Examples with DelegationToken org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.DelegationToken used on opensource projects

Example 1 with DelegationToken

use of org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.DelegationToken in project hadoop by apache.

the class RMWebServices method renewDelegationToken.

private Response renewDelegationToken(DelegationToken tokenData, HttpServletRequest hsr, UserGroupInformation callerUGI) throws AuthorizationException, IOException, InterruptedException, Exception {
    Token<RMDelegationTokenIdentifier> token = extractToken(tokenData.getToken());
    org.apache.hadoop.yarn.api.records.Token dToken = BuilderUtils.newDelegationToken(token.getIdentifier(), token.getKind().toString(), token.getPassword(), token.getService().toString());
    final RenewDelegationTokenRequest req = RenewDelegationTokenRequest.newInstance(dToken);
    RenewDelegationTokenResponse resp;
    try {
        resp = callerUGI.doAs(new PrivilegedExceptionAction<RenewDelegationTokenResponse>() {

            @Override
            public RenewDelegationTokenResponse run() throws IOException, YarnException {
                return rm.getClientRMService().renewDelegationToken(req);
            }
        });
    } catch (UndeclaredThrowableException ue) {
        if (ue.getCause() instanceof YarnException) {
            if (ue.getCause().getCause() instanceof InvalidToken) {
                throw new BadRequestException(ue.getCause().getCause().getMessage());
            } else if (ue.getCause().getCause() instanceof org.apache.hadoop.security.AccessControlException) {
                return Response.status(Status.FORBIDDEN).entity(ue.getCause().getCause().getMessage()).build();
            }
            LOG.info("Renew delegation token request failed", ue);
            throw ue;
        }
        LOG.info("Renew delegation token request failed", ue);
        throw ue;
    } catch (Exception e) {
        LOG.info("Renew delegation token request failed", e);
        throw e;
    }
    long renewTime = resp.getNextExpirationTime();
    DelegationToken respToken = new DelegationToken();
    respToken.setNextExpirationTime(renewTime);
    return Response.status(Status.OK).entity(respToken).build();
}

Example 2 with DelegationToken

use of org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.DelegationToken in project hadoop by apache.

the class RMWebServices method createDelegationToken.

private Response createDelegationToken(DelegationToken tokenData, HttpServletRequest hsr, UserGroupInformation callerUGI) throws AuthorizationException, IOException, InterruptedException, Exception {
    final String renewer = tokenData.getRenewer();
    GetDelegationTokenResponse resp;
    try {
        resp = callerUGI.doAs(new PrivilegedExceptionAction<GetDelegationTokenResponse>() {

            @Override
            public GetDelegationTokenResponse run() throws IOException, YarnException {
                GetDelegationTokenRequest createReq = GetDelegationTokenRequest.newInstance(renewer);
                return rm.getClientRMService().getDelegationToken(createReq);
            }
        });
    } catch (Exception e) {
        LOG.info("Create delegation token request failed", e);
        throw e;
    }
    Token<RMDelegationTokenIdentifier> tk = new Token<RMDelegationTokenIdentifier>(resp.getRMDelegationToken().getIdentifier().array(), resp.getRMDelegationToken().getPassword().array(), new Text(resp.getRMDelegationToken().getKind()), new Text(resp.getRMDelegationToken().getService()));
    RMDelegationTokenIdentifier identifier = tk.decodeIdentifier();
    long currentExpiration = rm.getRMContext().getRMDelegationTokenSecretManager().getRenewDate(identifier);
    DelegationToken respToken = new DelegationToken(tk.encodeToUrlString(), renewer, identifier.getOwner().toString(), tk.getKind().toString(), currentExpiration, identifier.getMaxDate());
    return Response.status(Status.OK).entity(respToken).build();
}

Example 3 with DelegationToken

use of org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.DelegationToken in project hadoop by apache.

the class RMWebServices method postDelegationTokenExpiration.

@POST
@Path("/delegation-token/expiration")
@Produces({ MediaType.APPLICATION_JSON + "; " + JettyUtils.UTF_8, MediaType.APPLICATION_XML + "; " + JettyUtils.UTF_8 })
@Consumes({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
public Response postDelegationTokenExpiration(@Context HttpServletRequest hsr) throws AuthorizationException, IOException, InterruptedException, Exception {
    init();
    UserGroupInformation callerUGI;
    try {
        callerUGI = createKerberosUserGroupInformation(hsr);
    } catch (YarnException ye) {
        return Response.status(Status.FORBIDDEN).entity(ye.getMessage()).build();
    }
    DelegationToken requestToken = new DelegationToken();
    requestToken.setToken(extractToken(hsr).encodeToUrlString());
    return renewDelegationToken(requestToken, hsr, callerUGI);
}

Example 4 with DelegationToken

use of org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.DelegationToken in project hadoop by apache.

the class TestRMWebServicesDelegationTokens method testRenewDelegationToken.

// Test to verify renew functionality - create a token and then try to renew
// it. The renewer should succeed; owner and third user should fail
@Test
public void testRenewDelegationToken() throws Exception {
    client().addFilter(new LoggingFilter(System.out));
    rm.start();
    final String renewer = "client2";
    this.client().addFilter(new LoggingFilter(System.out));
    final DelegationToken dummyToken = new DelegationToken();
    dummyToken.setRenewer(renewer);
    String[] mediaTypes = { MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML };
    for (final String mediaType : mediaTypes) {
        for (final String contentType : mediaTypes) {
            if (isKerberosAuth == false) {
                verifySimpleAuthRenew(mediaType, contentType);
                continue;
            }
            // test "client" and client2" trying to renew "client" token
            final DelegationToken responseToken = KerberosTestUtils.doAsClient(new Callable<DelegationToken>() {

                @Override
                public DelegationToken call() throws Exception {
                    ClientResponse response = resource().path("ws").path("v1").path("cluster").path("delegation-token").accept(contentType).entity(dummyToken, mediaType).post(ClientResponse.class);
                    assertResponseStatusCode(Status.OK, response.getStatusInfo());
                    DelegationToken tok = getDelegationTokenFromResponse(response);
                    assertFalse(tok.getToken().isEmpty());
                    String body = generateRenewTokenBody(mediaType, tok.getToken());
                    response = resource().path("ws").path("v1").path("cluster").path("delegation-token").path("expiration").header(yarnTokenHeader, tok.getToken()).accept(contentType).entity(body, mediaType).post(ClientResponse.class);
                    assertResponseStatusCode(Status.FORBIDDEN, response.getStatusInfo());
                    return tok;
                }
            });
            KerberosTestUtils.doAs(renewer, new Callable<DelegationToken>() {

                @Override
                public DelegationToken call() throws Exception {
                    // renew twice so that we can confirm that the
                    // expiration time actually changes
                    long oldExpirationTime = Time.now();
                    assertValidRMToken(responseToken.getToken());
                    String body = generateRenewTokenBody(mediaType, responseToken.getToken());
                    ClientResponse response = resource().path("ws").path("v1").path("cluster").path("delegation-token").path("expiration").header(yarnTokenHeader, responseToken.getToken()).accept(contentType).entity(body, mediaType).post(ClientResponse.class);
                    assertResponseStatusCode(Status.OK, response.getStatusInfo());
                    DelegationToken tok = getDelegationTokenFromResponse(response);
                    String message = "Expiration time not as expected: old = " + oldExpirationTime + "; new = " + tok.getNextExpirationTime();
                    assertTrue(message, tok.getNextExpirationTime() > oldExpirationTime);
                    oldExpirationTime = tok.getNextExpirationTime();
                    // artificial sleep to ensure we get a different expiration time
                    Thread.sleep(1000);
                    response = resource().path("ws").path("v1").path("cluster").path("delegation-token").path("expiration").header(yarnTokenHeader, responseToken.getToken()).accept(contentType).entity(body, mediaType).post(ClientResponse.class);
                    assertResponseStatusCode(Status.OK, response.getStatusInfo());
                    tok = getDelegationTokenFromResponse(response);
                    message = "Expiration time not as expected: old = " + oldExpirationTime + "; new = " + tok.getNextExpirationTime();
                    assertTrue(message, tok.getNextExpirationTime() > oldExpirationTime);
                    return tok;
                }
            });
            // test unauthorized user renew attempt
            KerberosTestUtils.doAs("client3", new Callable<DelegationToken>() {

                @Override
                public DelegationToken call() throws Exception {
                    String body = generateRenewTokenBody(mediaType, responseToken.getToken());
                    ClientResponse response = resource().path("ws").path("v1").path("cluster").path("delegation-token").path("expiration").header(yarnTokenHeader, responseToken.getToken()).accept(contentType).entity(body, mediaType).post(ClientResponse.class);
                    assertResponseStatusCode(Status.FORBIDDEN, response.getStatusInfo());
                    return null;
                }
            });
            // test bad request - incorrect format, empty token string and random
            // token string
            KerberosTestUtils.doAsClient(new Callable<Void>() {

                @Override
                public Void call() throws Exception {
                    String token = "TEST_TOKEN_STRING";
                    String body = "";
                    if (mediaType.equals(MediaType.APPLICATION_JSON)) {
                        body = "{\"token\": \"" + token + "\" }";
                    } else {
                        body = "<delegation-token><token>" + token + "</token></delegation-token>";
                    }
                    // missing token header
                    ClientResponse response = resource().path("ws").path("v1").path("cluster").path("delegation-token").path("expiration").accept(contentType).entity(body, mediaType).post(ClientResponse.class);
                    assertResponseStatusCode(Status.BAD_REQUEST, response.getStatusInfo());
                    return null;
                }
            });
        }
    }
    rm.stop();
    return;
}

Example 5 with DelegationToken

use of org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.DelegationToken in project hadoop by apache.

the class TestRMWebServicesDelegationTokens method verifyKerberosAuthCreate.

private void verifyKerberosAuthCreate(String mType, String cType, String reqBody, String renUser) throws Exception {
    final String mediaType = mType;
    final String contentType = cType;
    final String body = reqBody;
    final String renewer = renUser;
    KerberosTestUtils.doAsClient(new Callable<Void>() {

        @Override
        public Void call() throws Exception {
            ClientResponse response = resource().path("ws").path("v1").path("cluster").path("delegation-token").accept(contentType).entity(body, mediaType).post(ClientResponse.class);
            assertResponseStatusCode(Status.OK, response.getStatusInfo());
            DelegationToken tok = getDelegationTokenFromResponse(response);
            assertFalse(tok.getToken().isEmpty());
            Token<RMDelegationTokenIdentifier> token = new Token<RMDelegationTokenIdentifier>();
            token.decodeFromUrlString(tok.getToken());
            assertEquals(renewer, token.decodeIdentifier().getRenewer().toString());
            assertValidRMToken(tok.getToken());
            DelegationToken dtoken = new DelegationToken();
            response = resource().path("ws").path("v1").path("cluster").path("delegation-token").accept(contentType).entity(dtoken, mediaType).post(ClientResponse.class);
            assertResponseStatusCode(Status.OK, response.getStatusInfo());
            tok = getDelegationTokenFromResponse(response);
            assertFalse(tok.getToken().isEmpty());
            token = new Token<RMDelegationTokenIdentifier>();
            token.decodeFromUrlString(tok.getToken());
            assertEquals("", token.decodeIdentifier().getRenewer().toString());
            assertValidRMToken(tok.getToken());
            return null;
        }
    });
}