You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tez.apache.org by ss...@apache.org on 2013/12/11 00:06:50 UTC
git commit: TEZ-606. Fix Tez to work on kerberos secured clusters.
(sseth)
Updated Branches:
refs/heads/master ecf6adf8c -> 0b4e671e5
TEZ-606. Fix Tez to work on kerberos secured clusters. (sseth)
Project: http://git-wip-us.apache.org/repos/asf/incubator-tez/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-tez/commit/0b4e671e
Tree: http://git-wip-us.apache.org/repos/asf/incubator-tez/tree/0b4e671e
Diff: http://git-wip-us.apache.org/repos/asf/incubator-tez/diff/0b4e671e
Branch: refs/heads/master
Commit: 0b4e671e53ee5d59f81e1a8b47e6d3d23d2aca99
Parents: ecf6adf
Author: Siddharth Seth <ss...@apache.org>
Authored: Tue Dec 10 15:06:24 2013 -0800
Committer: Siddharth Seth <ss...@apache.org>
Committed: Tue Dec 10 15:06:24 2013 -0800
----------------------------------------------------------------------
.../rpc/DAGClientAMProtocolBlockingPB.java | 2 +-
.../tez/common/security/JobTokenIdentifier.java | 98 ++++++++++++++++++++
.../apache/hadoop/mapred/YarnTezDagChild.java | 8 +-
.../tez/dag/api/client/DAGClientServer.java | 15 +++
.../org/apache/tez/dag/app/DAGAppMaster.java | 19 ++--
.../tez/dag/app/DAGClientSecurityInfo.java | 58 ++++++++++++
.../tez/dag/app/MRClientSecurityInfo.java | 58 ------------
.../dag/app/TaskAttemptListenerImpTezDag.java | 4 +-
.../authorize/ClientHSPolicyProvider.java | 45 ---------
.../security/authorize/MRAMPolicyProvider.java | 50 ----------
.../security/authorize/TezAMPolicyProvider.java | 50 ++++++++++
.../org.apache.hadoop.security.SecurityInfo | 2 +-
.../dag/app/rm/container/TestAMContainer.java | 2 +-
.../apache/tez/mapreduce/processor/MRTask.java | 2 +-
.../tez/mapreduce/processor/MapUtils.java | 2 +-
.../processor/reduce/TestReduceProcessor.java | 2 +-
.../tez/common/TezTaskUmbilicalProtocol.java | 6 +-
.../common/security/JobTokenSelector.java | 54 +++++++++++
.../common/security/JobTokenIdentifier.java | 98 --------------------
.../common/security/JobTokenSecretManager.java | 1 +
.../common/security/JobTokenSelector.java | 53 -----------
.../library/common/security/TokenCache.java | 1 +
.../common/shuffle/server/ShuffleHandler.java | 2 +-
.../library/shuffle/common/ShuffleUtils.java | 2 +-
24 files changed, 304 insertions(+), 330 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-api/src/main/java/org/apache/tez/dag/api/client/rpc/DAGClientAMProtocolBlockingPB.java
----------------------------------------------------------------------
diff --git a/tez-api/src/main/java/org/apache/tez/dag/api/client/rpc/DAGClientAMProtocolBlockingPB.java b/tez-api/src/main/java/org/apache/tez/dag/api/client/rpc/DAGClientAMProtocolBlockingPB.java
index a1ee18f..4dd971e 100644
--- a/tez-api/src/main/java/org/apache/tez/dag/api/client/rpc/DAGClientAMProtocolBlockingPB.java
+++ b/tez-api/src/main/java/org/apache/tez/dag/api/client/rpc/DAGClientAMProtocolBlockingPB.java
@@ -22,7 +22,7 @@ import org.apache.hadoop.ipc.ProtocolInfo;
import org.apache.tez.dag.api.client.rpc.DAGClientAMProtocolRPC.DAGClientAMProtocol;
@ProtocolInfo(
- protocolName = "org.apache.tez.dag.api.client.rpc.DAGClientAMProtocolPB",
+ protocolName = "org.apache.tez.dag.api.client.rpc.DAGClientAMProtocolBlockingPB",
protocolVersion = 1)
public interface DAGClientAMProtocolBlockingPB
extends DAGClientAMProtocol.BlockingInterface {
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-common/src/main/java/org/apache/tez/common/security/JobTokenIdentifier.java
----------------------------------------------------------------------
diff --git a/tez-common/src/main/java/org/apache/tez/common/security/JobTokenIdentifier.java b/tez-common/src/main/java/org/apache/tez/common/security/JobTokenIdentifier.java
new file mode 100644
index 0000000..47bf74d
--- /dev/null
+++ b/tez-common/src/main/java/org/apache/tez/common/security/JobTokenIdentifier.java
@@ -0,0 +1,98 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.tez.common.security;
+
+import java.io.DataInput;
+import java.io.DataOutput;
+import java.io.IOException;
+
+import org.apache.hadoop.classification.InterfaceAudience;
+import org.apache.hadoop.classification.InterfaceStability;
+import org.apache.hadoop.io.Text;
+import org.apache.hadoop.security.UserGroupInformation;
+import org.apache.hadoop.security.token.Token;
+import org.apache.hadoop.security.token.TokenIdentifier;
+
+/**
+ * The token identifier for job token
+ */
+@InterfaceAudience.Private
+@InterfaceStability.Unstable
+public class JobTokenIdentifier extends TokenIdentifier {
+ private Text jobid;
+ public final static Text KIND_NAME = new Text("tez.job");
+
+ /**
+ * Default constructor
+ */
+ public JobTokenIdentifier() {
+ this.jobid = new Text();
+ }
+
+ /**
+ * Create a job token identifier from a jobid
+ * @param jobid the jobid to use
+ */
+ public JobTokenIdentifier(Text jobid) {
+ this.jobid = jobid;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Text getKind() {
+ return KIND_NAME;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public UserGroupInformation getUser() {
+ if (jobid == null || "".equals(jobid.toString())) {
+ return null;
+ }
+ return UserGroupInformation.createRemoteUser(jobid.toString());
+ }
+
+ /**
+ * Get the jobid
+ * @return the jobid
+ */
+ public Text getJobId() {
+ return jobid;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void readFields(DataInput in) throws IOException {
+ jobid.readFields(in);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void write(DataOutput out) throws IOException {
+ jobid.write(out);
+ }
+
+ @InterfaceAudience.Private
+ public static class Renewer extends Token.TrivialRenewer {
+ @Override
+ protected Text getKind() {
+ return KIND_NAME;
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-dag/src/main/java/org/apache/hadoop/mapred/YarnTezDagChild.java
----------------------------------------------------------------------
diff --git a/tez-dag/src/main/java/org/apache/hadoop/mapred/YarnTezDagChild.java b/tez-dag/src/main/java/org/apache/hadoop/mapred/YarnTezDagChild.java
index 9fa0853..b856f76 100644
--- a/tez-dag/src/main/java/org/apache/hadoop/mapred/YarnTezDagChild.java
+++ b/tez-dag/src/main/java/org/apache/hadoop/mapred/YarnTezDagChild.java
@@ -65,6 +65,7 @@ import org.apache.tez.common.TezJobConfig;
import org.apache.tez.common.TezTaskUmbilicalProtocol;
import org.apache.tez.common.TezUtils;
import org.apache.tez.common.counters.Limits;
+import org.apache.tez.common.security.JobTokenIdentifier;
import org.apache.tez.dag.api.TezConfiguration;
import org.apache.tez.dag.api.TezException;
import org.apache.tez.dag.records.TezTaskAttemptID;
@@ -83,7 +84,6 @@ import org.apache.tez.runtime.api.impl.TezUmbilical;
import org.apache.tez.runtime.common.objectregistry.ObjectLifeCycle;
import org.apache.tez.runtime.common.objectregistry.ObjectRegistryImpl;
import org.apache.tez.runtime.common.objectregistry.ObjectRegistryModule;
-import org.apache.tez.runtime.library.common.security.JobTokenIdentifier;
import org.apache.tez.runtime.library.common.security.TokenCache;
import org.apache.tez.runtime.library.shuffle.common.ShuffleUtils;
@@ -302,9 +302,9 @@ public class YarnTezDagChild {
UserGroupInformation.getCurrentUser().getCredentials();
if (LOG.isDebugEnabled()) {
- LOG.info("Executing with tokens:");
- for (Token<?> token: credentials.getAllTokens()) {
- LOG.info(token);
+ LOG.debug("Executing with tokens:");
+ for (Token<?> token : credentials.getAllTokens()) {
+ LOG.debug(token);
}
}
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-dag/src/main/java/org/apache/tez/dag/api/client/DAGClientServer.java
----------------------------------------------------------------------
diff --git a/tez-dag/src/main/java/org/apache/tez/dag/api/client/DAGClientServer.java b/tez-dag/src/main/java/org/apache/tez/dag/api/client/DAGClientServer.java
index 91fd8b4..3c2e669 100644
--- a/tez-dag/src/main/java/org/apache/tez/dag/api/client/DAGClientServer.java
+++ b/tez-dag/src/main/java/org/apache/tez/dag/api/client/DAGClientServer.java
@@ -25,10 +25,12 @@ import java.nio.ByteBuffer;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.hadoop.conf.Configuration;
+import org.apache.hadoop.fs.CommonConfigurationKeysPublic;
import org.apache.hadoop.ipc.ProtobufRpcEngine;
import org.apache.hadoop.ipc.RPC;
import org.apache.hadoop.ipc.RPC.Server;
import org.apache.hadoop.net.NetUtils;
+import org.apache.hadoop.security.authorize.PolicyProvider;
import org.apache.hadoop.service.AbstractService;
import org.apache.hadoop.yarn.api.records.ApplicationAttemptId;
import org.apache.hadoop.yarn.security.client.ClientToAMTokenSecretManager;
@@ -38,6 +40,7 @@ import org.apache.tez.dag.api.client.rpc.DAGClientAMProtocolBlockingPB;
import org.apache.tez.dag.api.client.rpc.DAGClientAMProtocolBlockingPBServerImpl;
import org.apache.tez.dag.api.client.rpc.DAGClientAMProtocolRPC.DAGClientAMProtocol;
import org.apache.tez.dag.app.DAGAppMaster.DAGClientHandler;
+import org.apache.tez.dag.app.security.authorize.TezAMPolicyProvider;
import com.google.protobuf.BlockingService;
@@ -75,6 +78,14 @@ public class DAGClientServer extends AbstractService {
server = createServer(DAGClientAMProtocolBlockingPB.class, addr, conf,
numHandlers, blockingService, portRange);
+
+ // Enable service authorization?
+ if (conf.getBoolean(
+ CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHORIZATION,
+ false)) {
+ refreshServiceAcls(conf, new TezAMPolicyProvider());
+ }
+
server.start();
bindAddress = NetUtils.getConnectAddress(server);
LOG.info("Instantiated DAGClientRPCServer at " + bindAddress);
@@ -84,6 +95,10 @@ public class DAGClientServer extends AbstractService {
}
}
+ private void refreshServiceAcls(Configuration configuration, PolicyProvider policyProvider) {
+ this.server.refreshServiceAcl(configuration, policyProvider);
+ }
+
@Override
public void serviceStop() {
if(server != null) {
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-dag/src/main/java/org/apache/tez/dag/app/DAGAppMaster.java
----------------------------------------------------------------------
diff --git a/tez-dag/src/main/java/org/apache/tez/dag/app/DAGAppMaster.java b/tez-dag/src/main/java/org/apache/tez/dag/app/DAGAppMaster.java
index b0c770e..6ec96ed 100644
--- a/tez-dag/src/main/java/org/apache/tez/dag/app/DAGAppMaster.java
+++ b/tez-dag/src/main/java/org/apache/tez/dag/app/DAGAppMaster.java
@@ -79,6 +79,7 @@ import org.apache.hadoop.yarn.util.ConverterUtils;
import org.apache.hadoop.yarn.util.SystemClock;
import org.apache.tez.client.TezSessionStatus;
import org.apache.tez.common.TezUtils;
+import org.apache.tez.common.security.JobTokenIdentifier;
import org.apache.tez.dag.api.DagTypeConverters;
import org.apache.tez.dag.api.TezConfiguration;
import org.apache.tez.dag.api.TezConstants;
@@ -124,7 +125,6 @@ import org.apache.tez.dag.history.HistoryEventHandler;
import org.apache.tez.dag.history.avro.HistoryEventType;
import org.apache.tez.dag.history.events.AMStartedEvent;
import org.apache.tez.dag.records.TezDAGID;
-import org.apache.tez.runtime.library.common.security.JobTokenIdentifier;
import org.apache.tez.runtime.library.common.security.JobTokenSecretManager;
import org.apache.tez.runtime.library.common.security.TokenCache;
@@ -265,12 +265,17 @@ public class DAGAppMaster extends AbstractService {
containerHeartbeatHandler = createContainerHeartbeatHandler(context, conf);
addIfService(containerHeartbeatHandler, true);
- JobTokenIdentifier identifier = new JobTokenIdentifier(new Text(UUID
- .randomUUID().toString()));
+ String sessionTokenUUID = UUID.randomUUID().toString();
+ JobTokenIdentifier identifier = new JobTokenIdentifier(new Text(
+ sessionTokenUUID));
sessionToken = new Token<JobTokenIdentifier>(identifier,
jobTokenSecretManager);
sessionToken.setService(identifier.getJobId());
TokenCache.setJobToken(sessionToken, tokens);
+ // Prepare the TaskAttemptListener server for authentication of Containers
+ // TaskAttemptListener gets the information via jobTokenSecretManager.
+ jobTokenSecretManager.addTokenForJob(sessionTokenUUID, sessionToken);
+ LOG.info("Adding session token to jobTokenSecretManager for sessionTokenUUID: " + sessionTokenUUID);
//service to handle requests to TaskUmbilicalProtocol
taskAttemptListener = createTaskAttemptListener(context,
@@ -477,13 +482,6 @@ public class DAGAppMaster extends AbstractService {
TezDAGID dagId = TezDAGID.getInstance(appAttemptID.getApplicationId(),
dagCounter.incrementAndGet());
- // Prepare the TaskAttemptListener server for authentication of Containers
- // TaskAttemptListener gets the information via jobTokenSecretManager.
- String dagIdString = dagId.toString();
- jobTokenSecretManager.addTokenForJob(dagIdString, sessionToken);
- LOG.info("Adding job token for " + dagIdString
- + " to jobTokenSecretManager");
-
Iterator<PlanKeyValuePair> iter =
dagPB.getDagKeyValues().getConfKeyValuesList().iterator();
Configuration dagConf = new Configuration(amConf);
@@ -941,7 +939,6 @@ public class DAGAppMaster extends AbstractService {
wLock.unlock();
}
}
-
}
private class ServiceWithDependency implements ServiceStateChangeListener {
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-dag/src/main/java/org/apache/tez/dag/app/DAGClientSecurityInfo.java
----------------------------------------------------------------------
diff --git a/tez-dag/src/main/java/org/apache/tez/dag/app/DAGClientSecurityInfo.java b/tez-dag/src/main/java/org/apache/tez/dag/app/DAGClientSecurityInfo.java
new file mode 100644
index 0000000..b787595
--- /dev/null
+++ b/tez-dag/src/main/java/org/apache/tez/dag/app/DAGClientSecurityInfo.java
@@ -0,0 +1,58 @@
+/**
+* Licensed to the Apache Software Foundation (ASF) under one
+* or more contributor license agreements. See the NOTICE file
+* distributed with this work for additional information
+* regarding copyright ownership. The ASF licenses this file
+* to you under the Apache License, Version 2.0 (the
+* "License"); you may not use this file except in compliance
+* with the License. You may obtain a copy of the License at
+*
+* http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+
+package org.apache.tez.dag.app;
+
+import java.lang.annotation.Annotation;
+
+import org.apache.hadoop.conf.Configuration;
+import org.apache.hadoop.security.KerberosInfo;
+import org.apache.hadoop.security.SecurityInfo;
+import org.apache.hadoop.security.token.TokenIdentifier;
+import org.apache.hadoop.security.token.TokenInfo;
+import org.apache.hadoop.security.token.TokenSelector;
+import org.apache.hadoop.yarn.security.client.ClientToAMTokenSelector;
+import org.apache.tez.dag.api.client.rpc.DAGClientAMProtocolBlockingPB;
+
+public class DAGClientSecurityInfo extends SecurityInfo {
+
+ @Override
+ public KerberosInfo getKerberosInfo(Class<?> protocol, Configuration conf) {
+ return null;
+ }
+
+ @Override
+ public TokenInfo getTokenInfo(Class<?> protocol, Configuration conf) {
+ if (!protocol.equals(DAGClientAMProtocolBlockingPB.class)) {
+ return null;
+ }
+ return new TokenInfo() {
+
+ @Override
+ public Class<? extends Annotation> annotationType() {
+ return null;
+ }
+
+ @Override
+ public Class<? extends TokenSelector<? extends TokenIdentifier>>
+ value() {
+ return ClientToAMTokenSelector.class;
+ }
+ };
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-dag/src/main/java/org/apache/tez/dag/app/MRClientSecurityInfo.java
----------------------------------------------------------------------
diff --git a/tez-dag/src/main/java/org/apache/tez/dag/app/MRClientSecurityInfo.java b/tez-dag/src/main/java/org/apache/tez/dag/app/MRClientSecurityInfo.java
deleted file mode 100644
index 73c9a02..0000000
--- a/tez-dag/src/main/java/org/apache/tez/dag/app/MRClientSecurityInfo.java
+++ /dev/null
@@ -1,58 +0,0 @@
-/**
-* Licensed to the Apache Software Foundation (ASF) under one
-* or more contributor license agreements. See the NOTICE file
-* distributed with this work for additional information
-* regarding copyright ownership. The ASF licenses this file
-* to you under the Apache License, Version 2.0 (the
-* "License"); you may not use this file except in compliance
-* with the License. You may obtain a copy of the License at
-*
-* http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing, software
-* distributed under the License is distributed on an "AS IS" BASIS,
-* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-* See the License for the specific language governing permissions and
-* limitations under the License.
-*/
-
-package org.apache.tez.dag.app;
-
-import java.lang.annotation.Annotation;
-
-import org.apache.hadoop.conf.Configuration;
-import org.apache.hadoop.mapreduce.v2.api.MRClientProtocolPB;
-import org.apache.hadoop.security.KerberosInfo;
-import org.apache.hadoop.security.SecurityInfo;
-import org.apache.hadoop.security.token.TokenIdentifier;
-import org.apache.hadoop.security.token.TokenInfo;
-import org.apache.hadoop.security.token.TokenSelector;
-import org.apache.hadoop.yarn.security.client.ClientToAMTokenSelector;
-
-public class MRClientSecurityInfo extends SecurityInfo {
-
- @Override
- public KerberosInfo getKerberosInfo(Class<?> protocol, Configuration conf) {
- return null;
- }
-
- @Override
- public TokenInfo getTokenInfo(Class<?> protocol, Configuration conf) {
- if (!protocol.equals(MRClientProtocolPB.class)) {
- return null;
- }
- return new TokenInfo() {
-
- @Override
- public Class<? extends Annotation> annotationType() {
- return null;
- }
-
- @Override
- public Class<? extends TokenSelector<? extends TokenIdentifier>>
- value() {
- return ClientToAMTokenSelector.class;
- }
- };
- }
-}
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-dag/src/main/java/org/apache/tez/dag/app/TaskAttemptListenerImpTezDag.java
----------------------------------------------------------------------
diff --git a/tez-dag/src/main/java/org/apache/tez/dag/app/TaskAttemptListenerImpTezDag.java b/tez-dag/src/main/java/org/apache/tez/dag/app/TaskAttemptListenerImpTezDag.java
index 7741b71..a13b730 100644
--- a/tez-dag/src/main/java/org/apache/tez/dag/app/TaskAttemptListenerImpTezDag.java
+++ b/tez-dag/src/main/java/org/apache/tez/dag/app/TaskAttemptListenerImpTezDag.java
@@ -48,7 +48,7 @@ import org.apache.tez.dag.app.dag.event.TaskAttemptEventStartedRemotely;
import org.apache.tez.dag.app.dag.event.VertexEventRouteEvent;
import org.apache.tez.dag.app.rm.container.AMContainerImpl;
import org.apache.tez.dag.app.rm.container.AMContainerTask;
-import org.apache.tez.dag.app.security.authorize.MRAMPolicyProvider;
+import org.apache.tez.dag.app.security.authorize.TezAMPolicyProvider;
import org.apache.tez.dag.records.TezTaskAttemptID;
import org.apache.tez.dag.records.TezVertexID;
import org.apache.tez.runtime.api.impl.TezEvent;
@@ -128,7 +128,7 @@ public class TaskAttemptListenerImpTezDag extends AbstractService implements
if (conf.getBoolean(
CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHORIZATION,
false)) {
- refreshServiceAcls(conf, new MRAMPolicyProvider());
+ refreshServiceAcls(conf, new TezAMPolicyProvider());
}
server.start();
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-dag/src/main/java/org/apache/tez/dag/app/security/authorize/ClientHSPolicyProvider.java
----------------------------------------------------------------------
diff --git a/tez-dag/src/main/java/org/apache/tez/dag/app/security/authorize/ClientHSPolicyProvider.java b/tez-dag/src/main/java/org/apache/tez/dag/app/security/authorize/ClientHSPolicyProvider.java
deleted file mode 100644
index 5343b7d..0000000
--- a/tez-dag/src/main/java/org/apache/tez/dag/app/security/authorize/ClientHSPolicyProvider.java
+++ /dev/null
@@ -1,45 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.tez.dag.app.security.authorize;
-
-import org.apache.hadoop.classification.InterfaceAudience;
-import org.apache.hadoop.classification.InterfaceStability;
-import org.apache.hadoop.mapreduce.v2.api.HSClientProtocolPB;
-import org.apache.hadoop.mapreduce.v2.jobhistory.JHAdminConfig;
-import org.apache.hadoop.security.authorize.PolicyProvider;
-import org.apache.hadoop.security.authorize.Service;
-
-/**
- * {@link PolicyProvider} for YARN MapReduce protocols.
- */
-@InterfaceAudience.Private
-@InterfaceStability.Unstable
-public class ClientHSPolicyProvider extends PolicyProvider {
-
- private static final Service[] mrHSServices =
- new Service[] {
- new Service(
- JHAdminConfig.MR_HS_SECURITY_SERVICE_AUTHORIZATION,
- HSClientProtocolPB.class)
- };
-
- @Override
- public Service[] getServices() {
- return mrHSServices;
- }
-}
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-dag/src/main/java/org/apache/tez/dag/app/security/authorize/MRAMPolicyProvider.java
----------------------------------------------------------------------
diff --git a/tez-dag/src/main/java/org/apache/tez/dag/app/security/authorize/MRAMPolicyProvider.java b/tez-dag/src/main/java/org/apache/tez/dag/app/security/authorize/MRAMPolicyProvider.java
deleted file mode 100644
index 0fff709..0000000
--- a/tez-dag/src/main/java/org/apache/tez/dag/app/security/authorize/MRAMPolicyProvider.java
+++ /dev/null
@@ -1,50 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.tez.dag.app.security.authorize;
-
-import org.apache.hadoop.classification.InterfaceAudience;
-import org.apache.hadoop.classification.InterfaceStability;
-import org.apache.hadoop.mapred.TaskUmbilicalProtocol;
-import org.apache.hadoop.mapreduce.v2.api.MRClientProtocolPB;
-import org.apache.hadoop.security.authorize.PolicyProvider;
-import org.apache.hadoop.security.authorize.Service;
-import org.apache.tez.mapreduce.hadoop.MRJobConfig;
-
-/**
- * {@link PolicyProvider} for YARN MapReduce protocols.
- */
-@InterfaceAudience.Private
-@InterfaceStability.Unstable
-public class MRAMPolicyProvider extends PolicyProvider {
-
- private static final Service[] mapReduceApplicationMasterServices =
- new Service[] {
- new Service(
- MRJobConfig.MR_AM_SECURITY_SERVICE_AUTHORIZATION_TASK_UMBILICAL,
- TaskUmbilicalProtocol.class),
- new Service(
- MRJobConfig.MR_AM_SECURITY_SERVICE_AUTHORIZATION_CLIENT,
- MRClientProtocolPB.class)
- };
-
- @Override
- public Service[] getServices() {
- return mapReduceApplicationMasterServices;
- }
-
-}
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-dag/src/main/java/org/apache/tez/dag/app/security/authorize/TezAMPolicyProvider.java
----------------------------------------------------------------------
diff --git a/tez-dag/src/main/java/org/apache/tez/dag/app/security/authorize/TezAMPolicyProvider.java b/tez-dag/src/main/java/org/apache/tez/dag/app/security/authorize/TezAMPolicyProvider.java
new file mode 100644
index 0000000..d72db04
--- /dev/null
+++ b/tez-dag/src/main/java/org/apache/tez/dag/app/security/authorize/TezAMPolicyProvider.java
@@ -0,0 +1,50 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tez.dag.app.security.authorize;
+
+import org.apache.hadoop.classification.InterfaceAudience;
+import org.apache.hadoop.classification.InterfaceStability;
+import org.apache.hadoop.security.authorize.PolicyProvider;
+import org.apache.hadoop.security.authorize.Service;
+import org.apache.tez.common.TezTaskUmbilicalProtocol;
+import org.apache.tez.dag.api.client.rpc.DAGClientAMProtocolBlockingPB;
+import org.apache.tez.mapreduce.hadoop.MRJobConfig;
+
+/**
+ * {@link PolicyProvider} for YARN MapReduce protocols.
+ */
+@InterfaceAudience.Private
+@InterfaceStability.Unstable
+public class TezAMPolicyProvider extends PolicyProvider {
+
+ private static final Service[] tezApplicationMasterServices =
+ new Service[] {
+ new Service(
+ MRJobConfig.MR_AM_SECURITY_SERVICE_AUTHORIZATION_TASK_UMBILICAL,
+ TezTaskUmbilicalProtocol.class),
+ new Service(
+ MRJobConfig.MR_AM_SECURITY_SERVICE_AUTHORIZATION_CLIENT,
+ DAGClientAMProtocolBlockingPB.class)
+ };
+
+ @Override
+ public Service[] getServices() {
+ return tezApplicationMasterServices;
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-dag/src/main/resources/META-INF/services/org.apache.hadoop.security.SecurityInfo
----------------------------------------------------------------------
diff --git a/tez-dag/src/main/resources/META-INF/services/org.apache.hadoop.security.SecurityInfo b/tez-dag/src/main/resources/META-INF/services/org.apache.hadoop.security.SecurityInfo
index d1de651..55a0d33 100644
--- a/tez-dag/src/main/resources/META-INF/services/org.apache.hadoop.security.SecurityInfo
+++ b/tez-dag/src/main/resources/META-INF/services/org.apache.hadoop.security.SecurityInfo
@@ -11,4 +11,4 @@
# See the License for the specific language governing permissions and
# limitations under the License.
#
-org.apache.tez.dag.app.MRClientSecurityInfo
+org.apache.tez.dag.app.DAGClientSecurityInfo
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-dag/src/test/java/org/apache/tez/dag/app/rm/container/TestAMContainer.java
----------------------------------------------------------------------
diff --git a/tez-dag/src/test/java/org/apache/tez/dag/app/rm/container/TestAMContainer.java b/tez-dag/src/test/java/org/apache/tez/dag/app/rm/container/TestAMContainer.java
index 9298cca..fd1900f 100644
--- a/tez-dag/src/test/java/org/apache/tez/dag/app/rm/container/TestAMContainer.java
+++ b/tez-dag/src/test/java/org/apache/tez/dag/app/rm/container/TestAMContainer.java
@@ -52,6 +52,7 @@ import org.apache.hadoop.yarn.api.records.Priority;
import org.apache.hadoop.yarn.api.records.Resource;
import org.apache.hadoop.yarn.event.Event;
import org.apache.hadoop.yarn.event.EventHandler;
+import org.apache.tez.common.security.JobTokenIdentifier;
import org.apache.tez.dag.app.AppContext;
import org.apache.tez.dag.app.ContainerHeartbeatHandler;
import org.apache.tez.dag.app.ContainerContext;
@@ -66,7 +67,6 @@ import org.apache.tez.dag.records.TezTaskAttemptID;
import org.apache.tez.dag.records.TezTaskID;
import org.apache.tez.dag.records.TezVertexID;
import org.apache.tez.runtime.api.impl.TaskSpec;
-import org.apache.tez.runtime.library.common.security.JobTokenIdentifier;
import org.apache.tez.runtime.library.common.security.TokenCache;
import org.junit.Test;
import org.mockito.ArgumentCaptor;
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-mapreduce/src/main/java/org/apache/tez/mapreduce/processor/MRTask.java
----------------------------------------------------------------------
diff --git a/tez-mapreduce/src/main/java/org/apache/tez/mapreduce/processor/MRTask.java b/tez-mapreduce/src/main/java/org/apache/tez/mapreduce/processor/MRTask.java
index 7383122..d97ff46 100644
--- a/tez-mapreduce/src/main/java/org/apache/tez/mapreduce/processor/MRTask.java
+++ b/tez-mapreduce/src/main/java/org/apache/tez/mapreduce/processor/MRTask.java
@@ -68,6 +68,7 @@ import org.apache.tez.common.TezUtils;
import org.apache.tez.common.counters.TaskCounter;
import org.apache.tez.common.counters.TezCounter;
import org.apache.tez.common.counters.TezCounters;
+import org.apache.tez.common.security.JobTokenIdentifier;
import org.apache.tez.dag.records.TezDAGID;
import org.apache.tez.mapreduce.hadoop.DeprecatedKeys;
import org.apache.tez.mapreduce.hadoop.IDConverter;
@@ -79,7 +80,6 @@ import org.apache.tez.mapreduce.output.MROutput;
import org.apache.tez.runtime.api.LogicalOutput;
import org.apache.tez.runtime.api.TezProcessorContext;
import org.apache.tez.runtime.library.common.Constants;
-import org.apache.tez.runtime.library.common.security.JobTokenIdentifier;
import org.apache.tez.runtime.library.common.security.TokenCache;
import org.apache.tez.runtime.library.common.sort.impl.TezRawKeyValueIterator;
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-mapreduce/src/test/java/org/apache/tez/mapreduce/processor/MapUtils.java
----------------------------------------------------------------------
diff --git a/tez-mapreduce/src/test/java/org/apache/tez/mapreduce/processor/MapUtils.java b/tez-mapreduce/src/test/java/org/apache/tez/mapreduce/processor/MapUtils.java
index da4b24c..e0efd45 100644
--- a/tez-mapreduce/src/test/java/org/apache/tez/mapreduce/processor/MapUtils.java
+++ b/tez-mapreduce/src/test/java/org/apache/tez/mapreduce/processor/MapUtils.java
@@ -50,6 +50,7 @@ import org.apache.hadoop.security.token.Token;
import org.apache.hadoop.util.DiskChecker.DiskErrorException;
import org.apache.tez.common.TezJobConfig;
import org.apache.tez.common.TezUtils;
+import org.apache.tez.common.security.JobTokenIdentifier;
import org.apache.tez.dag.api.ProcessorDescriptor;
import org.apache.tez.mapreduce.TezTestUtils;
import org.apache.tez.mapreduce.hadoop.MRJobConfig;
@@ -59,7 +60,6 @@ import org.apache.tez.runtime.api.impl.InputSpec;
import org.apache.tez.runtime.api.impl.OutputSpec;
import org.apache.tez.runtime.api.impl.TaskSpec;
import org.apache.tez.runtime.api.impl.TezUmbilical;
-import org.apache.tez.runtime.library.common.security.JobTokenIdentifier;
import org.apache.tez.runtime.library.shuffle.common.ShuffleUtils;
public class MapUtils {
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-mapreduce/src/test/java/org/apache/tez/mapreduce/processor/reduce/TestReduceProcessor.java
----------------------------------------------------------------------
diff --git a/tez-mapreduce/src/test/java/org/apache/tez/mapreduce/processor/reduce/TestReduceProcessor.java b/tez-mapreduce/src/test/java/org/apache/tez/mapreduce/processor/reduce/TestReduceProcessor.java
index ad0ec19..7462fba 100644
--- a/tez-mapreduce/src/test/java/org/apache/tez/mapreduce/processor/reduce/TestReduceProcessor.java
+++ b/tez-mapreduce/src/test/java/org/apache/tez/mapreduce/processor/reduce/TestReduceProcessor.java
@@ -38,6 +38,7 @@ import org.apache.hadoop.mapreduce.MRConfig;
import org.apache.hadoop.security.token.Token;
import org.apache.tez.common.TezJobConfig;
import org.apache.tez.common.TezUtils;
+import org.apache.tez.common.security.JobTokenIdentifier;
import org.apache.tez.dag.api.InputDescriptor;
import org.apache.tez.dag.api.OutputDescriptor;
import org.apache.tez.dag.api.ProcessorDescriptor;
@@ -57,7 +58,6 @@ import org.apache.tez.runtime.api.impl.InputSpec;
import org.apache.tez.runtime.api.impl.OutputSpec;
import org.apache.tez.runtime.api.impl.TaskSpec;
import org.apache.tez.runtime.library.common.Constants;
-import org.apache.tez.runtime.library.common.security.JobTokenIdentifier;
import org.apache.tez.runtime.library.common.task.local.output.TezLocalTaskOutputFiles;
import org.apache.tez.runtime.library.common.task.local.output.TezTaskOutput;
import org.apache.tez.runtime.library.input.LocalMergedInput;
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-runtime-internals/src/main/java/org/apache/tez/common/TezTaskUmbilicalProtocol.java
----------------------------------------------------------------------
diff --git a/tez-runtime-internals/src/main/java/org/apache/tez/common/TezTaskUmbilicalProtocol.java b/tez-runtime-internals/src/main/java/org/apache/tez/common/TezTaskUmbilicalProtocol.java
index 1966790..0c55e8b 100644
--- a/tez-runtime-internals/src/main/java/org/apache/tez/common/TezTaskUmbilicalProtocol.java
+++ b/tez-runtime-internals/src/main/java/org/apache/tez/common/TezTaskUmbilicalProtocol.java
@@ -24,19 +24,23 @@ import org.apache.hadoop.classification.InterfaceAudience;
import org.apache.hadoop.classification.InterfaceStability;
import org.apache.hadoop.ipc.ProtocolInfo;
import org.apache.hadoop.ipc.VersionedProtocol;
+import org.apache.hadoop.security.token.TokenInfo;
import org.apache.tez.common.records.ProceedToCompletionResponse;
import org.apache.tez.dag.api.TezException;
import org.apache.tez.dag.records.TezTaskAttemptID;
import org.apache.tez.runtime.api.impl.TezHeartbeatRequest;
import org.apache.tez.runtime.api.impl.TezHeartbeatResponse;
+import org.apache.tez.runtime.common.security.JobTokenSelector;
/** Protocol that task child process uses to contact its parent process. The
* parent is a daemon which which polls the central master for a new map or
* reduce task and runs it as a child process. All communication between child
* and parent is via this protocol. */
+@TokenInfo(JobTokenSelector.class)
@InterfaceAudience.Private
@InterfaceStability.Stable
-@ProtocolInfo(protocolName = "TezTaskUmbilicalProtocol", protocolVersion = 1)
+// ProtocolInfo will be required once we move to Hadoop PB RPC
+//@ProtocolInfo(protocolName = "TezTaskUmbilicalProtocol", protocolVersion = 1)
public interface TezTaskUmbilicalProtocol extends VersionedProtocol {
public static final long versionID = 19L;
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-runtime-internals/src/main/java/org/apache/tez/runtime/common/security/JobTokenSelector.java
----------------------------------------------------------------------
diff --git a/tez-runtime-internals/src/main/java/org/apache/tez/runtime/common/security/JobTokenSelector.java b/tez-runtime-internals/src/main/java/org/apache/tez/runtime/common/security/JobTokenSelector.java
new file mode 100644
index 0000000..7d15a57
--- /dev/null
+++ b/tez-runtime-internals/src/main/java/org/apache/tez/runtime/common/security/JobTokenSelector.java
@@ -0,0 +1,54 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.tez.runtime.common.security;
+
+import java.util.Collection;
+
+import org.apache.hadoop.classification.InterfaceAudience;
+import org.apache.hadoop.classification.InterfaceStability;
+import org.apache.hadoop.io.Text;
+import org.apache.hadoop.security.token.Token;
+import org.apache.hadoop.security.token.TokenIdentifier;
+import org.apache.hadoop.security.token.TokenSelector;
+import org.apache.tez.common.security.JobTokenIdentifier;
+
+/**
+ * Look through tokens to find the first job token that matches the service
+ * and return it.
+ */
+@InterfaceAudience.Private
+@InterfaceStability.Unstable
+public class JobTokenSelector implements TokenSelector<JobTokenIdentifier> {
+
+ @SuppressWarnings("unchecked")
+ @Override
+ public Token<JobTokenIdentifier> selectToken(Text service,
+ Collection<Token<? extends TokenIdentifier>> tokens) {
+ if (service == null) {
+ return null;
+ }
+ for (Token<? extends TokenIdentifier> token : tokens) {
+ if (JobTokenIdentifier.KIND_NAME.equals(token.getKind())
+ && service.equals(token.getService())) {
+ return (Token<JobTokenIdentifier>) token;
+ }
+ }
+ return null;
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/JobTokenIdentifier.java
----------------------------------------------------------------------
diff --git a/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/JobTokenIdentifier.java b/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/JobTokenIdentifier.java
deleted file mode 100644
index 4b916fa..0000000
--- a/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/JobTokenIdentifier.java
+++ /dev/null
@@ -1,98 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.tez.runtime.library.common.security;
-
-import java.io.DataInput;
-import java.io.DataOutput;
-import java.io.IOException;
-
-import org.apache.hadoop.classification.InterfaceAudience;
-import org.apache.hadoop.classification.InterfaceStability;
-import org.apache.hadoop.io.Text;
-import org.apache.hadoop.security.UserGroupInformation;
-import org.apache.hadoop.security.token.Token;
-import org.apache.hadoop.security.token.TokenIdentifier;
-
-/**
- * The token identifier for job token
- */
-@InterfaceAudience.Private
-@InterfaceStability.Unstable
-public class JobTokenIdentifier extends TokenIdentifier {
- private Text jobid;
- public final static Text KIND_NAME = new Text("mapreduce.job");
-
- /**
- * Default constructor
- */
- public JobTokenIdentifier() {
- this.jobid = new Text();
- }
-
- /**
- * Create a job token identifier from a jobid
- * @param jobid the jobid to use
- */
- public JobTokenIdentifier(Text jobid) {
- this.jobid = jobid;
- }
-
- /** {@inheritDoc} */
- @Override
- public Text getKind() {
- return KIND_NAME;
- }
-
- /** {@inheritDoc} */
- @Override
- public UserGroupInformation getUser() {
- if (jobid == null || "".equals(jobid.toString())) {
- return null;
- }
- return UserGroupInformation.createRemoteUser(jobid.toString());
- }
-
- /**
- * Get the jobid
- * @return the jobid
- */
- public Text getJobId() {
- return jobid;
- }
-
- /** {@inheritDoc} */
- @Override
- public void readFields(DataInput in) throws IOException {
- jobid.readFields(in);
- }
-
- /** {@inheritDoc} */
- @Override
- public void write(DataOutput out) throws IOException {
- jobid.write(out);
- }
-
- @InterfaceAudience.Private
- public static class Renewer extends Token.TrivialRenewer {
- @Override
- protected Text getKind() {
- return KIND_NAME;
- }
- }
-}
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/JobTokenSecretManager.java
----------------------------------------------------------------------
diff --git a/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/JobTokenSecretManager.java b/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/JobTokenSecretManager.java
index a03ee94..66153af 100644
--- a/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/JobTokenSecretManager.java
+++ b/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/JobTokenSecretManager.java
@@ -27,6 +27,7 @@ import org.apache.hadoop.classification.InterfaceAudience;
import org.apache.hadoop.classification.InterfaceStability;
import org.apache.hadoop.security.token.SecretManager;
import org.apache.hadoop.security.token.Token;
+import org.apache.tez.common.security.JobTokenIdentifier;
/**
* SecretManager for job token. It can be used to cache generated job tokens.
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/JobTokenSelector.java
----------------------------------------------------------------------
diff --git a/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/JobTokenSelector.java b/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/JobTokenSelector.java
deleted file mode 100644
index b8227ab..0000000
--- a/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/JobTokenSelector.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.tez.runtime.library.common.security;
-
-import java.util.Collection;
-
-import org.apache.hadoop.classification.InterfaceAudience;
-import org.apache.hadoop.classification.InterfaceStability;
-import org.apache.hadoop.io.Text;
-import org.apache.hadoop.security.token.Token;
-import org.apache.hadoop.security.token.TokenIdentifier;
-import org.apache.hadoop.security.token.TokenSelector;
-
-/**
- * Look through tokens to find the first job token that matches the service
- * and return it.
- */
-@InterfaceAudience.Private
-@InterfaceStability.Unstable
-public class JobTokenSelector implements TokenSelector<JobTokenIdentifier> {
-
- @SuppressWarnings("unchecked")
- @Override
- public Token<JobTokenIdentifier> selectToken(Text service,
- Collection<Token<? extends TokenIdentifier>> tokens) {
- if (service == null) {
- return null;
- }
- for (Token<? extends TokenIdentifier> token : tokens) {
- if (JobTokenIdentifier.KIND_NAME.equals(token.getKind())
- && service.equals(token.getService())) {
- return (Token<JobTokenIdentifier>) token;
- }
- }
- return null;
- }
-}
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/TokenCache.java
----------------------------------------------------------------------
diff --git a/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/TokenCache.java b/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/TokenCache.java
index 33373b7..6efc627 100644
--- a/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/TokenCache.java
+++ b/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/security/TokenCache.java
@@ -35,6 +35,7 @@ import org.apache.hadoop.security.UserGroupInformation;
import org.apache.hadoop.security.token.Token;
import org.apache.hadoop.security.token.TokenIdentifier;
import org.apache.tez.common.TezJobConfig;
+import org.apache.tez.common.security.JobTokenIdentifier;
/**
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/shuffle/server/ShuffleHandler.java
----------------------------------------------------------------------
diff --git a/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/shuffle/server/ShuffleHandler.java b/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/shuffle/server/ShuffleHandler.java
index 2f934e9..aecc9e4 100644
--- a/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/shuffle/server/ShuffleHandler.java
+++ b/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/common/shuffle/server/ShuffleHandler.java
@@ -64,8 +64,8 @@ import org.apache.hadoop.yarn.server.api.ApplicationInitializationContext;
import org.apache.hadoop.yarn.server.api.ApplicationTerminationContext;
import org.apache.hadoop.yarn.server.api.AuxiliaryService;
import org.apache.tez.common.TezJobConfig;
+import org.apache.tez.common.security.JobTokenIdentifier;
import org.apache.tez.runtime.api.TezOutputContext;
-import org.apache.tez.runtime.library.common.security.JobTokenIdentifier;
import org.apache.tez.runtime.library.common.security.JobTokenSecretManager;
import org.apache.tez.runtime.library.common.security.SecureShuffleUtils;
import org.apache.tez.runtime.library.common.shuffle.impl.ShuffleHeader;
http://git-wip-us.apache.org/repos/asf/incubator-tez/blob/0b4e671e/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/shuffle/common/ShuffleUtils.java
----------------------------------------------------------------------
diff --git a/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/shuffle/common/ShuffleUtils.java b/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/shuffle/common/ShuffleUtils.java
index 094f0fe..13db6f5 100644
--- a/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/shuffle/common/ShuffleUtils.java
+++ b/tez-runtime-library/src/main/java/org/apache/tez/runtime/library/shuffle/common/ShuffleUtils.java
@@ -34,7 +34,7 @@ import org.apache.hadoop.io.compress.CompressionCodec;
import org.apache.hadoop.io.compress.Decompressor;
import org.apache.hadoop.security.token.Token;
import org.apache.hadoop.yarn.api.records.ApplicationId;
-import org.apache.tez.runtime.library.common.security.JobTokenIdentifier;
+import org.apache.tez.common.security.JobTokenIdentifier;
import org.apache.tez.runtime.library.common.security.JobTokenSecretManager;
import org.apache.tez.runtime.library.common.sort.impl.IFileInputStream;