // create new aliases
  try {
    provider.createCredentialEntry(
        WebAppUtils.WEB_APP_KEY_PASSWORD_KEY, keypass);

    provider.createCredentialEntry(
        WebAppUtils.WEB_APP_KEYSTORE_PASSWORD_KEY, storepass);

    provider.createCredentialEntry(
        WebAppUtils.WEB_APP_TRUSTSTORE_PASSWORD_KEY, trustpass);

    // write out so that it can be found in checks
    provider.flush();
  } catch (Exception e) {
    e.printStackTrace();
    throw e;
  }
  // make sure we get back the right key directly from api
  assertArrayEquals(keypass, provider.getCredentialEntry(
      WebAppUtils.WEB_APP_KEY_PASSWORD_KEY).getCredential());
  assertArrayEquals(storepass, provider.getCredentialEntry(
      WebAppUtils.WEB_APP_KEYSTORE_PASSWORD_KEY).getCredential());
  assertArrayEquals(trustpass, provider.getCredentialEntry(
      WebAppUtils.WEB_APP_TRUSTSTORE_PASSWORD_KEY).getCredential());
  return conf;
}

Source File: TestDFSUtil.java From big-c with Apache License 2.0

4 votes

@Test
public void testGetPassword() throws Exception {
  File testDir = new File(System.getProperty("test.build.data",
      "target/test-dir"));

  Configuration conf = new Configuration();
  final Path jksPath = new Path(testDir.toString(), "test.jks");
  final String ourUrl =
  JavaKeyStoreProvider.SCHEME_NAME + "://file" + jksPath.toUri();

  File file = new File(testDir, "test.jks");
  file.delete();
  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, ourUrl);

  CredentialProvider provider =
      CredentialProviderFactory.getProviders(conf).get(0);
  char[] keypass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
  char[] storepass = {'s', 't', 'o', 'r', 'e', 'p', 'a', 's', 's'};
  char[] trustpass = {'t', 'r', 'u', 's', 't', 'p', 'a', 's', 's'};

  // ensure that we get nulls when the key isn't there
  assertEquals(null, provider.getCredentialEntry(
      DFS_SERVER_HTTPS_KEYPASSWORD_KEY));
  assertEquals(null, provider.getCredentialEntry(
      DFS_SERVER_HTTPS_KEYSTORE_PASSWORD_KEY));
  assertEquals(null, provider.getCredentialEntry(
      DFS_SERVER_HTTPS_TRUSTSTORE_PASSWORD_KEY));

  // create new aliases
  try {
    provider.createCredentialEntry(
        DFS_SERVER_HTTPS_KEYPASSWORD_KEY, keypass);

    provider.createCredentialEntry(
        DFS_SERVER_HTTPS_KEYSTORE_PASSWORD_KEY, storepass);

    provider.createCredentialEntry(
        DFS_SERVER_HTTPS_TRUSTSTORE_PASSWORD_KEY, trustpass);

    // write out so that it can be found in checks
    provider.flush();
  } catch (Exception e) {
    e.printStackTrace();
    throw e;
  }
  // make sure we get back the right key directly from api
  assertArrayEquals(keypass, provider.getCredentialEntry(
      DFS_SERVER_HTTPS_KEYPASSWORD_KEY).getCredential());
  assertArrayEquals(storepass, provider.getCredentialEntry(
      DFS_SERVER_HTTPS_KEYSTORE_PASSWORD_KEY).getCredential());
  assertArrayEquals(trustpass, provider.getCredentialEntry(
      DFS_SERVER_HTTPS_TRUSTSTORE_PASSWORD_KEY).getCredential());

  // use WebAppUtils as would be used by loadSslConfiguration
  Assert.assertEquals("keypass",
      DFSUtil.getPassword(conf, DFS_SERVER_HTTPS_KEYPASSWORD_KEY));
  Assert.assertEquals("storepass",
      DFSUtil.getPassword(conf, DFS_SERVER_HTTPS_KEYSTORE_PASSWORD_KEY));
  Assert.assertEquals("trustpass",
      DFSUtil.getPassword(conf, DFS_SERVER_HTTPS_TRUSTSTORE_PASSWORD_KEY));

  // let's make sure that a password that doesn't exist returns null
  Assert.assertEquals(null, DFSUtil.getPassword(conf,"invalid-alias"));
}

Source File: TestSSLFactory.java From big-c with Apache License 2.0

4 votes

/**
 * Checks that SSLFactory initialization is successful with the given
 * arguments.  This is a helper method for writing test cases that cover
 * different combinations of settings for the store password and key password.
 * It takes care of bootstrapping a keystore, a truststore, and SSL client or
 * server configuration.  Then, it initializes an SSLFactory.  If no exception
 * is thrown, then initialization was successful.
 *
 * @param mode SSLFactory.Mode mode to test
 * @param password String store password to set on keystore
 * @param keyPassword String key password to set on keystore
 * @param confPassword String store password to set in SSL config file, or null
 *   to avoid setting in SSL config file
 * @param confKeyPassword String key password to set in SSL config file, or
 *   null to avoid setting in SSL config file
 * @param useCredProvider boolean to indicate whether passwords should be set
 * into the config or not. When set to true nulls are set and aliases are
 * expected to be resolved through credential provider API through the
 * Configuration.getPassword method
 * @throws Exception for any error
 */
private void checkSSLFactoryInitWithPasswords(SSLFactory.Mode mode,
    String password, String keyPassword, String confPassword,
    String confKeyPassword, boolean useCredProvider) throws Exception {
  String keystore = new File(KEYSTORES_DIR, "keystore.jks").getAbsolutePath();
  String truststore = new File(KEYSTORES_DIR, "truststore.jks")
    .getAbsolutePath();
  String trustPassword = "trustP";

  // Create keys, certs, keystore, and truststore.
  KeyPair keyPair = KeyStoreTestUtil.generateKeyPair("RSA");
  X509Certificate cert = KeyStoreTestUtil.generateCertificate("CN=Test",
    keyPair, 30, "SHA1withRSA");
  KeyStoreTestUtil.createKeyStore(keystore, password, keyPassword, "Test",
    keyPair.getPrivate(), cert);
  Map<String, X509Certificate> certs = Collections.singletonMap("server",
    cert);
  KeyStoreTestUtil.createTrustStore(truststore, trustPassword, certs);

  // Create SSL configuration file, for either server or client.
  final String sslConfFileName;
  final Configuration sslConf;

  // if the passwords are provisioned in a cred provider then don't set them
  // in the configuration properly - expect them to be resolved through the
  // provider
  if (useCredProvider) {
    confPassword = null;
    confKeyPassword = null;
  }
  if (mode == SSLFactory.Mode.SERVER) {
    sslConfFileName = "ssl-server.xml";
    sslConf = KeyStoreTestUtil.createServerSSLConfig(keystore, confPassword,
      confKeyPassword, truststore);
    if (useCredProvider) {
      File testDir = new File(System.getProperty("test.build.data",
          "target/test-dir"));
      final Path jksPath = new Path(testDir.toString(), "test.jks");
      final String ourUrl =
          JavaKeyStoreProvider.SCHEME_NAME + "://file" + jksPath.toUri();
      sslConf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, ourUrl);
    }
  } else {
    sslConfFileName = "ssl-client.xml";
    sslConf = KeyStoreTestUtil.createClientSSLConfig(keystore, confPassword,
      confKeyPassword, truststore);
  }
  KeyStoreTestUtil.saveConfig(new File(sslConfsDir, sslConfFileName), sslConf);

  // Create the master configuration for use by the SSLFactory, which by
  // default refers to the ssl-server.xml or ssl-client.xml created above.
  Configuration conf = new Configuration();
  conf.setBoolean(SSLFactory.SSL_REQUIRE_CLIENT_CERT_KEY, true);

  // Try initializing an SSLFactory.
  SSLFactory sslFactory = new SSLFactory(mode, conf);
  try {
    sslFactory.init();
  } finally {
    sslFactory.destroy();
  }
}

Source File: TestLdapGroupsMapping.java From hadoop with Apache License 2.0

4 votes

@Test
public void testConfGetPassword() throws Exception {
  File testDir = new File(System.getProperty("test.build.data",
                                             "target/test-dir"));
  Configuration conf = new Configuration();
  final Path jksPath = new Path(testDir.toString(), "test.jks");
  final String ourUrl =
      JavaKeyStoreProvider.SCHEME_NAME + "://file" + jksPath.toUri();

  File file = new File(testDir, "test.jks");
  file.delete();
  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, ourUrl);

  CredentialProvider provider =
      CredentialProviderFactory.getProviders(conf).get(0);
  char[] bindpass = {'b', 'i', 'n', 'd', 'p', 'a', 's', 's'};
  char[] storepass = {'s', 't', 'o', 'r', 'e', 'p', 'a', 's', 's'};

  // ensure that we get nulls when the key isn't there
  assertEquals(null, provider.getCredentialEntry(
      LdapGroupsMapping.BIND_PASSWORD_KEY));
  assertEquals(null, provider.getCredentialEntry
      (LdapGroupsMapping.LDAP_KEYSTORE_PASSWORD_KEY));

  // create new aliases
  try {
    provider.createCredentialEntry(
        LdapGroupsMapping.BIND_PASSWORD_KEY, bindpass);

    provider.createCredentialEntry(
        LdapGroupsMapping.LDAP_KEYSTORE_PASSWORD_KEY, storepass);
    provider.flush();
  } catch (Exception e) {
    e.printStackTrace();
    throw e;
  }
  // make sure we get back the right key
  assertArrayEquals(bindpass, provider.getCredentialEntry(
      LdapGroupsMapping.BIND_PASSWORD_KEY).getCredential());
  assertArrayEquals(storepass, provider.getCredentialEntry(
      LdapGroupsMapping.LDAP_KEYSTORE_PASSWORD_KEY).getCredential());

  LdapGroupsMapping mapping = new LdapGroupsMapping();
  Assert.assertEquals("bindpass",
      mapping.getPassword(conf, LdapGroupsMapping.BIND_PASSWORD_KEY, ""));
  Assert.assertEquals("storepass",
      mapping.getPassword(conf, LdapGroupsMapping.LDAP_KEYSTORE_PASSWORD_KEY,
         ""));
  // let's make sure that a password that doesn't exist returns an
  // empty string as currently expected and used to trigger a call to
  // extract password
  Assert.assertEquals("", mapping.getPassword(conf,"invalid-alias", ""));
}

Source File: TestLdapGroupsMapping.java From big-c with Apache License 2.0

4 votes

@Test
public void testConfGetPassword() throws Exception {
  File testDir = new File(System.getProperty("test.build.data",
                                             "target/test-dir"));
  Configuration conf = new Configuration();
  final Path jksPath = new Path(testDir.toString(), "test.jks");
  final String ourUrl =
      JavaKeyStoreProvider.SCHEME_NAME + "://file" + jksPath.toUri();

  File file = new File(testDir, "test.jks");
  file.delete();
  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, ourUrl);

  CredentialProvider provider =
      CredentialProviderFactory.getProviders(conf).get(0);
  char[] bindpass = {'b', 'i', 'n', 'd', 'p', 'a', 's', 's'};
  char[] storepass = {'s', 't', 'o', 'r', 'e', 'p', 'a', 's', 's'};

  // ensure that we get nulls when the key isn't there
  assertEquals(null, provider.getCredentialEntry(
      LdapGroupsMapping.BIND_PASSWORD_KEY));
  assertEquals(null, provider.getCredentialEntry
      (LdapGroupsMapping.LDAP_KEYSTORE_PASSWORD_KEY));

  // create new aliases
  try {
    provider.createCredentialEntry(
        LdapGroupsMapping.BIND_PASSWORD_KEY, bindpass);

    provider.createCredentialEntry(
        LdapGroupsMapping.LDAP_KEYSTORE_PASSWORD_KEY, storepass);
    provider.flush();
  } catch (Exception e) {
    e.printStackTrace();
    throw e;
  }
  // make sure we get back the right key
  assertArrayEquals(bindpass, provider.getCredentialEntry(
      LdapGroupsMapping.BIND_PASSWORD_KEY).getCredential());
  assertArrayEquals(storepass, provider.getCredentialEntry(
      LdapGroupsMapping.LDAP_KEYSTORE_PASSWORD_KEY).getCredential());

  LdapGroupsMapping mapping = new LdapGroupsMapping();
  Assert.assertEquals("bindpass",
      mapping.getPassword(conf, LdapGroupsMapping.BIND_PASSWORD_KEY, ""));
  Assert.assertEquals("storepass",
      mapping.getPassword(conf, LdapGroupsMapping.LDAP_KEYSTORE_PASSWORD_KEY,
         ""));
  // let's make sure that a password that doesn't exist returns an
  // empty string as currently expected and used to trigger a call to
  // extract password
  Assert.assertEquals("", mapping.getPassword(conf,"invalid-alias", ""));
}

Source File: TestSSLFactory.java From hadoop with Apache License 2.0

4 votes

/**
 * Checks that SSLFactory initialization is successful with the given
 * arguments.  This is a helper method for writing test cases that cover
 * different combinations of settings for the store password and key password.
 * It takes care of bootstrapping a keystore, a truststore, and SSL client or
 * server configuration.  Then, it initializes an SSLFactory.  If no exception
 * is thrown, then initialization was successful.
 *
 * @param mode SSLFactory.Mode mode to test
 * @param password String store password to set on keystore
 * @param keyPassword String key password to set on keystore
 * @param confPassword String store password to set in SSL config file, or null
 *   to avoid setting in SSL config file
 * @param confKeyPassword String key password to set in SSL config file, or
 *   null to avoid setting in SSL config file
 * @param useCredProvider boolean to indicate whether passwords should be set
 * into the config or not. When set to true nulls are set and aliases are
 * expected to be resolved through credential provider API through the
 * Configuration.getPassword method
 * @throws Exception for any error
 */
private void checkSSLFactoryInitWithPasswords(SSLFactory.Mode mode,
    String password, String keyPassword, String confPassword,
    String confKeyPassword, boolean useCredProvider) throws Exception {
  String keystore = new File(KEYSTORES_DIR, "keystore.jks").getAbsolutePath();
  String truststore = new File(KEYSTORES_DIR, "truststore.jks")
    .getAbsolutePath();
  String trustPassword = "trustP";

  // Create keys, certs, keystore, and truststore.
  KeyPair keyPair = KeyStoreTestUtil.generateKeyPair("RSA");
  X509Certificate cert = KeyStoreTestUtil.generateCertificate("CN=Test",
    keyPair, 30, "SHA1withRSA");
  KeyStoreTestUtil.createKeyStore(keystore, password, keyPassword, "Test",
    keyPair.getPrivate(), cert);
  Map<String, X509Certificate> certs = Collections.singletonMap("server",
    cert);
  KeyStoreTestUtil.createTrustStore(truststore, trustPassword, certs);

  // Create SSL configuration file, for either server or client.
  final String sslConfFileName;
  final Configuration sslConf;

  // if the passwords are provisioned in a cred provider then don't set them
  // in the configuration properly - expect them to be resolved through the
  // provider
  if (useCredProvider) {
    confPassword = null;
    confKeyPassword = null;
  }
  if (mode == SSLFactory.Mode.SERVER) {
    sslConfFileName = "ssl-server.xml";
    sslConf = KeyStoreTestUtil.createServerSSLConfig(keystore, confPassword,
      confKeyPassword, truststore);
    if (useCredProvider) {
      File testDir = new File(System.getProperty("test.build.data",
          "target/test-dir"));
      final Path jksPath = new Path(testDir.toString(), "test.jks");
      final String ourUrl =
          JavaKeyStoreProvider.SCHEME_NAME + "://file" + jksPath.toUri();
      sslConf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, ourUrl);
    }
  } else {
    sslConfFileName = "ssl-client.xml";
    sslConf = KeyStoreTestUtil.createClientSSLConfig(keystore, confPassword,
      confKeyPassword, truststore);
  }
  KeyStoreTestUtil.saveConfig(new File(sslConfsDir, sslConfFileName), sslConf);

  // Create the master configuration for use by the SSLFactory, which by
  // default refers to the ssl-server.xml or ssl-client.xml created above.
  Configuration conf = new Configuration();
  conf.setBoolean(SSLFactory.SSL_REQUIRE_CLIENT_CERT_KEY, true);

  // Try initializing an SSLFactory.
  SSLFactory sslFactory = new SSLFactory(mode, conf);
  try {
    sslFactory.init();
  } finally {
    sslFactory.destroy();
  }
}

Source File: TestDFSUtil.java From hadoop with Apache License 2.0

4 votes

@Test
public void testGetPassword() throws Exception {
  File testDir = new File(System.getProperty("test.build.data",
      "target/test-dir"));

  Configuration conf = new Configuration();
  final Path jksPath = new Path(testDir.toString(), "test.jks");
  final String ourUrl =
  JavaKeyStoreProvider.SCHEME_NAME + "://file" + jksPath.toUri();

  File file = new File(testDir, "test.jks");
  file.delete();
  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, ourUrl);

  CredentialProvider provider =
      CredentialProviderFactory.getProviders(conf).get(0);
  char[] keypass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
  char[] storepass = {'s', 't', 'o', 'r', 'e', 'p', 'a', 's', 's'};
  char[] trustpass = {'t', 'r', 'u', 's', 't', 'p', 'a', 's', 's'};

  // ensure that we get nulls when the key isn't there
  assertEquals(null, provider.getCredentialEntry(
      DFS_SERVER_HTTPS_KEYPASSWORD_KEY));
  assertEquals(null, provider.getCredentialEntry(
      DFS_SERVER_HTTPS_KEYSTORE_PASSWORD_KEY));
  assertEquals(null, provider.getCredentialEntry(
      DFS_SERVER_HTTPS_TRUSTSTORE_PASSWORD_KEY));

  // create new aliases
  try {
    provider.createCredentialEntry(
        DFS_SERVER_HTTPS_KEYPASSWORD_KEY, keypass);

    provider.createCredentialEntry(
        DFS_SERVER_HTTPS_KEYSTORE_PASSWORD_KEY, storepass);

    provider.createCredentialEntry(
        DFS_SERVER_HTTPS_TRUSTSTORE_PASSWORD_KEY, trustpass);

    // write out so that it can be found in checks
    provider.flush();
  } catch (Exception e) {
    e.printStackTrace();
    throw e;
  }
  // make sure we get back the right key directly from api
  assertArrayEquals(keypass, provider.getCredentialEntry(
      DFS_SERVER_HTTPS_KEYPASSWORD_KEY).getCredential());
  assertArrayEquals(storepass, provider.getCredentialEntry(
      DFS_SERVER_HTTPS_KEYSTORE_PASSWORD_KEY).getCredential());
  assertArrayEquals(trustpass, provider.getCredentialEntry(
      DFS_SERVER_HTTPS_TRUSTSTORE_PASSWORD_KEY).getCredential());

  // use WebAppUtils as would be used by loadSslConfiguration
  Assert.assertEquals("keypass",
      DFSUtil.getPassword(conf, DFS_SERVER_HTTPS_KEYPASSWORD_KEY));
  Assert.assertEquals("storepass",
      DFSUtil.getPassword(conf, DFS_SERVER_HTTPS_KEYSTORE_PASSWORD_KEY));
  Assert.assertEquals("trustpass",
      DFSUtil.getPassword(conf, DFS_SERVER_HTTPS_TRUSTSTORE_PASSWORD_KEY));

  // let's make sure that a password that doesn't exist returns null
  Assert.assertEquals(null, DFSUtil.getPassword(conf,"invalid-alias"));
}

Source File: TestWebAppUtils.java From hadoop with Apache License 2.0

4 votes

protected Configuration provisionCredentialsForSSL() throws IOException,
    Exception {
  File testDir = new File(System.getProperty("test.build.data",
      "target/test-dir"));

  Configuration conf = new Configuration();
  final Path jksPath = new Path(testDir.toString(), "test.jks");
  final String ourUrl =
  JavaKeyStoreProvider.SCHEME_NAME + "://file" + jksPath.toUri();

  File file = new File(testDir, "test.jks");
  file.delete();
  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, ourUrl);

  CredentialProvider provider =
      CredentialProviderFactory.getProviders(conf).get(0);
  char[] keypass = {'k', 'e', 'y', 'p', 'a', 's', 's'};
  char[] storepass = {'s', 't', 'o', 'r', 'e', 'p', 'a', 's', 's'};
  char[] trustpass = {'t', 'r', 'u', 's', 't', 'p', 'a', 's', 's'};

  // ensure that we get nulls when the key isn't there
  assertEquals(null, provider.getCredentialEntry(
      WebAppUtils.WEB_APP_KEY_PASSWORD_KEY));
  assertEquals(null, provider.getCredentialEntry(
      WebAppUtils.WEB_APP_KEYSTORE_PASSWORD_KEY));
  assertEquals(null, provider.getCredentialEntry(
      WebAppUtils.WEB_APP_TRUSTSTORE_PASSWORD_KEY));

  // create new aliases
  try {
    provider.createCredentialEntry(
        WebAppUtils.WEB_APP_KEY_PASSWORD_KEY, keypass);

    provider.createCredentialEntry(
        WebAppUtils.WEB_APP_KEYSTORE_PASSWORD_KEY, storepass);

    provider.createCredentialEntry(
        WebAppUtils.WEB_APP_TRUSTSTORE_PASSWORD_KEY, trustpass);

    // write out so that it can be found in checks
    provider.flush();
  } catch (Exception e) {
    e.printStackTrace();
    throw e;
  }
  // make sure we get back the right key directly from api
  assertArrayEquals(keypass, provider.getCredentialEntry(
      WebAppUtils.WEB_APP_KEY_PASSWORD_KEY).getCredential());
  assertArrayEquals(storepass, provider.getCredentialEntry(
      WebAppUtils.WEB_APP_KEYSTORE_PASSWORD_KEY).getCredential());
  assertArrayEquals(trustpass, provider.getCredentialEntry(
      WebAppUtils.WEB_APP_TRUSTSTORE_PASSWORD_KEY).getCredential());
  return conf;
}

Source File: S3MapReduceCpCopierTest.java From circus-train with Apache License 2.0

4 votes

@Before
public void setupLibJarPath() throws Exception {
  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH, credentialsProvider.toString());
  when(job.waitForCompletion(anyBoolean())).thenReturn(true);
  when(executor.exec(any(Configuration.class), any(S3MapReduceCpOptions.class))).thenReturn(job);
}

Source File: CredentialReader.java From ranger with Apache License 2.0

4 votes

public static String getDecryptedString(String CrendentialProviderPath,String alias) {
 String credential=null;
 try{
  if(CrendentialProviderPath==null || alias==null){
	  return null;
  }		  		
  char[] pass = null;
  Configuration conf = new Configuration();
  String crendentialProviderPrefixJceks=JavaKeyStoreProvider.SCHEME_NAME + "://file";
  String crendentialProviderPrefixLocalJceks="localjceks://file";
  crendentialProviderPrefixJceks=crendentialProviderPrefixJceks.toLowerCase();
  CrendentialProviderPath=CrendentialProviderPath.trim();
  alias=alias.trim();
  if(CrendentialProviderPath.toLowerCase().startsWith(crendentialProviderPrefixJceks) || CrendentialProviderPath.toLowerCase().startsWith(crendentialProviderPrefixLocalJceks)){
	  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH,
			   //UserProvider.SCHEME_NAME + ":///," +
	  CrendentialProviderPath);
  }else{
	  if(CrendentialProviderPath.startsWith("/")){
		  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH,
				   //UserProvider.SCHEME_NAME + ":///," +
		  JavaKeyStoreProvider.SCHEME_NAME + "://file" + CrendentialProviderPath);
	  }else{
		  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH,
				   //UserProvider.SCHEME_NAME + ":///," +
				  JavaKeyStoreProvider.SCHEME_NAME + "://file/" + CrendentialProviderPath);
	  }
  }
  List<CredentialProvider> providers = CredentialProviderFactory.getProviders(conf);
  List<String> aliasesList=new ArrayList<String>();
  CredentialProvider.CredentialEntry credEntry=null;
  for(CredentialProvider provider: providers) {
            //System.out.println("Credential Provider :" + provider);
	  aliasesList=provider.getAliases();
	  if(aliasesList!=null && aliasesList.contains(alias.toLowerCase())){
		  credEntry=null;
		  credEntry= provider.getCredentialEntry(alias);
		  pass = credEntry.getCredential();
		  if(pass!=null && pass.length>0){
			  credential=String.valueOf(pass);
			  break;
		  }				
	  }
  }
 }catch(Exception ex){
  ex.printStackTrace();
  credential=null;
 }
 return credential;
}

Source File: CredentialReader.java From ranger with Apache License 2.0

4 votes

public static String getDecryptedString(String CrendentialProviderPath,String alias) {
 String credential=null;
 try{
  if(CrendentialProviderPath==null || alias==null||CrendentialProviderPath.trim().isEmpty()||alias.trim().isEmpty()){
	  return null;
  }		  		
  char[] pass = null;
  Configuration conf = new Configuration();
  String crendentialProviderPrefixJceks=JavaKeyStoreProvider.SCHEME_NAME + "://file";
  String crendentialProviderPrefixLocalJceks="localjceks://file";
  crendentialProviderPrefixJceks=crendentialProviderPrefixJceks.toLowerCase();
  CrendentialProviderPath=CrendentialProviderPath.trim();
  alias=alias.trim();
  if(CrendentialProviderPath.toLowerCase().startsWith(crendentialProviderPrefixJceks) ||  CrendentialProviderPath.toLowerCase().startsWith(crendentialProviderPrefixLocalJceks)){
	  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH,
			   //UserProvider.SCHEME_NAME + ":///," +
	  CrendentialProviderPath);
  }else{
	  if(CrendentialProviderPath.startsWith("/")){
		  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH,
				   //UserProvider.SCHEME_NAME + ":///," +
		  JavaKeyStoreProvider.SCHEME_NAME + "://file" + CrendentialProviderPath);
	  }else{
		  conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH,
				   //UserProvider.SCHEME_NAME + ":///," +
		  JavaKeyStoreProvider.SCHEME_NAME + "://file/" + CrendentialProviderPath);
	  }
  }	 	
  List<CredentialProvider> providers = CredentialProviderFactory.getProviders(conf);
  List<String> aliasesList=new ArrayList<String>();
  CredentialProvider.CredentialEntry credEntry=null;
  for(CredentialProvider provider: providers) {
            //System.out.println("Credential Provider :" + provider);
	  aliasesList=provider.getAliases();
	  if(aliasesList!=null && aliasesList.contains(alias.toLowerCase())){
		  credEntry=null;
		  credEntry= provider.getCredentialEntry(alias);
		  pass = credEntry.getCredential();
		  if(pass!=null && pass.length>0){
			  credential=String.valueOf(pass);
			  break;
		  }				
	  }
  }
 }catch(Exception ex){
  ex.printStackTrace();
  credential=null;
 }
 return credential;
}

org.apache.hadoop.security.alias.CredentialProviderFactory Java Examples