Java Code Examples for org.apache.hadoop.security.authentication.util.KerberosUtil#getKrb5LoginModuleName()

The following examples show how to use org.apache.hadoop.security.authentication.util.KerberosUtil#getKrb5LoginModuleName() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: KerberosConfiguration.java    From hadoop with Apache License 2.0 6 votes vote down vote up 
@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("keyTab", keytab);
  options.put("principal", principal);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", Boolean.toString(isInitiator));
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
      new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
          AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
          options)
  };
}
Example 2
Source File: KerberosTestUtils.java    From hadoop with Apache License 2.0 6 votes vote down vote up 
@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("keyTab", KerberosTestUtils.getKeytabFile());
  options.put("principal", principal);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
    new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
                              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
                              options),};
}
Example 3
Source File: TestWebDelegationToken.java    From hadoop with Apache License 2.0 6 votes vote down vote up 
@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("principal", principal);
  options.put("keyTab", keytab);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
      new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
          AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
          options),};
}
Example 4
Source File: KerberosTestUtils.java    From hadoop with Apache License 2.0 6 votes vote down vote up 
@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("keyTab", KerberosTestUtils.getKeytabFile());
  options.put("principal", principal);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
    new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
                              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
                              options),};
}
Example 5
Source File: KerberosConfiguration.java    From big-c with Apache License 2.0 6 votes vote down vote up 
@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("keyTab", keytab);
  options.put("principal", principal);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", Boolean.toString(isInitiator));
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
      new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
          AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
          options)
  };
}
Example 6
Source File: KerberosTestUtils.java    From big-c with Apache License 2.0 6 votes vote down vote up 
@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("keyTab", KerberosTestUtils.getKeytabFile());
  options.put("principal", principal);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
    new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
                              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
                              options),};
}
Example 7
Source File: TestWebDelegationToken.java    From big-c with Apache License 2.0 6 votes vote down vote up 
@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("principal", principal);
  options.put("keyTab", keytab);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
      new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
          AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
          options),};
}
Example 8
Source File: KerberosTestUtils.java    From big-c with Apache License 2.0 6 votes vote down vote up 
@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("keyTab", KerberosTestUtils.getKeytabFile());
  options.put("principal", principal);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
    new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
                              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
                              options),};
}
Example 9
Source File: KerberosAuthenticationHandler.java    From hadoop with Apache License 2.0 5 votes vote down vote up 
@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  if (IBM_JAVA) {
    options.put("useKeytab",
        keytab.startsWith("file://") ? keytab : "file://" + keytab);
    options.put("principal", principal);
    options.put("credsType", "acceptor");
  } else {
    options.put("keyTab", keytab);
    options.put("principal", principal);
    options.put("useKeyTab", "true");
    options.put("storeKey", "true");
    options.put("doNotPrompt", "true");
    options.put("useTicketCache", "true");
    options.put("renewTGT", "true");
    options.put("isInitiator", "false");
  }
  options.put("refreshKrb5Config", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    if (IBM_JAVA) {
      options.put("useDefaultCcache", "true");
      // The first value searched when "useDefaultCcache" is used.
      System.setProperty("KRB5CCNAME", ticketCache);
      options.put("renewTGT", "true");
      options.put("credsType", "both");
    } else {
      options.put("ticketCache", ticketCache);
    }
  }
  if (LOG.isDebugEnabled()) {
    options.put("debug", "true");
  }

  return new AppConfigurationEntry[]{
      new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
                              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
                              options),};
}
Example 10
Source File: KerberosAuthenticationHandler.java    From big-c with Apache License 2.0 5 votes vote down vote up 
@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  if (IBM_JAVA) {
    options.put("useKeytab",
        keytab.startsWith("file://") ? keytab : "file://" + keytab);
    options.put("principal", principal);
    options.put("credsType", "acceptor");
  } else {
    options.put("keyTab", keytab);
    options.put("principal", principal);
    options.put("useKeyTab", "true");
    options.put("storeKey", "true");
    options.put("doNotPrompt", "true");
    options.put("useTicketCache", "true");
    options.put("renewTGT", "true");
    options.put("isInitiator", "false");
  }
  options.put("refreshKrb5Config", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    if (IBM_JAVA) {
      options.put("useDefaultCcache", "true");
      // The first value searched when "useDefaultCcache" is used.
      System.setProperty("KRB5CCNAME", ticketCache);
      options.put("renewTGT", "true");
      options.put("credsType", "both");
    } else {
      options.put("ticketCache", ticketCache);
    }
  }
  if (LOG.isDebugEnabled()) {
    options.put("debug", "true");
  }

  return new AppConfigurationEntry[]{
      new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
                              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
                              options),};
}
Example 11
Source File: SecureClientLogin.java    From ranger with Apache License 2.0 5 votes vote down vote up 
@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String appName) {
	AppConfigurationEntry KEYTAB_KERBEROS_LOGIN = new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(), LoginModuleControlFlag.REQUIRED, kerberosOptions);
	if (usePassword) {
		AppConfigurationEntry KERBEROS_PWD_SAVER = new AppConfigurationEntry(KrbPasswordSaverLoginModule.class.getName(), LoginModuleControlFlag.REQUIRED, kerberosOptions);
		return new AppConfigurationEntry[] { KERBEROS_PWD_SAVER, KEYTAB_KERBEROS_LOGIN };
	}
	else {
		return new AppConfigurationEntry[] { KEYTAB_KERBEROS_LOGIN };
	}
}
Example 12
Source File: MiscUtil.java    From ranger with Apache License 2.0 5 votes vote down vote up 
@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
	Map<String, String> options = new HashMap<String, String>();
	if (IBM_JAVA) {
		options.put("useKeytab", keytab.startsWith("file://") ? keytab
				: "file://" + keytab);
		options.put("principal", principal);
		options.put("credsType", "acceptor");
	} else {
		options.put("keyTab", keytab);
		options.put("principal", principal);
		options.put("useKeyTab", "true");
		options.put("storeKey", "true");
		options.put("doNotPrompt", "true");
		options.put("useTicketCache", "true");
		options.put("renewTGT", "true");
		options.put("isInitiator", "false");
	}
	options.put("refreshKrb5Config", "true");
	String ticketCache = System.getenv("KRB5CCNAME");
	if (ticketCache != null) {
		if (IBM_JAVA) {
			options.put("useDefaultCcache", "true");
			// The first value searched when "useDefaultCcache" is used.
			System.setProperty("KRB5CCNAME", ticketCache);
			options.put("renewTGT", "true");
			options.put("credsType", "both");
		} else {
			options.put("ticketCache", ticketCache);
		}
	}
	if (logger.isDebugEnabled()) {
		options.put("debug", "true");
	}

	return new AppConfigurationEntry[] { new AppConfigurationEntry(
			KerberosUtil.getKrb5LoginModuleName(),
			AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
			options), };
}
Example 13
Source File: PxfUserGroupInformation.java    From pxf with Apache License 2.0 4 votes vote down vote up 
private HadoopConfiguration(String keytabPrincipal, String keytabFile) {
    this.keytabFile = keytabFile;
    this.keytabPrincipal = keytabPrincipal;

    String ticketCache = System.getenv("HADOOP_JAAS_DEBUG");
    if ("true".equalsIgnoreCase(ticketCache)) {
        BASIC_JAAS_OPTIONS.put("debug", "true");
    }

    OS_SPECIFIC_LOGIN = new AppConfigurationEntry(OS_LOGIN_MODULE_NAME, AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, BASIC_JAAS_OPTIONS);
    HADOOP_LOGIN = new AppConfigurationEntry(UserGroupInformation.HadoopLoginModule.class.getName(), AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, BASIC_JAAS_OPTIONS);
    USER_KERBEROS_OPTIONS = new HashMap<>();
    if (PlatformName.IBM_JAVA) {
        USER_KERBEROS_OPTIONS.put("useDefaultCcache", "true");
    } else {
        USER_KERBEROS_OPTIONS.put("doNotPrompt", "true");
        USER_KERBEROS_OPTIONS.put("useTicketCache", "true");
    }

    ticketCache = System.getenv("KRB5CCNAME");
    if (ticketCache != null) {
        if (PlatformName.IBM_JAVA) {
            System.setProperty("KRB5CCNAME", ticketCache);
        } else {
            USER_KERBEROS_OPTIONS.put("ticketCache", ticketCache);
        }
    }

    USER_KERBEROS_OPTIONS.put("renewTGT", "true");
    USER_KERBEROS_OPTIONS.putAll(BASIC_JAAS_OPTIONS);
    USER_KERBEROS_LOGIN = new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(), AppConfigurationEntry.LoginModuleControlFlag.OPTIONAL, USER_KERBEROS_OPTIONS);
    KEYTAB_KERBEROS_OPTIONS = new HashMap<>();
    if (PlatformName.IBM_JAVA) {
        KEYTAB_KERBEROS_OPTIONS.put("credsType", "both");
    } else {
        KEYTAB_KERBEROS_OPTIONS.put("doNotPrompt", "true");
        KEYTAB_KERBEROS_OPTIONS.put("useKeyTab", "true");
        KEYTAB_KERBEROS_OPTIONS.put("storeKey", "true");
    }

    KEYTAB_KERBEROS_OPTIONS.put("refreshKrb5Config", "true");
    KEYTAB_KERBEROS_OPTIONS.putAll(BASIC_JAAS_OPTIONS);
    KEYTAB_KERBEROS_LOGIN = new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(), AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, KEYTAB_KERBEROS_OPTIONS);
    SIMPLE_CONF = new AppConfigurationEntry[]{OS_SPECIFIC_LOGIN, HADOOP_LOGIN};
    USER_KERBEROS_CONF = new AppConfigurationEntry[]{OS_SPECIFIC_LOGIN, USER_KERBEROS_LOGIN, HADOOP_LOGIN};
    KEYTAB_KERBEROS_CONF = new AppConfigurationEntry[]{KEYTAB_KERBEROS_LOGIN, HADOOP_LOGIN};
}
Example 14
Source File: UserGroupInformation.java    From hadoop with Apache License 2.0 4 votes vote down vote up 
/**
 * Create a UserGroupInformation from a Kerberos ticket cache.
 * 
 * @param user                The principal name to load from the ticket
 *                            cache
 * @param ticketCachePath     the path to the ticket cache file
 *
 * @throws IOException        if the kerberos login fails
 */
@InterfaceAudience.Public
@InterfaceStability.Evolving
public static UserGroupInformation getUGIFromTicketCache(
          String ticketCache, String user) throws IOException {
  if (!isAuthenticationMethodEnabled(AuthenticationMethod.KERBEROS)) {
    return getBestUGI(null, user);
  }
  try {
    Map<String,String> krbOptions = new HashMap<String,String>();
    if (IBM_JAVA) {
      krbOptions.put("useDefaultCcache", "true");
      // The first value searched when "useDefaultCcache" is used.
      System.setProperty("KRB5CCNAME", ticketCache);
    } else {
      krbOptions.put("doNotPrompt", "true");
      krbOptions.put("useTicketCache", "true");
      krbOptions.put("useKeyTab", "false");
      krbOptions.put("ticketCache", ticketCache);
    }
    krbOptions.put("renewTGT", "false");
    krbOptions.putAll(HadoopConfiguration.BASIC_JAAS_OPTIONS);
    AppConfigurationEntry ace = new AppConfigurationEntry(
        KerberosUtil.getKrb5LoginModuleName(),
        LoginModuleControlFlag.REQUIRED,
        krbOptions);
    DynamicConfiguration dynConf =
        new DynamicConfiguration(new AppConfigurationEntry[]{ ace });
    LoginContext login = newLoginContext(
        HadoopConfiguration.USER_KERBEROS_CONFIG_NAME, null, dynConf);
    login.login();

    Subject loginSubject = login.getSubject();
    Set<Principal> loginPrincipals = loginSubject.getPrincipals();
    if (loginPrincipals.isEmpty()) {
      throw new RuntimeException("No login principals found!");
    }
    if (loginPrincipals.size() != 1) {
      LOG.warn("found more than one principal in the ticket cache file " +
        ticketCache);
    }
    User ugiUser = new User(loginPrincipals.iterator().next().getName(),
        AuthenticationMethod.KERBEROS, login);
    loginSubject.getPrincipals().add(ugiUser);
    UserGroupInformation ugi = new UserGroupInformation(loginSubject);
    ugi.setLogin(login);
    ugi.setAuthenticationMethod(AuthenticationMethod.KERBEROS);
    return ugi;
  } catch (LoginException le) {
    throw new IOException("failure to login using ticket cache file " +
        ticketCache, le);
  }
}
Example 15
Source File: UserGroupInformation.java    From big-c with Apache License 2.0 4 votes vote down vote up 
/**
 * Create a UserGroupInformation from a Kerberos ticket cache.
 * 
 * @param user                The principal name to load from the ticket
 *                            cache
 * @param ticketCachePath     the path to the ticket cache file
 *
 * @throws IOException        if the kerberos login fails
 */
@InterfaceAudience.Public
@InterfaceStability.Evolving
public static UserGroupInformation getUGIFromTicketCache(
          String ticketCache, String user) throws IOException {
  if (!isAuthenticationMethodEnabled(AuthenticationMethod.KERBEROS)) {
    return getBestUGI(null, user);
  }
  try {
    Map<String,String> krbOptions = new HashMap<String,String>();
    if (IBM_JAVA) {
      krbOptions.put("useDefaultCcache", "true");
      // The first value searched when "useDefaultCcache" is used.
      System.setProperty("KRB5CCNAME", ticketCache);
    } else {
      krbOptions.put("doNotPrompt", "true");
      krbOptions.put("useTicketCache", "true");
      krbOptions.put("useKeyTab", "false");
      krbOptions.put("ticketCache", ticketCache);
    }
    krbOptions.put("renewTGT", "false");
    krbOptions.putAll(HadoopConfiguration.BASIC_JAAS_OPTIONS);
    AppConfigurationEntry ace = new AppConfigurationEntry(
        KerberosUtil.getKrb5LoginModuleName(),
        LoginModuleControlFlag.REQUIRED,
        krbOptions);
    DynamicConfiguration dynConf =
        new DynamicConfiguration(new AppConfigurationEntry[]{ ace });
    LoginContext login = newLoginContext(
        HadoopConfiguration.USER_KERBEROS_CONFIG_NAME, null, dynConf);
    login.login();

    Subject loginSubject = login.getSubject();
    Set<Principal> loginPrincipals = loginSubject.getPrincipals();
    if (loginPrincipals.isEmpty()) {
      throw new RuntimeException("No login principals found!");
    }
    if (loginPrincipals.size() != 1) {
      LOG.warn("found more than one principal in the ticket cache file " +
        ticketCache);
    }
    User ugiUser = new User(loginPrincipals.iterator().next().getName(),
        AuthenticationMethod.KERBEROS, login);
    loginSubject.getPrincipals().add(ugiUser);
    UserGroupInformation ugi = new UserGroupInformation(loginSubject);
    ugi.setLogin(login);
    ugi.setAuthenticationMethod(AuthenticationMethod.KERBEROS);
    return ugi;
  } catch (LoginException le) {
    throw new IOException("failure to login using ticket cache file " +
        ticketCache, le);
  }
}