Examples with KerberosToken org.apache.accumulo.core.client.security.tokens.KerberosToken used on opensource projects

Example 1 with KerberosToken

use of org.apache.accumulo.core.client.security.tokens.KerberosToken in project accumulo by apache.

the class DeleteIT method test.

@Test
public void test() throws Exception {
    Connector c = getConnector();
    String tableName = getUniqueNames(1)[0];
    c.tableOperations().create(tableName);
    AuthenticationToken token = getAdminToken();
    if (token instanceof KerberosToken) {
        deleteTest(c, getCluster(), getAdminPrincipal(), null, tableName, getAdminUser().getKeytab().getAbsolutePath());
    } else if (token instanceof PasswordToken) {
        PasswordToken passwdToken = (PasswordToken) token;
        deleteTest(c, getCluster(), getAdminPrincipal(), new String(passwdToken.getPassword(), UTF_8), tableName, null);
    }
}

Example 2 with KerberosToken

use of org.apache.accumulo.core.client.security.tokens.KerberosToken in project accumulo by apache.

the class KerberosTokenEmbeddedKDCTest method test.

@Test
public void test() throws Exception {
    String user = testName.getMethodName();
    File userKeytab = new File(kdc.getKeytabDir(), user + ".keytab");
    if (userKeytab.exists() && !userKeytab.delete()) {
        log.warn("Unable to delete {}", userKeytab);
    }
    kdc.createPrincipal(userKeytab, user);
    user = kdc.qualifyUser(user);
    UserGroupInformation.loginUserFromKeytab(user, userKeytab.getAbsolutePath());
    KerberosToken token = new KerberosToken();
    assertEquals(user, token.getPrincipal());
    // Use the long-hand constructor, should be equivalent to short-hand
    KerberosToken tokenWithPrinc = new KerberosToken(user);
    assertEquals(token, tokenWithPrinc);
    assertEquals(token.hashCode(), tokenWithPrinc.hashCode());
}

Example 3 with KerberosToken

use of org.apache.accumulo.core.client.security.tokens.KerberosToken in project accumulo by apache.

the class KerberosTokenEmbeddedKDCTest method testDestroy.

@Test
public void testDestroy() throws Exception {
    String user = testName.getMethodName();
    File userKeytab = new File(kdc.getKeytabDir(), user + ".keytab");
    if (userKeytab.exists() && !userKeytab.delete()) {
        log.warn("Unable to delete {}", userKeytab);
    }
    kdc.createPrincipal(userKeytab, user);
    user = kdc.qualifyUser(user);
    UserGroupInformation.loginUserFromKeytab(user, userKeytab.getAbsolutePath());
    KerberosToken token = new KerberosToken();
    assertEquals(user, token.getPrincipal());
    token.destroy();
    assertTrue(token.isDestroyed());
    assertNull(token.getPrincipal());
}

Example 4 with KerberosToken

use of org.apache.accumulo.core.client.security.tokens.KerberosToken in project accumulo by apache.

the class Proxy method createProxyServer.

public static ServerAddress createProxyServer(HostAndPort address, TProtocolFactory protocolFactory, Properties properties, ClientConfiguration clientConf) throws Exception {
    final int numThreads = Integer.parseInt(properties.getProperty(THRIFT_THREAD_POOL_SIZE_KEY, THRIFT_THREAD_POOL_SIZE_DEFAULT));
    final long maxFrameSize = ConfigurationTypeHelper.getFixedMemoryAsBytes(properties.getProperty(THRIFT_MAX_FRAME_SIZE_KEY, THRIFT_MAX_FRAME_SIZE_DEFAULT));
    final int simpleTimerThreadpoolSize = Integer.parseInt(Property.GENERAL_SIMPLETIMER_THREADPOOL_SIZE.getDefaultValue());
    // How frequently to try to resize the thread pool
    final long threadpoolResizeInterval = 1000l * 5;
    // No timeout
    final long serverSocketTimeout = 0l;
    // Use the new hadoop metrics2 support
    final MetricsFactory metricsFactory = new MetricsFactory(false);
    final String serverName = "Proxy", threadName = "Accumulo Thrift Proxy";
    // create the implementation of the proxy interface
    ProxyServer impl = new ProxyServer(properties);
    // Wrap the implementation -- translate some exceptions
    AccumuloProxy.Iface wrappedImpl = RpcWrapper.service(impl);
    // Create the processor from the implementation
    TProcessor processor = new AccumuloProxy.Processor<>(wrappedImpl);
    // Get the type of thrift server to instantiate
    final String serverTypeStr = properties.getProperty(THRIFT_SERVER_TYPE, THRIFT_SERVER_TYPE_DEFAULT);
    ThriftServerType serverType = DEFAULT_SERVER_TYPE;
    if (!THRIFT_SERVER_TYPE_DEFAULT.equals(serverTypeStr)) {
        serverType = ThriftServerType.get(serverTypeStr);
    }
    SslConnectionParams sslParams = null;
    SaslServerConnectionParams saslParams = null;
    switch(serverType) {
        case SSL:
            sslParams = SslConnectionParams.forClient(ClientContext.convertClientConfig(clientConf));
            break;
        case SASL:
            if (!clientConf.hasSasl()) {
                // ACCUMULO-3651 Changed level to error and added FATAL to message for slf4j capability
                log.error("FATAL: SASL thrift server was requested but it is disabled in client configuration");
                throw new RuntimeException("SASL is not enabled in configuration");
            }
            // Kerberos needs to be enabled to use it
            if (!UserGroupInformation.isSecurityEnabled()) {
                // ACCUMULO-3651 Changed level to error and added FATAL to message for slf4j capability
                log.error("FATAL: Hadoop security is not enabled");
                throw new RuntimeException();
            }
            // Login via principal and keytab
            final String kerberosPrincipal = properties.getProperty(KERBEROS_PRINCIPAL, ""), kerberosKeytab = properties.getProperty(KERBEROS_KEYTAB, "");
            if (StringUtils.isBlank(kerberosPrincipal) || StringUtils.isBlank(kerberosKeytab)) {
                // ACCUMULO-3651 Changed level to error and added FATAL to message for slf4j capability
                log.error("FATAL: Kerberos principal and keytab must be provided");
                throw new RuntimeException();
            }
            UserGroupInformation.loginUserFromKeytab(kerberosPrincipal, kerberosKeytab);
            UserGroupInformation ugi = UserGroupInformation.getCurrentUser();
            log.info("Logged in as {}", ugi.getUserName());
            // The kerberosPrimary set in the SASL server needs to match the principal we're logged in as.
            final String shortName = ugi.getShortUserName();
            log.info("Setting server primary to {}", shortName);
            clientConf.setProperty(ClientProperty.KERBEROS_SERVER_PRIMARY, shortName);
            KerberosToken token = new KerberosToken();
            saslParams = new SaslServerConnectionParams(clientConf, token, null);
            processor = new UGIAssumingProcessor(processor);
            break;
        default:
            // nothing to do -- no extra configuration necessary
            break;
    }
    // Hook up support for tracing for thrift calls
    TimedProcessor timedProcessor = new TimedProcessor(metricsFactory, processor, serverName, threadName);
    // Create the thrift server with our processor and properties
    ServerAddress serverAddr = TServerUtils.startTServer(serverType, timedProcessor, protocolFactory, serverName, threadName, numThreads, simpleTimerThreadpoolSize, threadpoolResizeInterval, maxFrameSize, sslParams, saslParams, serverSocketTimeout, address);
    return serverAddr;
}

Example 5 with KerberosToken

use of org.apache.accumulo.core.client.security.tokens.KerberosToken in project accumulo by apache.

the class KerberosIT method testUserPrivilegesForTable.

@Test
public void testUserPrivilegesForTable() throws Exception {
    String user1 = testName.getMethodName();
    final File user1Keytab = new File(kdc.getKeytabDir(), user1 + ".keytab");
    if (user1Keytab.exists() && !user1Keytab.delete()) {
        log.warn("Unable to delete {}", user1Keytab);
    }
    // Create some new users -- cannot contain realm
    kdc.createPrincipal(user1Keytab, user1);
    final String qualifiedUser1 = kdc.qualifyUser(user1);
    // Log in as user1
    UserGroupInformation ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(qualifiedUser1, user1Keytab.getAbsolutePath());
    log.info("Logged in as {}", user1);
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            // Indirectly creates this user when we use it
            Connector conn = mac.getConnector(qualifiedUser1, new KerberosToken());
            log.info("Created connector as {}", qualifiedUser1);
            // The new user should have no system permissions
            for (SystemPermission perm : SystemPermission.values()) {
                assertFalse(conn.securityOperations().hasSystemPermission(qualifiedUser1, perm));
            }
            return null;
        }
    });
    final String table = testName.getMethodName() + "_user_table";
    final String viz = "viz";
    ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(rootUser.getPrincipal(), rootUser.getKeytab().getAbsolutePath());
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            Connector conn = mac.getConnector(rootUser.getPrincipal(), new KerberosToken());
            conn.tableOperations().create(table);
            // Give our unprivileged user permission on the table we made for them
            conn.securityOperations().grantTablePermission(qualifiedUser1, table, TablePermission.READ);
            conn.securityOperations().grantTablePermission(qualifiedUser1, table, TablePermission.WRITE);
            conn.securityOperations().grantTablePermission(qualifiedUser1, table, TablePermission.ALTER_TABLE);
            conn.securityOperations().grantTablePermission(qualifiedUser1, table, TablePermission.DROP_TABLE);
            conn.securityOperations().changeUserAuthorizations(qualifiedUser1, new Authorizations(viz));
            return null;
        }
    });
    // Switch back to the original user
    ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(qualifiedUser1, user1Keytab.getAbsolutePath());
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            Connector conn = mac.getConnector(qualifiedUser1, new KerberosToken());
            // Make sure we can actually use the table we made
            // Write data
            final long ts = 1000l;
            BatchWriter bw = conn.createBatchWriter(table, new BatchWriterConfig());
            Mutation m = new Mutation("a");
            m.put("b", "c", new ColumnVisibility(viz.getBytes()), ts, "d");
            bw.addMutation(m);
            bw.close();
            // Compact
            conn.tableOperations().compact(table, new CompactionConfig().setWait(true).setFlush(true));
            // Alter
            conn.tableOperations().setProperty(table, Property.TABLE_BLOOM_ENABLED.getKey(), "true");
            // Read (and proper authorizations)
            try (Scanner s = conn.createScanner(table, new Authorizations(viz))) {
                Iterator<Entry<Key, Value>> iter = s.iterator();
                assertTrue("No results from iterator", iter.hasNext());
                Entry<Key, Value> entry = iter.next();
                assertEquals(new Key("a", "b", "c", viz, ts), entry.getKey());
                assertEquals(new Value("d".getBytes()), entry.getValue());
                assertFalse("Had more results from iterator", iter.hasNext());
                return null;
            }
        }
    });
}