Examples with DelegationTokenAuthenticatedURL org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticatedURL used on opensource projects

Example 1 with DelegationTokenAuthenticatedURL

use of org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticatedURL in project hadoop by apache.

the class HttpFSFileSystem method initialize.

/**
   * Called after a new FileSystem instance is constructed.
   *
   * @param name a uri whose authority section names the host, port, etc. for this FileSystem
   * @param conf the configuration
   */
@Override
public void initialize(URI name, Configuration conf) throws IOException {
    UserGroupInformation ugi = UserGroupInformation.getCurrentUser();
    //the real use is the one that has the Kerberos credentials needed for
    //SPNEGO to work
    realUser = ugi.getRealUser();
    if (realUser == null) {
        realUser = UserGroupInformation.getLoginUser();
    }
    super.initialize(name, conf);
    try {
        uri = new URI(name.getScheme() + "://" + name.getAuthority());
    } catch (URISyntaxException ex) {
        throw new IOException(ex);
    }
    Class<? extends DelegationTokenAuthenticator> klass = getConf().getClass("httpfs.authenticator.class", KerberosDelegationTokenAuthenticator.class, DelegationTokenAuthenticator.class);
    DelegationTokenAuthenticator authenticator = ReflectionUtils.newInstance(klass, getConf());
    authURL = new DelegationTokenAuthenticatedURL(authenticator);
}

Example 2 with DelegationTokenAuthenticatedURL

use of org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticatedURL in project hadoop by apache.

the class KMSClientProvider method createConnection.

private HttpURLConnection createConnection(final URL url, String method) throws IOException {
    HttpURLConnection conn;
    try {
        final String doAsUser = getDoAsUser();
        conn = getActualUgi().doAs(new PrivilegedExceptionAction<HttpURLConnection>() {

            @Override
            public HttpURLConnection run() throws Exception {
                DelegationTokenAuthenticatedURL authUrl = new DelegationTokenAuthenticatedURL(configurator);
                return authUrl.openConnection(url, authToken, doAsUser);
            }
        });
    } catch (IOException ex) {
        if (ex instanceof SocketTimeoutException) {
            LOG.warn("Failed to connect to {}:{}", url.getHost(), url.getPort());
        }
        throw ex;
    } catch (UndeclaredThrowableException ex) {
        throw new IOException(ex.getUndeclaredThrowable());
    } catch (Exception ex) {
        throw new IOException(ex);
    }
    conn.setUseCaches(false);
    conn.setRequestMethod(method);
    if (method.equals(HTTP_POST) || method.equals(HTTP_PUT)) {
        conn.setDoOutput(true);
    }
    conn = configureConnection(conn);
    return conn;
}

Example 3 with DelegationTokenAuthenticatedURL

use of org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticatedURL in project atlas by apache.

the class SecureClientUtils method getClientConnectionHandler.

public static URLConnectionClientHandler getClientConnectionHandler(DefaultClientConfig config, org.apache.commons.configuration.Configuration clientConfig, String doAsUser, final UserGroupInformation ugi) {
    config.getProperties().put(URLConnectionClientHandler.PROPERTY_HTTP_URL_CONNECTION_SET_METHOD_WORKAROUND, true);
    Configuration conf = new Configuration();
    conf.addResource(conf.get(SSLFactory.SSL_CLIENT_CONF_KEY, SecurityProperties.SSL_CLIENT_PROPERTIES));
    UserGroupInformation.setConfiguration(conf);
    final ConnectionConfigurator connConfigurator = newConnConfigurator(conf);
    Authenticator authenticator = new KerberosDelegationTokenAuthenticator();
    authenticator.setConnectionConfigurator(connConfigurator);
    final DelegationTokenAuthenticator finalAuthenticator = (DelegationTokenAuthenticator) authenticator;
    final DelegationTokenAuthenticatedURL.Token token = new DelegationTokenAuthenticatedURL.Token();
    HttpURLConnectionFactory httpURLConnectionFactory = null;
    try {
        UserGroupInformation ugiToUse = ugi != null ? ugi : UserGroupInformation.getCurrentUser();
        final UserGroupInformation actualUgi = (ugiToUse.getAuthenticationMethod() == UserGroupInformation.AuthenticationMethod.PROXY) ? ugiToUse.getRealUser() : ugiToUse;
        LOG.info("Real User: {}, is from ticket cache? {}", actualUgi, actualUgi.isLoginTicketBased());
        if (StringUtils.isEmpty(doAsUser)) {
            doAsUser = actualUgi.getShortUserName();
        }
        LOG.info("doAsUser: {}", doAsUser);
        final String finalDoAsUser = doAsUser;
        httpURLConnectionFactory = new HttpURLConnectionFactory() {

            @Override
            public HttpURLConnection getHttpURLConnection(final URL url) throws IOException {
                try {
                    return actualUgi.doAs(new PrivilegedExceptionAction<HttpURLConnection>() {

                        @Override
                        public HttpURLConnection run() throws Exception {
                            try {
                                return new DelegationTokenAuthenticatedURL(finalAuthenticator, connConfigurator).openConnection(url, token, finalDoAsUser);
                            } catch (Exception e) {
                                throw new IOException(e);
                            }
                        }
                    });
                } catch (Exception e) {
                    if (e instanceof IOException) {
                        throw (IOException) e;
                    } else {
                        throw new IOException(e);
                    }
                }
            }
        };
    } catch (IOException e) {
        LOG.warn("Error obtaining user", e);
    }
    return new URLConnectionClientHandler(httpURLConnectionFactory);
}

Example 4 with DelegationTokenAuthenticatedURL

use of org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticatedURL in project hadoop by apache.

the class KMSClientProvider method renewDelegationToken.

@Override
public long renewDelegationToken(final Token<?> dToken) throws IOException {
    try {
        final String doAsUser = getDoAsUser();
        final DelegationTokenAuthenticatedURL.Token token = generateDelegationToken(dToken);
        final URL url = createURL(null, null, null, null);
        LOG.debug("Renewing delegation token {} with url:{}, as:{}", token, url, doAsUser);
        final DelegationTokenAuthenticatedURL authUrl = new DelegationTokenAuthenticatedURL(configurator);
        return getActualUgi().doAs(new PrivilegedExceptionAction<Long>() {

            @Override
            public Long run() throws Exception {
                return authUrl.renewDelegationToken(url, token, doAsUser);
            }
        });
    } catch (Exception ex) {
        if (ex instanceof IOException) {
            throw (IOException) ex;
        } else {
            throw new IOException(ex);
        }
    }
}

Example 5 with DelegationTokenAuthenticatedURL

use of org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticatedURL in project hadoop by apache.

the class KMSClientProvider method addDelegationTokens.

@Override
public Token<?>[] addDelegationTokens(final String renewer, Credentials credentials) throws IOException {
    Token<?>[] tokens = null;
    Text dtService = getDelegationTokenService();
    Token<?> token = credentials.getToken(dtService);
    if (token == null) {
        final URL url = createURL(null, null, null, null);
        final DelegationTokenAuthenticatedURL authUrl = new DelegationTokenAuthenticatedURL(configurator);
        try {
            final String doAsUser = getDoAsUser();
            token = getActualUgi().doAs(new PrivilegedExceptionAction<Token<?>>() {

                @Override
                public Token<?> run() throws Exception {
                    // everytime.
                    return authUrl.getDelegationToken(url, new DelegationTokenAuthenticatedURL.Token(), renewer, doAsUser);
                }
            });
            if (token != null) {
                credentials.addToken(token.getService(), token);
                tokens = new Token<?>[] { token };
            } else {
                throw new IOException("Got NULL as delegation token");
            }
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
        } catch (Exception e) {
            throw new IOException(e);
        }
    }
    return tokens;
}