Skip to content

Commit cdce883

Browse files
zjshen14zjshen14
committed
HADOOP-11181. Generalized o.a.h.s.t.d.DelegationTokenManager to handle all sub-classes of AbstractDelegationTokenIdentifier. Contributed by Zhijie Shen.
1 parent 7dcad84 commit cdce883

File tree

9 files changed

+135
-55
lines changed

9 files changed

+135
-55
lines changed

‎hadoop-common-project/hadoop-common/CHANGES.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -594,6 +594,10 @@ Release 2.6.0 - UNRELEASED
594594

595595
HADOOP-11184. Update Hadoop's lz4 to version r123. (cmccabe)
596596

597+
HADOOP-11181. Generalized o.a.h.s.t.d.DelegationTokenManager to handle all
598+
sub-classes of AbstractDelegationTokenIdentifier. (zjshen)
599+
600+
597601
OPTIMIZATIONS
598602

599603
HADOOP-10838. Byte array native checksumming. (James Thomas via todd)

‎hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenIdentifier.java‎

Lines changed: 34 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -53,26 +53,9 @@ public AbstractDelegationTokenIdentifier() {
5353
}
5454

5555
public AbstractDelegationTokenIdentifier(Text owner, Text renewer, Text realUser) {
56-
if (owner == null) {
57-
this.owner = new Text();
58-
} else {
59-
this.owner = owner;
60-
}
61-
if (renewer == null) {
62-
this.renewer = new Text();
63-
} else {
64-
HadoopKerberosName renewerKrbName = new HadoopKerberosName(renewer.toString());
65-
try {
66-
this.renewer = new Text(renewerKrbName.getShortName());
67-
} catch (IOException e) {
68-
throw new RuntimeException(e);
69-
}
70-
}
71-
if (realUser == null) {
72-
this.realUser = new Text();
73-
} else {
74-
this.realUser = realUser;
75-
}
56+
setOwner(owner);
57+
setRenewer(renewer);
58+
setRealUser(realUser);
7659
issueDate = 0;
7760
maxDate = 0;
7861
}
@@ -107,14 +90,43 @@ public Text getOwner() {
10790
return owner;
10891
}
10992

93+
public void setOwner(Text owner) {
94+
if (owner == null) {
95+
this.owner = new Text();
96+
} else {
97+
this.owner = owner;
98+
}
99+
}
100+
110101
public Text getRenewer() {
111102
return renewer;
112103
}
113-
104+
105+
public void setRenewer(Text renewer) {
106+
if (renewer == null) {
107+
this.renewer = new Text();
108+
} else {
109+
HadoopKerberosName renewerKrbName = new HadoopKerberosName(renewer.toString());
110+
try {
111+
this.renewer = new Text(renewerKrbName.getShortName());
112+
} catch (IOException e) {
113+
throw new RuntimeException(e);
114+
}
115+
}
116+
}
117+
114118
public Text getRealUser() {
115119
return realUser;
116120
}
117-
121+
122+
public void setRealUser(Text realUser) {
123+
if (realUser == null) {
124+
this.realUser = new Text();
125+
} else {
126+
this.realUser = realUser;
127+
}
128+
}
129+
118130
public void setIssueDate(long issueDate) {
119131
this.issueDate = issueDate;
120132
}

‎hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -648,4 +648,17 @@ public void run() {
648648
}
649649
}
650650
}
651+
652+
/**
653+
* Decode the token identifier. The subclass can customize the way to decode
654+
* the token identifier.
655+
*
656+
* @param token the token where to extract the identifier
657+
* @return the delegation token identifier
658+
* @throws IOException
659+
*/
660+
public TokenIdent decodeTokenIdentifier(Token<TokenIdent> token) throws IOException {
661+
return token.decodeIdentifier();
662+
}
663+
651664
}

‎hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticationHandler.java‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import org.apache.hadoop.security.authentication.server.AuthenticationToken;
2929
import org.apache.hadoop.security.authentication.server.KerberosAuthenticationHandler;
3030
import org.apache.hadoop.security.token.Token;
31+
import org.apache.hadoop.security.token.delegation.AbstractDelegationTokenIdentifier;
3132
import org.apache.hadoop.security.token.delegation.AbstractDelegationTokenSecretManager;
3233
import org.apache.hadoop.util.HttpExceptionUtils;
3334
import org.codehaus.jackson.map.ObjectMapper;
@@ -216,8 +217,7 @@ public boolean managementOperation(AuthenticationToken token,
216217
);
217218
requestContinues = false;
218219
} else {
219-
Token<DelegationTokenIdentifier> dt =
220-
new Token<DelegationTokenIdentifier>();
220+
Token<AbstractDelegationTokenIdentifier> dt = new Token();
221221
try {
222222
dt.decodeFromUrlString(tokenToRenew);
223223
long expirationTime = tokenManager.renewToken(dt,
@@ -240,8 +240,7 @@ public boolean managementOperation(AuthenticationToken token,
240240
);
241241
requestContinues = false;
242242
} else {
243-
Token<DelegationTokenIdentifier> dt =
244-
new Token<DelegationTokenIdentifier>();
243+
Token<AbstractDelegationTokenIdentifier> dt = new Token();
245244
try {
246245
dt.decodeFromUrlString(tokenToCancel);
247246
tokenManager.cancelToken(dt, (requestUgi != null)
@@ -303,6 +302,7 @@ private static Map delegationTokenToJSON(Token token) throws IOException {
303302
* @throws IOException thrown if an IO error occurred.
304303
* @throws AuthenticationException thrown if the authentication failed.
305304
*/
305+
@SuppressWarnings("unchecked")
306306
@Override
307307
public AuthenticationToken authenticate(HttpServletRequest request,
308308
HttpServletResponse response)
@@ -311,8 +311,7 @@ public AuthenticationToken authenticate(HttpServletRequest request,
311311
String delegationParam = getDelegationToken(request);
312312
if (delegationParam != null) {
313313
try {
314-
Token<DelegationTokenIdentifier> dt =
315-
new Token<DelegationTokenIdentifier>();
314+
Token<AbstractDelegationTokenIdentifier> dt = new Token();
316315
dt.decodeFromUrlString(delegationParam);
317316
UserGroupInformation ugi = tokenManager.verifyToken(dt);
318317
final String shortName = ugi.getShortUserName();

‎hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenManager.java‎

Lines changed: 42 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
import org.apache.hadoop.io.Text;
2828
import org.apache.hadoop.security.UserGroupInformation;
2929
import org.apache.hadoop.security.token.Token;
30+
import org.apache.hadoop.security.token.delegation.AbstractDelegationTokenIdentifier;
3031
import org.apache.hadoop.security.token.delegation.AbstractDelegationTokenSecretManager;
3132
import org.apache.hadoop.security.token.delegation.ZKDelegationTokenSecretManager;
3233

@@ -76,6 +77,13 @@ public DelegationTokenSecretManager(Configuration conf, Text tokenKind) {
7677
public DelegationTokenIdentifier createIdentifier() {
7778
return new DelegationTokenIdentifier(tokenKind);
7879
}
80+
81+
@Override
82+
public DelegationTokenIdentifier decodeTokenIdentifier(
83+
Token<DelegationTokenIdentifier> token) throws IOException {
84+
return DelegationTokenManager.decodeToken(token, tokenKind);
85+
}
86+
7987
}
8088

8189
private static class ZKSecretManager
@@ -92,19 +100,23 @@ public ZKSecretManager(Configuration conf, Text tokenKind) {
92100
public DelegationTokenIdentifier createIdentifier() {
93101
return new DelegationTokenIdentifier(tokenKind);
94102
}
103+
104+
@Override
105+
public DelegationTokenIdentifier decodeTokenIdentifier(
106+
Token<DelegationTokenIdentifier> token) throws IOException {
107+
return DelegationTokenManager.decodeToken(token, tokenKind);
108+
}
95109
}
96110

97111
private AbstractDelegationTokenSecretManager secretManager = null;
98112
private boolean managedSecretManager;
99-
private Text tokenKind;
100113

101114
public DelegationTokenManager(Configuration conf, Text tokenKind) {
102115
if (conf.getBoolean(ENABLE_ZK_KEY, false)) {
103116
this.secretManager = new ZKSecretManager(conf, tokenKind);
104117
} else {
105118
this.secretManager = new DelegationTokenSecretManager(conf, tokenKind);
106119
}
107-
this.tokenKind = tokenKind;
108120
managedSecretManager = true;
109121
}
110122

@@ -121,7 +133,6 @@ public void setExternalDelegationTokenSecretManager(
121133
AbstractDelegationTokenSecretManager secretManager) {
122134
this.secretManager.stopThreads();
123135
this.secretManager = secretManager;
124-
this.tokenKind = secretManager.createIdentifier().getKind();
125136
managedSecretManager = false;
126137
}
127138

@@ -143,42 +154,44 @@ public void destroy() {
143154
}
144155

145156
@SuppressWarnings("unchecked")
146-
public Token<DelegationTokenIdentifier> createToken(UserGroupInformation ugi,
147-
String renewer) {
157+
public Token<? extends AbstractDelegationTokenIdentifier> createToken(
158+
UserGroupInformation ugi, String renewer) {
148159
renewer = (renewer == null) ? ugi.getShortUserName() : renewer;
149160
String user = ugi.getUserName();
150161
Text owner = new Text(user);
151162
Text realUser = null;
152163
if (ugi.getRealUser() != null) {
153164
realUser = new Text(ugi.getRealUser().getUserName());
154165
}
155-
DelegationTokenIdentifier tokenIdentifier = new DelegationTokenIdentifier(
156-
tokenKind, owner, new Text(renewer), realUser);
157-
return new Token<DelegationTokenIdentifier>(tokenIdentifier, secretManager);
166+
AbstractDelegationTokenIdentifier tokenIdentifier =
167+
(AbstractDelegationTokenIdentifier) secretManager.createIdentifier();
168+
tokenIdentifier.setOwner(owner);
169+
tokenIdentifier.setRenewer(new Text(renewer));
170+
tokenIdentifier.setRealUser(realUser);
171+
return new Token(tokenIdentifier, secretManager);
158172
}
159173

160174
@SuppressWarnings("unchecked")
161-
public long renewToken(Token<DelegationTokenIdentifier> token, String renewer)
162-
throws IOException {
175+
public long renewToken(
176+
Token<? extends AbstractDelegationTokenIdentifier> token, String renewer)
177+
throws IOException {
163178
return secretManager.renewToken(token, renewer);
164179
}
165180

166181
@SuppressWarnings("unchecked")
167-
public void cancelToken(Token<DelegationTokenIdentifier> token,
182+
public void cancelToken(
183+
Token<? extends AbstractDelegationTokenIdentifier> token,
168184
String canceler) throws IOException {
169185
canceler = (canceler != null) ? canceler :
170186
verifyToken(token).getShortUserName();
171187
secretManager.cancelToken(token, canceler);
172188
}
173189

174190
@SuppressWarnings("unchecked")
175-
public UserGroupInformation verifyToken(Token<DelegationTokenIdentifier>
176-
token) throws IOException {
177-
ByteArrayInputStream buf = new ByteArrayInputStream(token.getIdentifier());
178-
DataInputStream dis = new DataInputStream(buf);
179-
DelegationTokenIdentifier id = new DelegationTokenIdentifier(tokenKind);
180-
id.readFields(dis);
181-
dis.close();
191+
public UserGroupInformation verifyToken(
192+
Token<? extends AbstractDelegationTokenIdentifier> token)
193+
throws IOException {
194+
AbstractDelegationTokenIdentifier id = secretManager.decodeTokenIdentifier(token);
182195
secretManager.verifyToken(id, token.getPassword());
183196
return id.getUser();
184197
}
@@ -188,4 +201,15 @@ public UserGroupInformation verifyToken(Token<DelegationTokenIdentifier>
188201
public AbstractDelegationTokenSecretManager getDelegationTokenSecretManager() {
189202
return secretManager;
190203
}
204+
205+
private static DelegationTokenIdentifier decodeToken(
206+
Token<DelegationTokenIdentifier> token, Text tokenKind)
207+
throws IOException {
208+
ByteArrayInputStream buf = new ByteArrayInputStream(token.getIdentifier());
209+
DataInputStream dis = new DataInputStream(buf);
210+
DelegationTokenIdentifier id = new DelegationTokenIdentifier(tokenKind);
211+
id.readFields(dis);
212+
dis.close();
213+
return id;
214+
}
191215
}

‎hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/token/delegation/TestZKDelegationTokenSecretManager.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ public class TestZKDelegationTokenSecretManager {
3232

3333
private static final long DAY_IN_SECS = 86400;
3434

35+
@SuppressWarnings("unchecked")
3536
@Test
3637
public void testZKDelTokSecretManager() throws Exception {
3738
TestingServer zkServer = new TestingServer();
@@ -54,11 +55,13 @@ public void testZKDelTokSecretManager() throws Exception {
5455
tm2.init();
5556

5657
Token<DelegationTokenIdentifier> token =
57-
tm1.createToken(UserGroupInformation.getCurrentUser(), "foo");
58+
(Token<DelegationTokenIdentifier>) tm1.createToken(
59+
UserGroupInformation.getCurrentUser(), "foo");
5860
Assert.assertNotNull(token);
5961
tm2.verifyToken(token);
6062

61-
token = tm2.createToken(UserGroupInformation.getCurrentUser(), "bar");
63+
token = (Token<DelegationTokenIdentifier>) tm2.createToken(
64+
UserGroupInformation.getCurrentUser(), "bar");
6265
Assert.assertNotNull(token);
6366
tm1.verifyToken(token);
6467
} finally {

‎hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/token/delegation/web/TestDelegationTokenAuthenticationHandlerWithMocks.java‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,7 @@ private void testGetToken(String renewer, Text expectedTokenKind)
202202
Assert.assertEquals(expectedTokenKind, dt.getKind());
203203
}
204204

205+
@SuppressWarnings("unchecked")
205206
private void testCancelToken() throws Exception {
206207
DelegationTokenAuthenticator.DelegationTokenOperation op =
207208
DelegationTokenAuthenticator.DelegationTokenOperation.
@@ -220,7 +221,7 @@ private void testCancelToken() throws Exception {
220221

221222
Mockito.reset(response);
222223
Token<DelegationTokenIdentifier> token =
223-
handler.getTokenManager().createToken(
224+
(Token<DelegationTokenIdentifier>) handler.getTokenManager().createToken(
224225
UserGroupInformation.getCurrentUser(), "foo");
225226
Mockito.when(request.getQueryString()).thenReturn(
226227
DelegationTokenAuthenticator.OP_PARAM + "=" + op.toString() + "&" +
@@ -239,6 +240,7 @@ private void testCancelToken() throws Exception {
239240
}
240241
}
241242

243+
@SuppressWarnings("unchecked")
242244
private void testRenewToken() throws Exception {
243245
DelegationTokenAuthenticator.DelegationTokenOperation op =
244246
DelegationTokenAuthenticator.DelegationTokenOperation.
@@ -271,7 +273,7 @@ private void testRenewToken() throws Exception {
271273
PrintWriter pwriter = new PrintWriter(writer);
272274
Mockito.when(response.getWriter()).thenReturn(pwriter);
273275
Token<DelegationTokenIdentifier> dToken =
274-
handler.getTokenManager().createToken(
276+
(Token<DelegationTokenIdentifier>) handler.getTokenManager().createToken(
275277
UserGroupInformation.getCurrentUser(), "user");
276278
Mockito.when(request.getQueryString()).
277279
thenReturn(DelegationTokenAuthenticator.OP_PARAM + "=" + op.toString() +
@@ -292,11 +294,12 @@ public void testAuthenticate() throws Exception {
292294
testInvalidDelegationTokenHeader();
293295
}
294296

297+
@SuppressWarnings("unchecked")
295298
private void testValidDelegationTokenQueryString() throws Exception {
296299
HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
297300
HttpServletResponse response = Mockito.mock(HttpServletResponse.class);
298301
Token<DelegationTokenIdentifier> dToken =
299-
handler.getTokenManager().createToken(
302+
(Token<DelegationTokenIdentifier>) handler.getTokenManager().createToken(
300303
UserGroupInformation.getCurrentUser(), "user");
301304
Mockito.when(request.getQueryString()).thenReturn(
302305
DelegationTokenAuthenticator.DELEGATION_PARAM + "=" +
@@ -311,11 +314,12 @@ private void testValidDelegationTokenQueryString() throws Exception {
311314
Assert.assertTrue(token.isExpired());
312315
}
313316

317+
@SuppressWarnings("unchecked")
314318
private void testValidDelegationTokenHeader() throws Exception {
315319
HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
316320
HttpServletResponse response = Mockito.mock(HttpServletResponse.class);
317321
Token<DelegationTokenIdentifier> dToken =
318-
handler.getTokenManager().createToken(
322+
(Token<DelegationTokenIdentifier>) handler.getTokenManager().createToken(
319323
UserGroupInformation.getCurrentUser(), "user");
320324
Mockito.when(request.getHeader(Mockito.eq(
321325
DelegationTokenAuthenticator.DELEGATION_TOKEN_HEADER))).thenReturn(

0 commit comments

Comments
 (0)