Examples with KeyProvider org.apache.hadoop.crypto.key.KeyProvider used on opensource projects

Example 11 with KeyProvider

use of org.apache.hadoop.crypto.key.KeyProvider in project hadoop by apache.

the class TestKMS method doProxyUserTest.

public void doProxyUserTest(final boolean kerberos) throws Exception {
    Configuration conf = new Configuration();
    conf.set("hadoop.security.authentication", "kerberos");
    final File testDir = getTestDir();
    conf = createBaseKMSConf(testDir, conf);
    if (kerberos) {
        conf.set("hadoop.kms.authentication.type", "kerberos");
    }
    conf.set("hadoop.kms.authentication.kerberos.keytab", keytab.getAbsolutePath());
    conf.set("hadoop.kms.authentication.kerberos.principal", "HTTP/localhost");
    conf.set("hadoop.kms.authentication.kerberos.name.rules", "DEFAULT");
    conf.set("hadoop.kms.proxyuser.client.users", "foo,bar");
    conf.set("hadoop.kms.proxyuser.client.hosts", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "kaa.ALL", "client");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "kbb.ALL", "foo");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "kcc.ALL", "foo1");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "kdd.ALL", "bar");
    writeConf(testDir, conf);
    runServer(null, null, testDir, new KMSCallable<Void>() {

        @Override
        public Void call() throws Exception {
            final Configuration conf = new Configuration();
            conf.setInt(KeyProvider.DEFAULT_BITLENGTH_NAME, 128);
            final URI uri = createKMSUri(getKMSUrl());
            UserGroupInformation proxyUgi = null;
            if (kerberos) {
                // proxyuser client using kerberos credentials
                proxyUgi = UserGroupInformation.loginUserFromKeytabAndReturnUGI("client", keytab.getAbsolutePath());
            } else {
                proxyUgi = UserGroupInformation.createRemoteUser("client");
                UserGroupInformation.setLoginUser(proxyUgi);
            }
            final UserGroupInformation clientUgi = proxyUgi;
            clientUgi.doAs(new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    final KeyProvider kp = createProvider(uri, conf);
                    kp.createKey("kaa", new KeyProvider.Options(conf));
                    // authorized proxyuser
                    UserGroupInformation fooUgi = UserGroupInformation.createProxyUser("foo", clientUgi);
                    fooUgi.doAs(new PrivilegedExceptionAction<Void>() {

                        @Override
                        public Void run() throws Exception {
                            Assert.assertNotNull(kp.createKey("kbb", new KeyProvider.Options(conf)));
                            return null;
                        }
                    });
                    // unauthorized proxyuser
                    UserGroupInformation foo1Ugi = UserGroupInformation.createProxyUser("foo1", clientUgi);
                    foo1Ugi.doAs(new PrivilegedExceptionAction<Void>() {

                        @Override
                        public Void run() throws Exception {
                            try {
                                kp.createKey("kcc", new KeyProvider.Options(conf));
                                Assert.fail();
                            } catch (AuthorizationException ex) {
                            // OK
                            } catch (Exception ex) {
                                Assert.fail(ex.getMessage());
                            }
                            return null;
                        }
                    });
                    // authorized proxyuser
                    UserGroupInformation barUgi = UserGroupInformation.createProxyUser("bar", clientUgi);
                    barUgi.doAs(new PrivilegedExceptionAction<Void>() {

                        @Override
                        public Void run() throws Exception {
                            Assert.assertNotNull(kp.createKey("kdd", new KeyProvider.Options(conf)));
                            return null;
                        }
                    });
                    return null;
                }
            });
            return null;
        }
    });
}

Example 12 with KeyProvider

use of org.apache.hadoop.crypto.key.KeyProvider in project hadoop by apache.

the class TestKMS method testKMSAuthFailureRetry.

@Test
public void testKMSAuthFailureRetry() throws Exception {
    Configuration conf = new Configuration();
    conf.set("hadoop.security.authentication", "kerberos");
    final File testDir = getTestDir();
    conf = createBaseKMSConf(testDir, conf);
    conf.set("hadoop.kms.authentication.kerberos.keytab", keytab.getAbsolutePath());
    conf.set("hadoop.kms.authentication.kerberos.principal", "HTTP/localhost");
    conf.set("hadoop.kms.authentication.kerberos.name.rules", "DEFAULT");
    conf.set("hadoop.kms.authentication.token.validity", "1");
    for (KMSACLs.Type type : KMSACLs.Type.values()) {
        conf.set(type.getAclConfigKey(), type.toString());
    }
    conf.set(KMSACLs.Type.CREATE.getAclConfigKey(), KMSACLs.Type.CREATE.toString() + ",SET_KEY_MATERIAL");
    conf.set(KMSACLs.Type.ROLLOVER.getAclConfigKey(), KMSACLs.Type.ROLLOVER.toString() + ",SET_KEY_MATERIAL");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k0.ALL", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k1.ALL", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k2.ALL", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k3.ALL", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k4.ALL", "*");
    writeConf(testDir, conf);
    runServer(null, null, testDir, new KMSCallable<Void>() {

        @Override
        public Void call() throws Exception {
            final Configuration conf = new Configuration();
            conf.setInt(KeyProvider.DEFAULT_BITLENGTH_NAME, 128);
            final URI uri = createKMSUri(getKMSUrl());
            doAs("SET_KEY_MATERIAL", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    kp.createKey("k0", new byte[16], new KeyProvider.Options(conf));
                    // This happens before rollover
                    kp.createKey("k1", new byte[16], new KeyProvider.Options(conf));
                    // Atleast 2 rollovers.. so should induce signer Exception
                    Thread.sleep(3500);
                    kp.createKey("k2", new byte[16], new KeyProvider.Options(conf));
                    return null;
                }
            });
            return null;
        }
    });
    // Test retry count
    runServer(null, null, testDir, new KMSCallable<Void>() {

        @Override
        public Void call() throws Exception {
            final Configuration conf = new Configuration();
            conf.setInt(KeyProvider.DEFAULT_BITLENGTH_NAME, 128);
            conf.setInt(KMSClientProvider.AUTH_RETRY, 0);
            final URI uri = createKMSUri(getKMSUrl());
            doAs("SET_KEY_MATERIAL", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    kp.createKey("k3", new byte[16], new KeyProvider.Options(conf));
                    // Atleast 2 rollovers.. so should induce signer Exception
                    Thread.sleep(3500);
                    try {
                        kp.createKey("k4", new byte[16], new KeyProvider.Options(conf));
                        Assert.fail("This should not succeed..");
                    } catch (IOException e) {
                        Assert.assertTrue("HTTP exception must be a 401 : " + e.getMessage(), e.getMessage().contains("401"));
                    }
                    return null;
                }
            });
            return null;
        }
    });
}

Example 13 with KeyProvider

use of org.apache.hadoop.crypto.key.KeyProvider in project hadoop by apache.

the class TestKMS method testKMSTimeout.

/**
   * Test the configurable timeout in the KMSClientProvider.  Open up a
   * socket, but don't accept connections for it.  This leads to a timeout
   * when the KMS client attempts to connect.
   * @throws Exception
   */
@Test
public void testKMSTimeout() throws Exception {
    File confDir = getTestDir();
    Configuration conf = createBaseKMSConf(confDir);
    conf.setInt(KMSClientProvider.TIMEOUT_ATTR, 1);
    writeConf(confDir, conf);
    ServerSocket sock;
    int port;
    try {
        sock = new ServerSocket(0, 50, InetAddress.getByName("localhost"));
        port = sock.getLocalPort();
    } catch (Exception e) {
        /* Problem creating socket?  Just bail. */
        return;
    }
    URL url = new URL("http://localhost:" + port + "/kms");
    URI uri = createKMSUri(url);
    boolean caughtTimeout = false;
    try {
        KeyProvider kp = createProvider(uri, conf);
        kp.getKeys();
    } catch (SocketTimeoutException e) {
        caughtTimeout = true;
    } catch (IOException e) {
        Assert.assertTrue("Caught unexpected exception" + e.toString(), false);
    }
    caughtTimeout = false;
    try {
        KeyProvider kp = createProvider(uri, conf);
        KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp).generateEncryptedKey("a");
    } catch (SocketTimeoutException e) {
        caughtTimeout = true;
    } catch (IOException e) {
        Assert.assertTrue("Caught unexpected exception" + e.toString(), false);
    }
    caughtTimeout = false;
    try {
        KeyProvider kp = createProvider(uri, conf);
        KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp).decryptEncryptedKey(new KMSClientProvider.KMSEncryptedKeyVersion("a", "a", new byte[] { 1, 2 }, "EEK", new byte[] { 1, 2 }));
    } catch (SocketTimeoutException e) {
        caughtTimeout = true;
    } catch (IOException e) {
        Assert.assertTrue("Caught unexpected exception" + e.toString(), false);
    }
    Assert.assertTrue(caughtTimeout);
    sock.close();
}

Example 14 with KeyProvider

use of org.apache.hadoop.crypto.key.KeyProvider in project hadoop by apache.

the class KMSWebApp method contextInitialized.

@Override
public void contextInitialized(ServletContextEvent sce) {
    try {
        String confDir = System.getProperty(KMSConfiguration.KMS_CONFIG_DIR);
        if (confDir == null) {
            throw new RuntimeException("System property '" + KMSConfiguration.KMS_CONFIG_DIR + "' not defined");
        }
        kmsConf = KMSConfiguration.getKMSConf();
        initLogging(confDir);
        UserGroupInformation.setConfiguration(kmsConf);
        LOG.info("-------------------------------------------------------------");
        LOG.info("  Java runtime version : {}", System.getProperty("java.runtime.version"));
        LOG.info("  User: {}", System.getProperty("user.name"));
        LOG.info("  KMS Hadoop Version: " + VersionInfo.getVersion());
        LOG.info("-------------------------------------------------------------");
        kmsAcls = new KMSACLs();
        kmsAcls.startReloader();
        metricRegistry = new MetricRegistry();
        jmxReporter = JmxReporter.forRegistry(metricRegistry).build();
        jmxReporter.start();
        generateEEKCallsMeter = metricRegistry.register(GENERATE_EEK_METER, new Meter());
        decryptEEKCallsMeter = metricRegistry.register(DECRYPT_EEK_METER, new Meter());
        adminCallsMeter = metricRegistry.register(ADMIN_CALLS_METER, new Meter());
        keyCallsMeter = metricRegistry.register(KEY_CALLS_METER, new Meter());
        invalidCallsMeter = metricRegistry.register(INVALID_CALLS_METER, new Meter());
        unauthorizedCallsMeter = metricRegistry.register(UNAUTHORIZED_CALLS_METER, new Meter());
        unauthenticatedCallsMeter = metricRegistry.register(UNAUTHENTICATED_CALLS_METER, new Meter());
        kmsAudit = new KMSAudit(kmsConf);
        // intializing the KeyProvider
        String providerString = kmsConf.get(KMSConfiguration.KEY_PROVIDER_URI);
        if (providerString == null) {
            throw new IllegalStateException("No KeyProvider has been defined");
        }
        KeyProvider keyProvider = KeyProviderFactory.get(new URI(providerString), kmsConf);
        if (kmsConf.getBoolean(KMSConfiguration.KEY_CACHE_ENABLE, KMSConfiguration.KEY_CACHE_ENABLE_DEFAULT)) {
            long keyTimeOutMillis = kmsConf.getLong(KMSConfiguration.KEY_CACHE_TIMEOUT_KEY, KMSConfiguration.KEY_CACHE_TIMEOUT_DEFAULT);
            long currKeyTimeOutMillis = kmsConf.getLong(KMSConfiguration.CURR_KEY_CACHE_TIMEOUT_KEY, KMSConfiguration.CURR_KEY_CACHE_TIMEOUT_DEFAULT);
            keyProvider = new CachingKeyProvider(keyProvider, keyTimeOutMillis, currKeyTimeOutMillis);
        }
        LOG.info("Initialized KeyProvider " + keyProvider);
        keyProviderCryptoExtension = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(keyProvider);
        keyProviderCryptoExtension = new EagerKeyGeneratorKeyProviderCryptoExtension(kmsConf, keyProviderCryptoExtension);
        if (kmsConf.getBoolean(KMSConfiguration.KEY_AUTHORIZATION_ENABLE, KMSConfiguration.KEY_AUTHORIZATION_ENABLE_DEFAULT)) {
            keyProviderCryptoExtension = new KeyAuthorizationKeyProvider(keyProviderCryptoExtension, kmsAcls);
        }
        LOG.info("Initialized KeyProviderCryptoExtension " + keyProviderCryptoExtension);
        final int defaultBitlength = kmsConf.getInt(KeyProvider.DEFAULT_BITLENGTH_NAME, KeyProvider.DEFAULT_BITLENGTH);
        LOG.info("Default key bitlength is {}", defaultBitlength);
        LOG.info("KMS Started");
    } catch (Throwable ex) {
        System.out.println();
        System.out.println("ERROR: Hadoop KMS could not be started");
        System.out.println();
        System.out.println("REASON: " + ex.toString());
        System.out.println();
        System.out.println("Stacktrace:");
        System.out.println("---------------------------------------------------");
        ex.printStackTrace(System.out);
        System.out.println("---------------------------------------------------");
        System.out.println();
        System.exit(1);
    }
}

Example 15 with KeyProvider

use of org.apache.hadoop.crypto.key.KeyProvider in project hadoop by apache.

the class DFSUtil method createKeyProviderCryptoExtension.

/**
   * Creates a new KeyProviderCryptoExtension by wrapping the
   * KeyProvider specified in the given Configuration.
   *
   * @param conf Configuration
   * @return new KeyProviderCryptoExtension, or null if no provider was found.
   * @throws IOException if the KeyProvider is improperly specified in
   *                             the Configuration
   */
public static KeyProviderCryptoExtension createKeyProviderCryptoExtension(final Configuration conf) throws IOException {
    KeyProvider keyProvider = DFSUtilClient.createKeyProvider(conf);
    if (keyProvider == null) {
        return null;
    }
    KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(keyProvider);
    return cryptoProvider;
}