Examples with AuthorizationException org.apache.hadoop.security.authorize.AuthorizationException used on opensource projects

Example 41 with AuthorizationException

use of org.apache.hadoop.security.authorize.AuthorizationException in project hadoop by apache.

the class RMWebServices method updateReservation.

/**
   * Function to update a Reservation to the RM.
   *
   * @param resContext provides information to construct the
   *          ReservationUpdateRequest
   * @param hsr the servlet request
   * @return Response containing the status code
   * @throws AuthorizationException
   * @throws IOException
   * @throws InterruptedException
   */
@POST
@Path("/reservation/update")
@Produces({ MediaType.APPLICATION_JSON + "; " + JettyUtils.UTF_8, MediaType.APPLICATION_XML + "; " + JettyUtils.UTF_8 })
@Consumes({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
public Response updateReservation(ReservationUpdateRequestInfo resContext, @Context HttpServletRequest hsr) throws AuthorizationException, IOException, InterruptedException {
    init();
    UserGroupInformation callerUGI = getCallerUserGroupInformation(hsr, true);
    if (callerUGI == null) {
        throw new AuthorizationException("Unable to obtain user name, " + "user not authenticated");
    }
    if (UserGroupInformation.isSecurityEnabled() && isStaticUser(callerUGI)) {
        String msg = "The default static user cannot carry out this operation.";
        return Response.status(Status.FORBIDDEN).entity(msg).build();
    }
    final ReservationUpdateRequest reservation = createReservationUpdateRequest(resContext);
    ReservationUpdateResponseInfo resRespInfo;
    try {
        resRespInfo = callerUGI.doAs(new PrivilegedExceptionAction<ReservationUpdateResponseInfo>() {

            @Override
            public ReservationUpdateResponseInfo run() throws IOException, YarnException {
                rm.getClientRMService().updateReservation(reservation);
                return new ReservationUpdateResponseInfo();
            }
        });
    } catch (UndeclaredThrowableException ue) {
        if (ue.getCause() instanceof YarnException) {
            throw new BadRequestException(ue.getCause().getMessage());
        }
        LOG.info("Update reservation request failed", ue);
        throw ue;
    }
    return Response.status(Status.OK).entity(resRespInfo).build();
}

Example 42 with AuthorizationException

use of org.apache.hadoop.security.authorize.AuthorizationException in project hadoop by apache.

the class RMWebServices method createKerberosUserGroupInformation.

private UserGroupInformation createKerberosUserGroupInformation(HttpServletRequest hsr) throws AuthorizationException, YarnException {
    UserGroupInformation callerUGI = getCallerUserGroupInformation(hsr, true);
    if (callerUGI == null) {
        String msg = "Unable to obtain user name, user not authenticated";
        throw new AuthorizationException(msg);
    }
    String authType = hsr.getAuthType();
    if (!KerberosAuthenticationHandler.TYPE.equalsIgnoreCase(authType)) {
        String msg = "Delegation token operations can only be carried out on a " + "Kerberos authenticated channel. Expected auth type is " + KerberosAuthenticationHandler.TYPE + ", got type " + authType;
        throw new YarnException(msg);
    }
    if (hsr.getAttribute(DelegationTokenAuthenticationHandler.DELEGATION_TOKEN_UGI_ATTRIBUTE) != null) {
        String msg = "Delegation token operations cannot be carried out using delegation" + " token authentication.";
        throw new YarnException(msg);
    }
    callerUGI.setAuthenticationMethod(AuthenticationMethod.KERBEROS);
    return callerUGI;
}

Example 43 with AuthorizationException

use of org.apache.hadoop.security.authorize.AuthorizationException in project hadoop by apache.

the class ApplicationHistoryManagerOnTimelineStore method generateApplicationReport.

private ApplicationReportExt generateApplicationReport(TimelineEntity entity, ApplicationReportField field) throws YarnException, IOException {
    ApplicationReportExt app = convertToApplicationReport(entity, field);
    // control, we can return immediately
    if (field == ApplicationReportField.USER_AND_ACLS) {
        return app;
    }
    try {
        checkAccess(app);
        if (app.appReport.getCurrentApplicationAttemptId() != null) {
            ApplicationAttemptReport appAttempt = getApplicationAttempt(app.appReport.getCurrentApplicationAttemptId(), false);
            app.appReport.setHost(appAttempt.getHost());
            app.appReport.setRpcPort(appAttempt.getRpcPort());
            app.appReport.setTrackingUrl(appAttempt.getTrackingUrl());
            app.appReport.setOriginalTrackingUrl(appAttempt.getOriginalTrackingUrl());
        }
    } catch (AuthorizationException | ApplicationAttemptNotFoundException e) {
        // AuthorizationException is thrown because the user doesn't have access
        if (e instanceof AuthorizationException) {
            LOG.warn("Failed to authorize when generating application report for " + app.appReport.getApplicationId() + ". Use a placeholder for its latest attempt id. ", e);
        } else {
            // Attempt not found
            LOG.info("No application attempt found for " + app.appReport.getApplicationId() + ". Use a placeholder for its latest attempt id. ", e);
        }
        // It's possible that the app is finished before the first attempt is created.
        app.appReport.setDiagnostics(null);
        app.appReport.setCurrentApplicationAttemptId(null);
    }
    if (app.appReport.getCurrentApplicationAttemptId() == null) {
        app.appReport.setCurrentApplicationAttemptId(ApplicationAttemptId.newInstance(app.appReport.getApplicationId(), -1));
    }
    if (app.appReport.getHost() == null) {
        app.appReport.setHost(UNAVAILABLE);
    }
    if (app.appReport.getRpcPort() < 0) {
        app.appReport.setRpcPort(-1);
    }
    if (app.appReport.getTrackingUrl() == null) {
        app.appReport.setTrackingUrl(UNAVAILABLE);
    }
    if (app.appReport.getOriginalTrackingUrl() == null) {
        app.appReport.setOriginalTrackingUrl(UNAVAILABLE);
    }
    if (app.appReport.getDiagnostics() == null) {
        app.appReport.setDiagnostics("");
    }
    return app;
}

Example 44 with AuthorizationException

use of org.apache.hadoop.security.authorize.AuthorizationException in project hadoop by apache.

the class TestApplicationHistoryManagerOnTimelineStore method testGetAMContainer.

@Test
public void testGetAMContainer() throws Exception {
    final ApplicationAttemptId appAttemptId = ApplicationAttemptId.newInstance(ApplicationId.newInstance(0, 1), 1);
    ContainerReport container;
    if (callerUGI == null) {
        container = historyManager.getAMContainer(appAttemptId);
    } else {
        try {
            container = callerUGI.doAs(new PrivilegedExceptionAction<ContainerReport>() {

                @Override
                public ContainerReport run() throws Exception {
                    return historyManager.getAMContainer(appAttemptId);
                }
            });
            if (callerUGI != null && callerUGI.getShortUserName().equals("user3")) {
                // The exception is expected
                Assert.fail();
            }
        } catch (AuthorizationException e) {
            if (callerUGI != null && callerUGI.getShortUserName().equals("user3")) {
                // The exception is expected
                return;
            }
            throw e;
        }
    }
    Assert.assertNotNull(container);
    Assert.assertEquals(appAttemptId, container.getContainerId().getApplicationAttemptId());
}

Example 45 with AuthorizationException

use of org.apache.hadoop.security.authorize.AuthorizationException in project hadoop by apache.

the class TestApplicationHistoryManagerOnTimelineStore method testGetApplicationAttempts.

@Test
public void testGetApplicationAttempts() throws Exception {
    final ApplicationId appId = ApplicationId.newInstance(0, 1);
    Collection<ApplicationAttemptReport> appAttempts;
    if (callerUGI == null) {
        appAttempts = historyManager.getApplicationAttempts(appId).values();
    } else {
        try {
            appAttempts = callerUGI.doAs(new PrivilegedExceptionAction<Collection<ApplicationAttemptReport>>() {

                @Override
                public Collection<ApplicationAttemptReport> run() throws Exception {
                    return historyManager.getApplicationAttempts(appId).values();
                }
            });
            if (callerUGI != null && callerUGI.getShortUserName().equals("user3")) {
                // The exception is expected
                Assert.fail();
            }
        } catch (AuthorizationException e) {
            if (callerUGI != null && callerUGI.getShortUserName().equals("user3")) {
                // The exception is expected
                return;
            }
            throw e;
        }
    }
    Assert.assertNotNull(appAttempts);
    Assert.assertEquals(SCALE, appAttempts.size());
}