Examples with KerberosCredentialsService org.apache.nifi.kerberos.KerberosCredentialsService used on opensource projects

Example 11 with KerberosCredentialsService

use of org.apache.nifi.kerberos.KerberosCredentialsService in project nifi by apache.

the class KafkaProcessorUtils method validateCommonProperties.

static Collection<ValidationResult> validateCommonProperties(final ValidationContext validationContext) {
    List<ValidationResult> results = new ArrayList<>();
    String securityProtocol = validationContext.getProperty(SECURITY_PROTOCOL).getValue();
    final String explicitPrincipal = validationContext.getProperty(USER_PRINCIPAL).evaluateAttributeExpressions().getValue();
    final String explicitKeytab = validationContext.getProperty(USER_KEYTAB).evaluateAttributeExpressions().getValue();
    final KerberosCredentialsService credentialsService = validationContext.getProperty(KERBEROS_CREDENTIALS_SERVICE).asControllerService(KerberosCredentialsService.class);
    final String resolvedPrincipal;
    final String resolvedKeytab;
    if (credentialsService == null) {
        resolvedPrincipal = explicitPrincipal;
        resolvedKeytab = explicitKeytab;
    } else {
        resolvedPrincipal = credentialsService.getPrincipal();
        resolvedKeytab = credentialsService.getKeytab();
    }
    if (credentialsService != null && (explicitPrincipal != null || explicitKeytab != null)) {
        results.add(new ValidationResult.Builder().subject("Kerberos Credentials").valid(false).explanation("Cannot specify both a Kerberos Credentials Service and a principal/keytab").build());
    }
    final String allowExplicitKeytabVariable = System.getenv(ALLOW_EXPLICIT_KEYTAB);
    if ("false".equalsIgnoreCase(allowExplicitKeytabVariable) && (explicitPrincipal != null || explicitKeytab != null)) {
        results.add(new ValidationResult.Builder().subject("Kerberos Credentials").valid(false).explanation("The '" + ALLOW_EXPLICIT_KEYTAB + "' system environment variable is configured to forbid explicitly configuring principal/keytab in processors. " + "The Kerberos Credentials Service should be used instead of setting the Kerberos Keytab or Kerberos Principal property.").build());
    }
    // security protocol, then Kerberos principal is provided as well
    if (SEC_SASL_PLAINTEXT.getValue().equals(securityProtocol) || SEC_SASL_SSL.getValue().equals(securityProtocol)) {
        String jaasServiceName = validationContext.getProperty(JAAS_SERVICE_NAME).evaluateAttributeExpressions().getValue();
        if (jaasServiceName == null || jaasServiceName.trim().length() == 0) {
            results.add(new ValidationResult.Builder().subject(JAAS_SERVICE_NAME.getDisplayName()).valid(false).explanation("The <" + JAAS_SERVICE_NAME.getDisplayName() + "> property must be set when <" + SECURITY_PROTOCOL.getDisplayName() + "> is configured as '" + SEC_SASL_PLAINTEXT.getValue() + "' or '" + SEC_SASL_SSL.getValue() + "'.").build());
        }
        if ((resolvedKeytab == null && resolvedPrincipal != null) || (resolvedKeytab != null && resolvedPrincipal == null)) {
            results.add(new ValidationResult.Builder().subject(JAAS_SERVICE_NAME.getDisplayName()).valid(false).explanation("Both <" + USER_KEYTAB.getDisplayName() + "> and <" + USER_PRINCIPAL.getDisplayName() + "> " + "must be set or neither must be set.").build());
        }
    }
    // If SSL or SASL_SSL then SSLContext Controller Service must be set.
    final boolean sslProtocol = SEC_SSL.getValue().equals(securityProtocol) || SEC_SASL_SSL.getValue().equals(securityProtocol);
    final boolean csSet = validationContext.getProperty(SSL_CONTEXT_SERVICE).isSet();
    if (csSet && !sslProtocol) {
        results.add(new ValidationResult.Builder().subject(SECURITY_PROTOCOL.getDisplayName()).valid(false).explanation("If you set the SSL Controller Service you should also choose an SSL based security protocol.").build());
    }
    if (!csSet && sslProtocol) {
        results.add(new ValidationResult.Builder().subject(SSL_CONTEXT_SERVICE.getDisplayName()).valid(false).explanation("If you set to an SSL based protocol you need to set the SSL Controller Service").build());
    }
    final String enableAutoCommit = validationContext.getProperty(new PropertyDescriptor.Builder().name(ConsumerConfig.ENABLE_AUTO_COMMIT_CONFIG).build()).getValue();
    if (enableAutoCommit != null && !enableAutoCommit.toLowerCase().equals("false")) {
        results.add(new ValidationResult.Builder().subject(ConsumerConfig.ENABLE_AUTO_COMMIT_CONFIG).explanation("Enable auto commit must be false. It is managed by the processor.").build());
    }
    final String keySerializer = validationContext.getProperty(new PropertyDescriptor.Builder().name(ProducerConfig.KEY_SERIALIZER_CLASS_CONFIG).build()).getValue();
    if (keySerializer != null && !ByteArraySerializer.class.getName().equals(keySerializer)) {
        results.add(new ValidationResult.Builder().subject(ProducerConfig.KEY_SERIALIZER_CLASS_CONFIG).explanation("Key Serializer must be " + ByteArraySerializer.class.getName() + "' was '" + keySerializer + "'").build());
    }
    final String valueSerializer = validationContext.getProperty(new PropertyDescriptor.Builder().name(ProducerConfig.VALUE_SERIALIZER_CLASS_CONFIG).build()).getValue();
    if (valueSerializer != null && !ByteArraySerializer.class.getName().equals(valueSerializer)) {
        results.add(new ValidationResult.Builder().subject(ProducerConfig.VALUE_SERIALIZER_CLASS_CONFIG).explanation("Value Serializer must be " + ByteArraySerializer.class.getName() + "' was '" + valueSerializer + "'").build());
    }
    final String keyDeSerializer = validationContext.getProperty(new PropertyDescriptor.Builder().name(ConsumerConfig.KEY_DESERIALIZER_CLASS_CONFIG).build()).getValue();
    if (keyDeSerializer != null && !ByteArrayDeserializer.class.getName().equals(keyDeSerializer)) {
        results.add(new ValidationResult.Builder().subject(ConsumerConfig.KEY_DESERIALIZER_CLASS_CONFIG).explanation("Key De-Serializer must be '" + ByteArrayDeserializer.class.getName() + "' was '" + keyDeSerializer + "'").build());
    }
    final String valueDeSerializer = validationContext.getProperty(new PropertyDescriptor.Builder().name(ConsumerConfig.VALUE_DESERIALIZER_CLASS_CONFIG).build()).getValue();
    if (valueDeSerializer != null && !ByteArrayDeserializer.class.getName().equals(valueDeSerializer)) {
        results.add(new ValidationResult.Builder().subject(ConsumerConfig.VALUE_DESERIALIZER_CLASS_CONFIG).explanation("Value De-Serializer must be " + ByteArrayDeserializer.class.getName() + "' was '" + valueDeSerializer + "'").build());
    }
    return results;
}

Example 12 with KerberosCredentialsService

use of org.apache.nifi.kerberos.KerberosCredentialsService in project nifi by apache.

the class ReportLineageToAtlas method setKafkaJaasConfig.

/**
 * Populate Kafka JAAS properties for Atlas notification.
 * Since Atlas 0.8.1 uses Kafka client 0.10.0.0, we can not use 'sasl.jaas.config' property
 * as it is available since 0.10.2, implemented by KAFKA-4259.
 * Instead, this method uses old property names.
 * @param mapToPopulate Map of configuration properties
 * @param context Context
 */
private void setKafkaJaasConfig(Map<Object, Object> mapToPopulate, PropertyContext context) {
    String keytab;
    String principal;
    final String explicitPrincipal = context.getProperty(NIFI_KERBEROS_PRINCIPAL).evaluateAttributeExpressions().getValue();
    final String explicitKeytab = context.getProperty(NIFI_KERBEROS_KEYTAB).evaluateAttributeExpressions().getValue();
    final KerberosCredentialsService credentialsService = context.getProperty(ReportLineageToAtlas.KERBEROS_CREDENTIALS_SERVICE).asControllerService(KerberosCredentialsService.class);
    if (credentialsService == null) {
        principal = explicitPrincipal;
        keytab = explicitKeytab;
    } else {
        principal = credentialsService.getPrincipal();
        keytab = credentialsService.getKeytab();
    }
    String serviceName = context.getProperty(KAFKA_KERBEROS_SERVICE_NAME).evaluateAttributeExpressions().getValue();
    if (StringUtils.isNotBlank(keytab) && StringUtils.isNotBlank(principal) && StringUtils.isNotBlank(serviceName)) {
        mapToPopulate.put("atlas.jaas.KafkaClient.loginModuleControlFlag", "required");
        mapToPopulate.put("atlas.jaas.KafkaClient.loginModuleName", "com.sun.security.auth.module.Krb5LoginModule");
        mapToPopulate.put("atlas.jaas.KafkaClient.option.keyTab", keytab);
        mapToPopulate.put("atlas.jaas.KafkaClient.option.principal", principal);
        mapToPopulate.put("atlas.jaas.KafkaClient.option.serviceName", serviceName);
        mapToPopulate.put("atlas.jaas.KafkaClient.option.storeKey", "True");
        mapToPopulate.put("atlas.jaas.KafkaClient.option.useKeyTab", "True");
        mapToPopulate.put("atlas.jaas.ticketBased-KafkaClient.loginModuleControlFlag", "required");
        mapToPopulate.put("atlas.jaas.ticketBased-KafkaClient.loginModuleName", "com.sun.security.auth.module.Krb5LoginModule");
        mapToPopulate.put("atlas.jaas.ticketBased-KafkaClient.option.useTicketCache", "true");
        mapToPopulate.put(ATLAS_KAFKA_PREFIX + "sasl.kerberos.service.name", serviceName);
    }
}

Example 13 with KerberosCredentialsService

use of org.apache.nifi.kerberos.KerberosCredentialsService in project nifi by apache.

the class Kerberos method validate.

@Override
public Collection<ValidationResult> validate(ValidationContext context) {
    final List<ValidationResult> problems = new ArrayList<>();
    final String explicitPrincipal = context.getProperty(NIFI_KERBEROS_PRINCIPAL).evaluateAttributeExpressions().getValue();
    final String explicitKeytab = context.getProperty(NIFI_KERBEROS_KEYTAB).evaluateAttributeExpressions().getValue();
    final KerberosCredentialsService credentialsService = context.getProperty(ReportLineageToAtlas.KERBEROS_CREDENTIALS_SERVICE).asControllerService(KerberosCredentialsService.class);
    final String resolvedPrincipal;
    final String resolvedKeytab;
    if (credentialsService == null) {
        resolvedPrincipal = explicitPrincipal;
        resolvedKeytab = explicitKeytab;
    } else {
        resolvedPrincipal = credentialsService.getPrincipal();
        resolvedKeytab = credentialsService.getKeytab();
    }
    if (resolvedPrincipal == null || resolvedKeytab == null) {
        problems.add(new ValidationResult.Builder().subject("Kerberos Credentials").valid(false).explanation("Both the Principal and the Keytab must be specified when using Kerberos authentication, either via the explicit properties or the Kerberos Credentials Service.").build());
    }
    if (credentialsService != null && (explicitPrincipal != null || explicitKeytab != null)) {
        problems.add(new ValidationResult.Builder().subject("Kerberos Credentials").valid(false).explanation("Cannot specify both a Kerberos Credentials Service and a principal/keytab").build());
    }
    final String allowExplicitKeytabVariable = System.getenv(ALLOW_EXPLICIT_KEYTAB);
    if ("false".equalsIgnoreCase(allowExplicitKeytabVariable) && (explicitPrincipal != null || explicitKeytab != null)) {
        problems.add(new ValidationResult.Builder().subject("Kerberos Credentials").valid(false).explanation("The '" + ALLOW_EXPLICIT_KEYTAB + "' system environment variable is configured to forbid explicitly configuring principal/keytab in processors. " + "The Kerberos Credentials Service should be used instead of setting the Kerberos Keytab or Kerberos Principal property.").build());
    }
    return problems;
}

Example 14 with KerberosCredentialsService

use of org.apache.nifi.kerberos.KerberosCredentialsService in project nifi by apache.

the class HBase_1_1_2_ClientService method createConnection.

protected Connection createConnection(final ConfigurationContext context) throws IOException, InterruptedException {
    final String configFiles = context.getProperty(HADOOP_CONF_FILES).getValue();
    final Configuration hbaseConfig = getConfigurationFromFiles(configFiles);
    // override with any properties that are provided
    if (context.getProperty(ZOOKEEPER_QUORUM).isSet()) {
        hbaseConfig.set(HBASE_CONF_ZK_QUORUM, context.getProperty(ZOOKEEPER_QUORUM).getValue());
    }
    if (context.getProperty(ZOOKEEPER_CLIENT_PORT).isSet()) {
        hbaseConfig.set(HBASE_CONF_ZK_PORT, context.getProperty(ZOOKEEPER_CLIENT_PORT).getValue());
    }
    if (context.getProperty(ZOOKEEPER_ZNODE_PARENT).isSet()) {
        hbaseConfig.set(HBASE_CONF_ZNODE_PARENT, context.getProperty(ZOOKEEPER_ZNODE_PARENT).getValue());
    }
    if (context.getProperty(HBASE_CLIENT_RETRIES).isSet()) {
        hbaseConfig.set(HBASE_CONF_CLIENT_RETRIES, context.getProperty(HBASE_CLIENT_RETRIES).getValue());
    }
    // add any dynamic properties to the HBase configuration
    for (final Map.Entry<PropertyDescriptor, String> entry : context.getProperties().entrySet()) {
        final PropertyDescriptor descriptor = entry.getKey();
        if (descriptor.isDynamic()) {
            hbaseConfig.set(descriptor.getName(), entry.getValue());
        }
    }
    if (SecurityUtil.isSecurityEnabled(hbaseConfig)) {
        String principal = context.getProperty(kerberosProperties.getKerberosPrincipal()).evaluateAttributeExpressions().getValue();
        String keyTab = context.getProperty(kerberosProperties.getKerberosKeytab()).evaluateAttributeExpressions().getValue();
        // If the Kerberos Credentials Service is specified, we need to use its configuration, not the explicit properties for principal/keytab.
        // The customValidate method ensures that only one can be set, so we know that the principal & keytab above are null.
        final KerberosCredentialsService credentialsService = context.getProperty(KERBEROS_CREDENTIALS_SERVICE).asControllerService(KerberosCredentialsService.class);
        if (credentialsService != null) {
            principal = credentialsService.getPrincipal();
            keyTab = credentialsService.getKeytab();
        }
        getLogger().info("HBase Security Enabled, logging in as principal {} with keytab {}", new Object[] { principal, keyTab });
        ugi = SecurityUtil.loginKerberos(hbaseConfig, principal, keyTab);
        getLogger().info("Successfully logged in as principal {} with keytab {}", new Object[] { principal, keyTab });
        return ugi.doAs(new PrivilegedExceptionAction<Connection>() {

            @Override
            public Connection run() throws Exception {
                return ConnectionFactory.createConnection(hbaseConfig);
            }
        });
    } else {
        getLogger().info("Simple Authentication");
        return ConnectionFactory.createConnection(hbaseConfig);
    }
}

Example 15 with KerberosCredentialsService

use of org.apache.nifi.kerberos.KerberosCredentialsService in project nifi by apache.

the class HBase_1_1_2_ClientService method customValidate.

@Override
protected Collection<ValidationResult> customValidate(ValidationContext validationContext) {
    boolean confFileProvided = validationContext.getProperty(HADOOP_CONF_FILES).isSet();
    boolean zkQuorumProvided = validationContext.getProperty(ZOOKEEPER_QUORUM).isSet();
    boolean zkPortProvided = validationContext.getProperty(ZOOKEEPER_CLIENT_PORT).isSet();
    boolean znodeParentProvided = validationContext.getProperty(ZOOKEEPER_ZNODE_PARENT).isSet();
    boolean retriesProvided = validationContext.getProperty(HBASE_CLIENT_RETRIES).isSet();
    final String explicitPrincipal = validationContext.getProperty(kerberosProperties.getKerberosPrincipal()).evaluateAttributeExpressions().getValue();
    final String explicitKeytab = validationContext.getProperty(kerberosProperties.getKerberosKeytab()).evaluateAttributeExpressions().getValue();
    final KerberosCredentialsService credentialsService = validationContext.getProperty(KERBEROS_CREDENTIALS_SERVICE).asControllerService(KerberosCredentialsService.class);
    final String resolvedPrincipal;
    final String resolvedKeytab;
    if (credentialsService == null) {
        resolvedPrincipal = explicitPrincipal;
        resolvedKeytab = explicitKeytab;
    } else {
        resolvedPrincipal = credentialsService.getPrincipal();
        resolvedKeytab = credentialsService.getKeytab();
    }
    final List<ValidationResult> problems = new ArrayList<>();
    if (!confFileProvided && (!zkQuorumProvided || !zkPortProvided || !znodeParentProvided || !retriesProvided)) {
        problems.add(new ValidationResult.Builder().valid(false).subject(this.getClass().getSimpleName()).explanation("ZooKeeper Quorum, ZooKeeper Client Port, ZooKeeper ZNode Parent, and HBase Client Retries are required " + "when Hadoop Configuration Files are not provided.").build());
    }
    if (confFileProvided) {
        final String configFiles = validationContext.getProperty(HADOOP_CONF_FILES).getValue();
        ValidationResources resources = validationResourceHolder.get();
        // then load the Configuration and set the new resources in the holder
        if (resources == null || !configFiles.equals(resources.getConfigResources())) {
            getLogger().debug("Reloading validation resources");
            resources = new ValidationResources(configFiles, getConfigurationFromFiles(configFiles));
            validationResourceHolder.set(resources);
        }
        final Configuration hbaseConfig = resources.getConfiguration();
        problems.addAll(KerberosProperties.validatePrincipalAndKeytab(getClass().getSimpleName(), hbaseConfig, resolvedPrincipal, resolvedKeytab, getLogger()));
    }
    if (credentialsService != null && (explicitPrincipal != null || explicitKeytab != null)) {
        problems.add(new ValidationResult.Builder().subject("Kerberos Credentials").valid(false).explanation("Cannot specify both a Kerberos Credentials Service and a principal/keytab").build());
    }
    final String allowExplicitKeytabVariable = System.getenv(ALLOW_EXPLICIT_KEYTAB);
    if ("false".equalsIgnoreCase(allowExplicitKeytabVariable) && (explicitPrincipal != null || explicitKeytab != null)) {
        problems.add(new ValidationResult.Builder().subject("Kerberos Credentials").valid(false).explanation("The '" + ALLOW_EXPLICIT_KEYTAB + "' system environment variable is configured to forbid explicitly configuring principal/keytab in processors. " + "The Kerberos Credentials Service should be used instead of setting the Kerberos Keytab or Kerberos Principal property.").build());
    }
    return problems;
}