You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by su...@apache.org on 2017/01/27 23:38:15 UTC
[18/50] [abbrv] hadoop git commit: HADOOP-14029. Fix
KMSClientProvider for non-secure proxyuser use case. Contributed by Xiaoyu
Yao.
HADOOP-14029. Fix KMSClientProvider for non-secure proxyuser use case. Contributed by Xiaoyu Yao.
Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo
Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/20343157
Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/20343157
Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/20343157
Branch: refs/heads/YARN-2915
Commit: 2034315763cd7b1eb77e96c719918fc14e2dabf6
Parents: 7bc333a
Author: Xiaoyu Yao <xy...@apache.org>
Authored: Thu Jan 26 20:34:32 2017 -0800
Committer: Xiaoyu Yao <xy...@apache.org>
Committed: Thu Jan 26 20:34:32 2017 -0800
----------------------------------------------------------------------
.../apache/hadoop/crypto/key/kms/KMSClientProvider.java | 11 ++++++-----
.../org/apache/hadoop/crypto/key/kms/server/TestKMS.java | 6 +++++-
2 files changed, 11 insertions(+), 6 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hadoop/blob/20343157/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java
index ccc8968..4c6b625 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java
@@ -1096,13 +1096,14 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension,
// Use real user for proxy user
actualUgi = currentUgi.getRealUser();
}
-
- if (!containsKmsDt(actualUgi) &&
+ if (UserGroupInformation.isSecurityEnabled() &&
+ !containsKmsDt(actualUgi) &&
!actualUgi.hasKerberosCredentials()) {
- // Use login user for user that does not have either
+ // Use login user is only necessary when Kerberos is enabled
+ // but the actual user does not have either
// Kerberos credential or KMS delegation token for KMS operations
- LOG.debug("using loginUser no KMS Delegation Token "
- + "no Kerberos Credentials");
+ LOG.debug("Using loginUser when Kerberos is enabled but the actual user" +
+ " does not have either KMS Delegation Token or Kerberos Credentials");
actualUgi = UserGroupInformation.getLoginUser();
}
return actualUgi;
http://git-wip-us.apache.org/repos/asf/hadoop/blob/20343157/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java b/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java
index 3a2d53c..72301db 100644
--- a/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java
+++ b/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java
@@ -2419,7 +2419,11 @@ public class TestKMS {
public void doWebHDFSProxyUserTest(final boolean kerberos) throws Exception {
Configuration conf = new Configuration();
- conf.set("hadoop.security.authentication", "kerberos");
+ if (kerberos) {
+ conf.set("hadoop.security.authentication", "kerberos");
+ }
+ UserGroupInformation.setConfiguration(conf);
+
final File testDir = getTestDir();
conf = createBaseKMSConf(testDir, conf);
if (kerberos) {
---------------------------------------------------------------------
To unsubscribe, e-mail: common-commits-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-commits-help@hadoop.apache.org