Examples with SecurityModule org.apache.flink.runtime.security.modules.SecurityModule used on opensource projects

Example 1 with SecurityModule

use of org.apache.flink.runtime.security.modules.SecurityModule in project flink by apache.

the class YarnTaskExecutorRunnerTest method testPreInstallKerberosKeytabConfiguration.

@Test
public void testPreInstallKerberosKeytabConfiguration() throws Exception {
    final String resourceDirPath = Paths.get("src", "test", "resources").toAbsolutePath().toString();
    final Map<String, String> envs = new HashMap<>(2);
    envs.put(YarnConfigKeys.KEYTAB_PRINCIPAL, "testuser1@domain");
    // Try directly resolving local path when no remote keytab path is provided.
    envs.put(YarnConfigKeys.LOCAL_KEYTAB_PATH, "src/test/resources/krb5.keytab");
    Configuration configuration = new Configuration();
    YarnTaskExecutorRunner.setupAndModifyConfiguration(configuration, resourceDirPath, envs);
    // the SecurityContext is installed on TaskManager startup
    SecurityUtils.install(new SecurityConfiguration(configuration));
    final List<SecurityModule> modules = SecurityUtils.getInstalledModules();
    Optional<SecurityModule> moduleOpt = modules.stream().filter(module -> module instanceof HadoopModule).findFirst();
    if (moduleOpt.isPresent()) {
        HadoopModule hadoopModule = (HadoopModule) moduleOpt.get();
        assertThat(hadoopModule.getSecurityConfig().getPrincipal(), is("testuser1@domain"));
        // Using containString verification as the absolute path varies depending on runtime
        // environment
        assertThat(hadoopModule.getSecurityConfig().getKeytab(), containsString("src/test/resources/krb5.keytab"));
    } else {
        fail("Can not find HadoopModule!");
    }
    assertThat(configuration.getString(SecurityOptions.KERBEROS_LOGIN_KEYTAB), containsString("src/test/resources/krb5.keytab"));
    assertThat(configuration.getString(SecurityOptions.KERBEROS_LOGIN_PRINCIPAL), is("testuser1@domain"));
}

Example 2 with SecurityModule

use of org.apache.flink.runtime.security.modules.SecurityModule in project flink by apache.

the class SecurityUtils method install.

/**
	 * Installs a process-wide security configuration.
	 *
	 * Applies the configuration using the available security modules (i.e. Hadoop, JAAS).
	 */
public static void install(SecurityConfiguration config) throws Exception {
    // install the security modules
    List<SecurityModule> modules = new ArrayList<>();
    try {
        for (Class<? extends SecurityModule> moduleClass : config.getSecurityModules()) {
            SecurityModule module = moduleClass.newInstance();
            module.install(config);
            modules.add(module);
        }
    } catch (Exception ex) {
        throw new Exception("unable to establish the security context", ex);
    }
    installedModules = modules;
    // use the Hadoop login user as the subject of the installed security context
    if (!(installedContext instanceof NoOpSecurityContext)) {
        LOG.warn("overriding previous security context");
    }
    UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
    installedContext = new HadoopSecurityContext(loginUser);
}

Example 3 with SecurityModule

use of org.apache.flink.runtime.security.modules.SecurityModule in project flink by apache.

the class SecurityUtils method installModules.

static void installModules(SecurityConfiguration config) throws Exception {
    // install the security module factories
    List<SecurityModule> modules = new ArrayList<>();
    for (String moduleFactoryClass : config.getSecurityModuleFactories()) {
        SecurityModuleFactory moduleFactory = null;
        try {
            moduleFactory = SecurityFactoryServiceLoader.findModuleFactory(moduleFactoryClass);
        } catch (NoMatchSecurityFactoryException ne) {
            LOG.error("Unable to instantiate security module factory {}", moduleFactoryClass);
            throw new IllegalArgumentException("Unable to find module factory class", ne);
        }
        SecurityModule module = moduleFactory.createModule(config);
        // can be null if a SecurityModule is not supported in the current environment
        if (module != null) {
            module.install();
            modules.add(module);
        }
    }
    installedModules = modules;
}

Example 4 with SecurityModule

use of org.apache.flink.runtime.security.modules.SecurityModule in project flink by apache.

the class YarnTaskExecutorRunnerTest method testDefaultKerberosKeytabConfiguration.

@Test
public void testDefaultKerberosKeytabConfiguration() throws Exception {
    final String resourceDirPath = Paths.get("src", "test", "resources").toAbsolutePath().toString();
    final Map<String, String> envs = new HashMap<>(2);
    envs.put(YarnConfigKeys.KEYTAB_PRINCIPAL, "testuser1@domain");
    envs.put(YarnConfigKeys.REMOTE_KEYTAB_PATH, resourceDirPath);
    // Local keytab path will be populated from default YarnConfigOptions.LOCALIZED_KEYTAB_PATH
    envs.put(YarnConfigKeys.LOCAL_KEYTAB_PATH, YarnConfigOptions.LOCALIZED_KEYTAB_PATH.defaultValue());
    Configuration configuration = new Configuration();
    YarnTaskExecutorRunner.setupAndModifyConfiguration(configuration, resourceDirPath, envs);
    // the SecurityContext is installed on TaskManager startup
    SecurityUtils.install(new SecurityConfiguration(configuration));
    final List<SecurityModule> modules = SecurityUtils.getInstalledModules();
    Optional<SecurityModule> moduleOpt = modules.stream().filter(module -> module instanceof HadoopModule).findFirst();
    if (moduleOpt.isPresent()) {
        HadoopModule hadoopModule = (HadoopModule) moduleOpt.get();
        assertThat(hadoopModule.getSecurityConfig().getPrincipal(), is("testuser1@domain"));
        assertThat(hadoopModule.getSecurityConfig().getKeytab(), is(new File(resourceDirPath, YarnConfigOptions.LOCALIZED_KEYTAB_PATH.defaultValue()).getAbsolutePath()));
    } else {
        fail("Can not find HadoopModule!");
    }
    assertThat(configuration.getString(SecurityOptions.KERBEROS_LOGIN_KEYTAB), is(new File(resourceDirPath, YarnConfigOptions.LOCALIZED_KEYTAB_PATH.defaultValue()).getAbsolutePath()));
    assertThat(configuration.getString(SecurityOptions.KERBEROS_LOGIN_PRINCIPAL), is("testuser1@domain"));
}