Examples with RMDelegationTokenIdentifier org.apache.hadoop.yarn.security.client.RMDelegationTokenIdentifier used on opensource projects

Example 26 with RMDelegationTokenIdentifier

use of org.apache.hadoop.yarn.security.client.RMDelegationTokenIdentifier in project hadoop by apache.

the class ClientRMService method getDelegationToken.

@Override
public GetDelegationTokenResponse getDelegationToken(GetDelegationTokenRequest request) throws YarnException {
    try {
        // Verify that the connection is kerberos authenticated
        if (!isAllowedDelegationTokenOp()) {
            throw new IOException("Delegation Token can be issued only with kerberos authentication");
        }
        GetDelegationTokenResponse response = recordFactory.newRecordInstance(GetDelegationTokenResponse.class);
        UserGroupInformation ugi = UserGroupInformation.getCurrentUser();
        Text owner = new Text(ugi.getUserName());
        Text realUser = null;
        if (ugi.getRealUser() != null) {
            realUser = new Text(ugi.getRealUser().getUserName());
        }
        RMDelegationTokenIdentifier tokenIdentifier = new RMDelegationTokenIdentifier(owner, new Text(request.getRenewer()), realUser);
        Token<RMDelegationTokenIdentifier> realRMDTtoken = new Token<RMDelegationTokenIdentifier>(tokenIdentifier, this.rmDTSecretManager);
        response.setRMDelegationToken(BuilderUtils.newDelegationToken(realRMDTtoken.getIdentifier(), realRMDTtoken.getKind().toString(), realRMDTtoken.getPassword(), realRMDTtoken.getService().toString()));
        return response;
    } catch (IOException io) {
        throw RPCUtil.getRemoteException(io);
    }
}

Example 27 with RMDelegationTokenIdentifier

use of org.apache.hadoop.yarn.security.client.RMDelegationTokenIdentifier in project hadoop by apache.

the class MemoryRMStateStore method storeOrUpdateRMDT.

private void storeOrUpdateRMDT(RMDelegationTokenIdentifier rmDTIdentifier, Long renewDate, boolean isUpdate) throws Exception {
    Map<RMDelegationTokenIdentifier, Long> rmDTState = state.rmSecretManagerState.getTokenState();
    if (rmDTState.containsKey(rmDTIdentifier)) {
        IOException e = new IOException("RMDelegationToken: " + rmDTIdentifier + "is already stored.");
        LOG.info("Error storing info for RMDelegationToken: " + rmDTIdentifier, e);
        throw e;
    }
    rmDTState.put(rmDTIdentifier, renewDate);
    if (!isUpdate) {
        state.rmSecretManagerState.dtSequenceNumber = rmDTIdentifier.getSequenceNumber();
    }
    LOG.info("Store RMDT with sequence number " + rmDTIdentifier.getSequenceNumber());
}

Example 28 with RMDelegationTokenIdentifier

use of org.apache.hadoop.yarn.security.client.RMDelegationTokenIdentifier in project hadoop by apache.

the class FileSystemRMStateStore method loadRMDTSecretManagerState.

private void loadRMDTSecretManagerState(RMState rmState) throws Exception {
    checkAndResumeUpdateOperation(rmDTSecretManagerRoot);
    FileStatus[] childNodes = listStatusWithRetries(rmDTSecretManagerRoot);
    for (FileStatus childNodeStatus : childNodes) {
        assert childNodeStatus.isFile();
        String childNodeName = childNodeStatus.getPath().getName();
        if (checkAndRemovePartialRecordWithRetries(childNodeStatus.getPath())) {
            continue;
        }
        if (childNodeName.startsWith(DELEGATION_TOKEN_SEQUENCE_NUMBER_PREFIX)) {
            rmState.rmSecretManagerState.dtSequenceNumber = Integer.parseInt(childNodeName.split("_")[1]);
            continue;
        }
        Path childNodePath = getNodePath(rmDTSecretManagerRoot, childNodeName);
        byte[] childData = readFileWithRetries(childNodePath, childNodeStatus.getLen());
        ByteArrayInputStream is = new ByteArrayInputStream(childData);
        try (DataInputStream fsIn = new DataInputStream(is)) {
            if (childNodeName.startsWith(DELEGATION_KEY_PREFIX)) {
                DelegationKey key = new DelegationKey();
                key.readFields(fsIn);
                rmState.rmSecretManagerState.masterKeyState.add(key);
                if (LOG.isDebugEnabled()) {
                    LOG.debug("Loaded delegation key: keyId=" + key.getKeyId() + ", expirationDate=" + key.getExpiryDate());
                }
            } else if (childNodeName.startsWith(DELEGATION_TOKEN_PREFIX)) {
                RMDelegationTokenIdentifierData identifierData = new RMDelegationTokenIdentifierData();
                identifierData.readFields(fsIn);
                RMDelegationTokenIdentifier identifier = identifierData.getTokenIdentifier();
                long renewDate = identifierData.getRenewDate();
                rmState.rmSecretManagerState.delegationTokenState.put(identifier, renewDate);
                if (LOG.isDebugEnabled()) {
                    LOG.debug("Loaded RMDelegationTokenIdentifier: " + identifier + " renewDate=" + renewDate);
                }
            } else {
                LOG.warn("Unknown file for recovering RMDelegationTokenSecretManager");
            }
        }
    }
}

Example 29 with RMDelegationTokenIdentifier

use of org.apache.hadoop.yarn.security.client.RMDelegationTokenIdentifier in project hadoop by apache.

the class ZKRMStateStore method loadRMDelegationTokenState.

private void loadRMDelegationTokenState(RMState rmState) throws Exception {
    List<String> childNodes = getChildren(delegationTokensRootPath);
    for (String childNodeName : childNodes) {
        String childNodePath = getNodePath(delegationTokensRootPath, childNodeName);
        byte[] childData = getData(childNodePath);
        if (childData == null) {
            LOG.warn("Content of " + childNodePath + " is broken.");
            continue;
        }
        ByteArrayInputStream is = new ByteArrayInputStream(childData);
        try (DataInputStream fsIn = new DataInputStream(is)) {
            if (childNodeName.startsWith(DELEGATION_TOKEN_PREFIX)) {
                RMDelegationTokenIdentifierData identifierData = new RMDelegationTokenIdentifierData();
                identifierData.readFields(fsIn);
                RMDelegationTokenIdentifier identifier = identifierData.getTokenIdentifier();
                long renewDate = identifierData.getRenewDate();
                rmState.rmSecretManagerState.delegationTokenState.put(identifier, renewDate);
                if (LOG.isDebugEnabled()) {
                    LOG.debug("Loaded RMDelegationTokenIdentifier: " + identifier + " renewDate=" + renewDate);
                }
            }
        }
    }
}

Example 30 with RMDelegationTokenIdentifier

use of org.apache.hadoop.yarn.security.client.RMDelegationTokenIdentifier in project hadoop by apache.

the class RMDelegationTokenIdentifierData method getTokenIdentifier.

public RMDelegationTokenIdentifier getTokenIdentifier() throws IOException {
    ByteArrayInputStream in = new ByteArrayInputStream(builder.getTokenIdentifier().toByteArray());
    RMDelegationTokenIdentifier identifer = new RMDelegationTokenIdentifier();
    identifer.readFields(new DataInputStream(in));
    return identifer;
}