You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by GitBox <gi...@apache.org> on 2021/10/08 05:21:49 UTC
[GitHub] [ozone] adoroszlai commented on a change in pull request #2721: HDDS-5780. Support s3 authentication on a per request basis
adoroszlai commented on a change in pull request #2721:
URL: https://github.com/apache/ozone/pull/2721#discussion_r724347097
##########
File path: hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManagerServiceGrpc.java
##########
@@ -60,22 +79,66 @@ public void submitRequest(OMRequest request,
request.getCmdType().name());
AtomicInteger callCount = new AtomicInteger(0);
OMResponse omResponse;
+
+ if (secConfig.isSecurityEnabled()) {
+ if (request.hasS3Authentication()) {
+ S3Authentication auth = request.getS3Authentication();
+ OzoneTokenIdentifier identifier = new OzoneTokenIdentifier();
+ identifier.setTokenType(S3AUTHINFO);
+ identifier.setStrToSign(auth.getStringToSign());
+ identifier.setSignature(auth.getSignature());
+ identifier.setAwsAccessId(auth.getAccessId());
+ identifier.setOwner(new Text(auth.getAccessId()));
+ try {
+ // authenticate user with signature verification through
+ // delegationTokenMgr validateToken via retrievePassword
+ delegationTokenMgr.retrievePassword(identifier);
+ } catch (Throwable e) {
+ LOG.error("signatures do NOT match for S3 identifier:{}",
+ identifier, e);
+ responseObserver.onNext(
+ createErrorResponse(request,
+ new OMException("User " + request.getUserInfo()
+ .getUserName() +
+ " request authorization failure: " +
+ "signatures do NOT match",
+ OMException.ResultCodes.S3_SECRET_NOT_FOUND)));
+ responseObserver.onCompleted();
+ return;
+ }
+ }
+ }
+
+ org.apache.hadoop.ipc.Server.getCurCall().set(new Server.Call(1,
+ callCount.incrementAndGet(),
+ null,
+ null,
+ RPC.RpcKind.RPC_PROTOCOL_BUFFER,
+ ClientId.getClientId()));
+ // TODO: currently require setting the Server class for each request
+ // with thread context (Server.Call()) that includes retries
+ // and importantly random ClientId. This is currently necessary for
+ // Om Ratis Server to create createWriteRaftClientRequest.
+ // Look to remove Server class requirement for issuing ratis transactions
+ // for OMRequests. Test through successful ratis-enabled OMRequest
+ // handling without dependency on hadoop IPC based Server.
try {
- org.apache.hadoop.ipc.Server.getCurCall().set(new Server.Call(1,
- callCount.incrementAndGet(),
- null,
- null,
- RPC.RpcKind.RPC_PROTOCOL_BUFFER,
- ClientId.getClientId()));
- // TODO: currently require setting the Server class for each request
- // with thread context (Server.Call()) that includes retries
- // and importantly random ClientId. This is currently necessary for
- // Om Ratis Server to create createWriteRaftClientRequest.
- // Look to remove Server class requirement for issuing ratis transactions
- // for OMRequests. Test through successful ratis-enabled OMRequest
- // handling without dependency on hadoop IPC based Server.
- omResponse = this.omTranslator.
- submitRequest(NULL_RPC_CONTROLLER, request);
+ omResponse =
+ UserGroupInformation.getCurrentUser().doAs(
+ (PrivilegedExceptionAction<OMResponse>) () -> {
+ try {
+ return this.omTranslator.
+ submitRequest(NULL_RPC_CONTROLLER, request);
+ } catch (Throwable se) {
+ Throwable e = se.getCause();
+ if (se == null) {
+ throw new IOException(se);
+ } else {
+ throw e instanceof IOException ?
+ (IOException) e : new IOException(se);
Review comment:
Also typo?
```suggestion
(IOException) e : new IOException(e);
```
##########
File path: hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManagerServiceGrpc.java
##########
@@ -60,22 +79,66 @@ public void submitRequest(OMRequest request,
request.getCmdType().name());
AtomicInteger callCount = new AtomicInteger(0);
OMResponse omResponse;
+
+ if (secConfig.isSecurityEnabled()) {
+ if (request.hasS3Authentication()) {
+ S3Authentication auth = request.getS3Authentication();
+ OzoneTokenIdentifier identifier = new OzoneTokenIdentifier();
+ identifier.setTokenType(S3AUTHINFO);
+ identifier.setStrToSign(auth.getStringToSign());
+ identifier.setSignature(auth.getSignature());
+ identifier.setAwsAccessId(auth.getAccessId());
+ identifier.setOwner(new Text(auth.getAccessId()));
+ try {
+ // authenticate user with signature verification through
+ // delegationTokenMgr validateToken via retrievePassword
+ delegationTokenMgr.retrievePassword(identifier);
+ } catch (Throwable e) {
+ LOG.error("signatures do NOT match for S3 identifier:{}",
+ identifier, e);
+ responseObserver.onNext(
+ createErrorResponse(request,
+ new OMException("User " + request.getUserInfo()
+ .getUserName() +
+ " request authorization failure: " +
+ "signatures do NOT match",
+ OMException.ResultCodes.S3_SECRET_NOT_FOUND)));
+ responseObserver.onCompleted();
+ return;
+ }
+ }
+ }
+
+ org.apache.hadoop.ipc.Server.getCurCall().set(new Server.Call(1,
+ callCount.incrementAndGet(),
+ null,
+ null,
+ RPC.RpcKind.RPC_PROTOCOL_BUFFER,
+ ClientId.getClientId()));
+ // TODO: currently require setting the Server class for each request
+ // with thread context (Server.Call()) that includes retries
+ // and importantly random ClientId. This is currently necessary for
+ // Om Ratis Server to create createWriteRaftClientRequest.
+ // Look to remove Server class requirement for issuing ratis transactions
+ // for OMRequests. Test through successful ratis-enabled OMRequest
+ // handling without dependency on hadoop IPC based Server.
try {
- org.apache.hadoop.ipc.Server.getCurCall().set(new Server.Call(1,
- callCount.incrementAndGet(),
- null,
- null,
- RPC.RpcKind.RPC_PROTOCOL_BUFFER,
- ClientId.getClientId()));
- // TODO: currently require setting the Server class for each request
- // with thread context (Server.Call()) that includes retries
- // and importantly random ClientId. This is currently necessary for
- // Om Ratis Server to create createWriteRaftClientRequest.
- // Look to remove Server class requirement for issuing ratis transactions
- // for OMRequests. Test through successful ratis-enabled OMRequest
- // handling without dependency on hadoop IPC based Server.
- omResponse = this.omTranslator.
- submitRequest(NULL_RPC_CONTROLLER, request);
+ omResponse =
+ UserGroupInformation.getCurrentUser().doAs(
+ (PrivilegedExceptionAction<OMResponse>) () -> {
+ try {
+ return this.omTranslator.
+ submitRequest(NULL_RPC_CONTROLLER, request);
+ } catch (Throwable se) {
+ Throwable e = se.getCause();
+ if (se == null) {
Review comment:
`se` cannot be `null` here. Intended `e == null`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org