You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ambari.apache.org by jl...@apache.org on 2015/01/05 20:35:26 UTC
[2/2] ambari git commit: AMBARI-8879: Common Services: Refactor
HDP-2.2 Kerberos service (Jayush Luniya)
AMBARI-8879: Common Services: Refactor HDP-2.2 Kerberos service (Jayush Luniya)
Project: http://git-wip-us.apache.org/repos/asf/ambari/repo
Commit: http://git-wip-us.apache.org/repos/asf/ambari/commit/0d7976bc
Tree: http://git-wip-us.apache.org/repos/asf/ambari/tree/0d7976bc
Diff: http://git-wip-us.apache.org/repos/asf/ambari/diff/0d7976bc
Branch: refs/heads/trunk
Commit: 0d7976bc3d6f4b2e564b9defd7c5e73fd7de1f97
Parents: b501215
Author: Jayush Luniya <jl...@hortonworks.com>
Authored: Mon Jan 5 11:35:14 2015 -0800
Committer: Jayush Luniya <jl...@hortonworks.com>
Committed: Mon Jan 5 11:35:14 2015 -0800
----------------------------------------------------------------------
.../1.10.3-10/configuration/krb5-conf.xml | 160 ++++++++
.../KERBEROS/1.10.3-10/metainfo.xml | 129 ++++++
.../package/scripts/kerberos_client.py | 40 ++
.../package/scripts/kerberos_common.py | 398 +++++++++++++++++++
.../package/scripts/kerberos_server.py | 144 +++++++
.../1.10.3-10/package/scripts/params.py | 203 ++++++++++
.../1.10.3-10/package/scripts/service_check.py | 65 +++
.../KERBEROS/1.10.3-10/package/scripts/utils.py | 105 +++++
.../1.10.3-10/package/templates/kadm5_acl.j2 | 20 +
.../1.10.3-10/package/templates/kdc_conf.j2 | 30 ++
.../1.10.3-10/package/templates/krb5_conf.j2 | 47 +++
.../KERBEROS/configuration/krb5-conf.xml | 160 --------
.../HDP/2.2/services/KERBEROS/metainfo.xml | 105 +----
.../KERBEROS/package/scripts/kerberos_client.py | 40 --
.../KERBEROS/package/scripts/kerberos_common.py | 398 -------------------
.../KERBEROS/package/scripts/kerberos_server.py | 144 -------
.../services/KERBEROS/package/scripts/params.py | 203 ----------
.../KERBEROS/package/scripts/service_check.py | 65 ---
.../services/KERBEROS/package/scripts/utils.py | 105 -----
.../KERBEROS/package/templates/kadm5_acl.j2 | 20 -
.../KERBEROS/package/templates/kdc_conf.j2 | 30 --
.../KERBEROS/package/templates/krb5_conf.j2 | 47 ---
.../stacks/2.2/KERBEROS/test_kerberos_client.py | 42 +-
.../stacks/2.2/KERBEROS/test_kerberos_server.py | 31 +-
.../src/test/python/stacks/utils/RMFTestCase.py | 4 +
25 files changed, 1399 insertions(+), 1336 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/configuration/krb5-conf.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/configuration/krb5-conf.xml b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/configuration/krb5-conf.xml
new file mode 100644
index 0000000..c10ae73
--- /dev/null
+++ b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/configuration/krb5-conf.xml
@@ -0,0 +1,160 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
+<!--
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+-->
+
+<configuration>
+ <property>
+ <name>logging_default</name>
+ <value>FILE:/var/log/krb5libs.log</value>
+ </property>
+ <property>
+ <name>logging_kdc</name>
+ <value>FILE:/var/log/krb5kdc.log</value>
+ </property>
+ <property>
+ <name>logging_admin_server</name>
+ <value>FILE:/var/log/kadmind.log</value>
+ </property>
+
+ <property>
+ <name>libdefaults_dns_lookup_realm</name>
+ <value>false</value>
+ </property>
+ <property>
+ <name>libdefaults_dns_lookup_kdc</name>
+ <value>false</value>
+ </property>
+ <property>
+ <name>libdefaults_ticket_lifetime</name>
+ <value>24h</value>
+ </property>
+ <property>
+ <name>libdefaults_renew_lifetime</name>
+ <value>7d</value>
+ </property>
+ <property>
+ <name>libdefaults_forwardable</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>libdefaults_default_tgs_enctypes</name>
+ <description>
+ a space-delimited list of session key encryption types supported by the KDC or Active
+ Directory
+ </description>
+ <value>
+ aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 arcfour-hmac-md5
+ camellia256-cts-cmac camellia128-cts-cmac des-cbc-crc des-cbc-md5 des-cbc-md4
+ </value>
+ </property>
+ <property>
+ <name>libdefaults_default_tkt_enctypes</name>
+ <description>
+ a space-delimited list of session key encryption types supported by the KDC or Active
+ Directory
+ </description>
+ <value>
+ aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 arcfour-hmac-md5
+ camellia256-cts-cmac camellia128-cts-cmac des-cbc-crc des-cbc-md5 des-cbc-md4
+ </value>
+ </property>
+
+ <property require-input="true">
+ <name>realm</name>
+ <description>
+ The realm to use when creating service principals
+ </description>
+ <value/>
+ </property>
+ <property require-input="true">
+ <name>domains</name>
+ <description>
+ A comma-delimited list of domain names that the realm serves (optional)
+ </description>
+ <value/>
+ </property>
+ <property require-input="true">
+ <name>kdc_type</name>
+ <description>
+ The type of KDC being used. Either mit-kdc or active-directory
+ </description>
+ <value>mit-kdc</value>
+ </property>
+ <property require-input="true">
+ <name>kdc_host</name>
+ <description>
+ The IP address or FQDN of the KDC or Active Directory server, optionally a port number may be
+ provided
+ </description>
+ <value/>
+ </property>
+ <property>
+ <name>admin_server_host</name>
+ <description>
+ The IP address or FQDN of the administrative Kerberos server, optionally a port number may be
+ provided
+ </description>
+ <value/>
+ </property>
+
+
+ <property>
+ <name>conf_dir</name>
+ <description>The krb5.conf configuration directory</description>
+ <value>/etc</value>
+ </property>
+ <property>
+ <name>content</name>
+ <description>The jinja template for the krb5.conf file</description>
+ <value>
+[libdefaults]
+ renew_lifetime = {{libdefaults_renew_lifetime}}
+ forwardable = {{libdefaults_forwardable}}
+ default_realm = {{realm|upper()}}
+ ticket_lifetime = {{libdefaults_ticket_lifetime}}
+ dns_lookup_realm = {{libdefaults_dns_lookup_realm}}
+ dns_lookup_kdc = {{libdefaults_dns_lookup_kdc}}
+
+{% if domains %}
+[domain_realm]
+{% for domain in domains.split(',') %}
+ {{domain}} = {{realm|upper()}}
+{% endfor %}
+{% endif %}
+
+[logging]
+ default = {{logging_default}}
+{#
+# The following options are unused unless a managed KDC is installed
+ admin_server = {{logging_admin_server}}
+ kdc = {{logging_admin_kdc}}
+#}
+
+[realms]
+ {{realm}} = {
+ admin_server = {{admin_server_host|default(kdc_host, True)}}
+ kdc = {{kdc_host}}
+ }
+
+{# Append additional realm declarations below #}
+ </value>
+ </property>
+</configuration>
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/metainfo.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/metainfo.xml b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/metainfo.xml
new file mode 100644
index 0000000..64f42c1
--- /dev/null
+++ b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/metainfo.xml
@@ -0,0 +1,129 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<metainfo>
+ <schemaVersion>2.0</schemaVersion>
+ <services>
+ <service>
+ <name>KERBEROS</name>
+ <displayName>Kerberos</displayName>
+ <comment>A computer network authentication protocol which works on
+ the basis of 'tickets' to allow nodes communicating over a
+ non-secure network to prove their identity to one another in a
+ secure manner.
+ </comment>
+ <version>1.10.3-10</version>
+
+ <components>
+ <component>
+ <name>KERBEROS_CLIENT</name>
+ <displayName>Kerberos Client</displayName>
+ <category>CLIENT</category>
+ <cardinality>ALL</cardinality>
+ <auto-deploy>
+ <enabled>true</enabled>
+ </auto-deploy>
+ <commandScript>
+ <script>scripts/kerberos_client.py</script>
+ <scriptType>PYTHON</scriptType>
+ <timeout>1200</timeout>
+ </commandScript>
+ <customCommands>
+ <customCommand>
+ <name>SET_KEYTAB</name>
+ <commandScript>
+ <script>scripts/kerberos_client.py</script>
+ <scriptType>PYTHON</scriptType>
+ <timeout>1000</timeout>
+ </commandScript>
+ </customCommand>
+ </customCommands>
+ <configFiles>
+ <configFile>
+ <type>env</type>
+ <fileName>krb5.conf</fileName>
+ <dictionaryName>krb5-conf</dictionaryName>
+ </configFile>
+ </configFiles>
+ </component>
+ </components>
+
+ <osSpecifics>
+ <osSpecific>
+ <osFamily>redhat5,redhat6</osFamily>
+ <packages>
+ <package>
+ <name>krb5-server</name>
+ </package>
+ <package>
+ <name>krb5-libs</name>
+ </package>
+ <package>
+ <name>krb5-workstation</name>
+ </package>
+ </packages>
+ </osSpecific>
+
+ <osSpecific>
+ <osFamily>ubuntu12</osFamily>
+ <packages>
+ <package>
+ <name>krb5-kdc</name>
+ </package>
+ <package>
+ <name>krb5-admin-server</name>
+ </package>
+ <package>
+ <name>krb5-user</name>
+ </package>
+ <package>
+ <name>krb5-config</name>
+ </package>
+ </packages>
+ </osSpecific>
+
+ <osSpecific>
+ <osFamily>suse11</osFamily>
+ <packages>
+ <package>
+ <name>krb5</name>
+ </package>
+ <package>
+ <name>krb5-client</name>
+ </package>
+ <package>
+ <name>krb5-server</name>
+ </package>
+ </packages>
+ </osSpecific>
+ </osSpecifics>
+
+ <commandScript>
+ <script>scripts/service_check.py</script>
+ <scriptType>PYTHON</scriptType>
+ <timeout>300</timeout>
+ </commandScript>
+
+ <configuration-dependencies>
+ <config-type>krb5-conf</config-type>
+ <config-type>kdc-conf</config-type>
+ <config-type>kadm5-acl</config-type>
+ </configuration-dependencies>
+ <restartRequiredAfterChange>true</restartRequiredAfterChange>
+ </service>
+ </services>
+</metainfo>
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/kerberos_client.py
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/kerberos_client.py b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/kerberos_client.py
new file mode 100644
index 0000000..a341e8d
--- /dev/null
+++ b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/kerberos_client.py
@@ -0,0 +1,40 @@
+"""
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+"""
+
+from kerberos_common import *
+
+class KerberosClient(KerberosScript):
+ def install(self, env):
+ self.install_packages(env, ['krb5-server', 'krb5-libs', 'krb5-auth-dialog', 'krb5', 'krb5-kdc', 'krb5-admin-server'])
+ self.configure(env)
+
+
+ def configure(self, env):
+ import params
+ env.set_params(params)
+ self.write_krb5_conf()
+
+ def status(self, env):
+ raise ClientComponentHasNoStatus()
+
+ def set_keytab(self, env):
+ KerberosScript.write_keytab_file()
+
+if __name__ == "__main__":
+ KerberosClient().execute()
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/kerberos_common.py
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/kerberos_common.py b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/kerberos_common.py
new file mode 100644
index 0000000..42e195c
--- /dev/null
+++ b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/kerberos_common.py
@@ -0,0 +1,398 @@
+"""
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+"""
+
+import base64
+import os
+import string
+import subprocess
+import sys
+import tempfile
+
+from resource_management import *
+from utils import get_property_value
+
+class KerberosScript(Script):
+ KRB5_REALM_PROPERTIES = [
+ 'kdc',
+ 'admin_server',
+ 'default_domain',
+ 'master_kdc'
+ ]
+
+ KRB5_SECTION_NAMES = [
+ 'libdefaults',
+ 'logging',
+ 'realms',
+ 'domain_realm',
+ 'capaths',
+ 'ca_paths',
+ 'appdefaults',
+ 'plugins'
+ ]
+
+ @staticmethod
+ def create_random_password():
+ import random
+
+ chars = string.digits + string.ascii_letters
+ return ''.join(random.choice(chars) for x in range(13))
+
+ @staticmethod
+ def write_conf_section(output_file, section_name, section_data):
+ if section_name is not None:
+ output_file.write('[%s]\n' % section_name)
+
+ if section_data is not None:
+ for key, value in section_data.iteritems():
+ output_file.write(" %s = %s\n" % (key, value))
+
+
+ @staticmethod
+ def _write_conf_realm(output_file, realm_name, realm_data):
+ """ Writes out realm details
+
+ Example:
+
+ EXAMPLE.COM = {
+ kdc = kerberos.example.com
+ admin_server = kerberos.example.com
+ }
+
+ """
+ if realm_name is not None:
+ output_file.write(" %s = {\n" % realm_name)
+
+ if realm_data is not None:
+ for key, value in realm_data.iteritems():
+ if key in KerberosScript.KRB5_REALM_PROPERTIES:
+ output_file.write(" %s = %s\n" % (key, value))
+
+ output_file.write(" }\n")
+
+ @staticmethod
+ def write_conf_realms_section(output_file, section_name, realms_data):
+ if section_name is not None:
+ output_file.write('[%s]\n' % section_name)
+
+ if realms_data is not None:
+ for realm, realm_data in realms_data.iteritems():
+ KerberosScript._write_conf_realm(output_file, realm, realm_data)
+ output_file.write('\n')
+
+ @staticmethod
+ def write_krb5_conf():
+ import params
+
+ Directory(params.krb5_conf_dir,
+ owner='root',
+ recursive=True,
+ group='root',
+ mode=0755
+ )
+
+ if (params.krb5_conf_template is None) or not params.krb5_conf_template.strip():
+ content = Template('krb5_conf.j2')
+ else:
+ content = InlineTemplate(params.krb5_conf_template)
+
+ File(params.krb5_conf_path,
+ content=content,
+ owner='root',
+ group='root',
+ mode=0644
+ )
+
+ @staticmethod
+ def invoke_kadmin(query, admin_identity=None, default_realm=None):
+ """
+ Executes the kadmin or kadmin.local command (depending on whether auth_identity is set or not
+ and returns command result code and standard out data.
+
+ :param query: the kadmin query to execute
+ :param admin_identity: the identity for the administrative user (optional)
+ :param default_realm: the default realm to assume
+ :return: return_code, out
+ """
+ if (query is not None) and (len(query) > 0):
+ auth_principal = None
+ auth_keytab_file = None
+
+ if admin_identity is not None:
+ auth_principal = get_property_value(admin_identity, 'principal')
+
+ if auth_principal is None:
+ kadmin = 'kadmin.local'
+ credential = ''
+ else:
+ kadmin = 'kadmin -p "%s"' % auth_principal
+
+ auth_password = get_property_value(admin_identity, 'password')
+
+ if auth_password is None:
+ auth_keytab = get_property_value(admin_identity, 'keytab')
+
+ if auth_keytab is not None:
+ (fd, auth_keytab_file) = tempfile.mkstemp()
+ os.write(fd, base64.b64decode(auth_keytab))
+ os.close(fd)
+
+ credential = '-k -t %s' % auth_keytab_file
+ else:
+ credential = '-w "%s"' % auth_password
+
+ if (default_realm is not None) and (len(default_realm) > 0):
+ realm = '-r %s' % default_realm
+ else:
+ realm = ''
+
+ try:
+ command = '%s %s %s -q "%s"' % (kadmin, credential, realm, query.replace('"', '\\"'))
+ return shell.checked_call(command)
+ except:
+ raise
+ finally:
+ if auth_keytab_file is not None:
+ os.remove(auth_keytab_file)
+
+ @staticmethod
+ def create_keytab_file(principal, path, auth_identity=None):
+ success = False
+
+ if (principal is not None) and (len(principal) > 0):
+ if (auth_identity is None) or (len(auth_identity) == 0):
+ norandkey = '-norandkey'
+ else:
+ norandkey = ''
+
+ if (path is not None) and (len(path) > 0):
+ keytab_file = '-k %s' % path
+ else:
+ keytab_file = ''
+
+ try:
+ result_code, output = KerberosScript.invoke_kadmin(
+ 'ktadd %s %s %s' % (keytab_file, norandkey, principal),
+ auth_identity)
+
+ success = (result_code == 0)
+ except:
+ raise Fail("Failed to create keytab for principal: %s (in %s)" % (principal, path))
+
+ return success
+
+ @staticmethod
+ def create_keytab(principal, auth_identity=None):
+ keytab = None
+
+ (fd, temp_path) = tempfile.mkstemp()
+ os.remove(temp_path)
+
+ try:
+ if KerberosScript.create_keytab_file(principal, temp_path, auth_identity):
+ with open(temp_path, 'r') as f:
+ keytab = base64.b64encode(f.read())
+ finally:
+ if os.path.isfile(temp_path):
+ os.remove(temp_path)
+
+ return keytab
+
+ @staticmethod
+ def principal_exists(identity, auth_identity=None):
+ exists = False
+
+ if identity is not None:
+ principal = get_property_value(identity, 'principal')
+
+ if (principal is not None) and (len(principal) > 0):
+ try:
+ result_code, output = KerberosScript.invoke_kadmin('getprinc %s' % principal,
+ auth_identity)
+ exists = (output is not None) and (("Principal: %s" % principal) in output)
+ except:
+ raise Fail("Failed to determine if principal exists: %s" % principal)
+
+ return exists
+
+ @staticmethod
+ def change_principal_password(identity, auth_identity=None):
+ success = False
+
+ if identity is not None:
+ principal = get_property_value(identity, 'principal')
+
+ if (principal is not None) and (len(principal) > 0):
+ password = get_property_value(identity, 'password')
+
+ if password is None:
+ credentials = '-randkey'
+ else:
+ credentials = '-pw "%s"' % password
+
+ try:
+ result_code, output = KerberosScript.invoke_kadmin(
+ 'change_password %s %s' % (credentials, principal),
+ auth_identity)
+
+ success = (result_code == 0)
+ except:
+ raise Fail("Failed to create principal: %s" % principal)
+
+ return success
+
+ @staticmethod
+ def create_principal(identity, auth_identity=None):
+ success = False
+
+ if identity is not None:
+ principal = get_property_value(identity, 'principal')
+
+ if (principal is not None) and (len(principal) > 0):
+ password = get_property_value(identity, 'password')
+
+ if password is None:
+ credentials = '-randkey'
+ else:
+ credentials = '-pw "%s"' % password
+
+ try:
+ result_code, out = KerberosScript.invoke_kadmin(
+ 'addprinc %s %s' % (credentials, principal),
+ auth_identity)
+
+ success = (result_code == 0)
+ except:
+ raise Fail("Failed to create principal: %s" % principal)
+
+ return success
+
+ @staticmethod
+ def create_principals(identities, auth_identity=None):
+ if identities is not None:
+ for identity in identities:
+ KerberosScript.create_principal(identity, auth_identity)
+
+ @staticmethod
+ def create_or_update_administrator_identity():
+ import params
+
+ if params.realm is not None:
+ admin_identity = params.get_property_value(params.realm, 'admin_identity')
+
+ if KerberosScript.principal_exists(admin_identity):
+ KerberosScript.change_principal_password(admin_identity)
+ else:
+ KerberosScript.create_principal(admin_identity)
+
+ @staticmethod
+ def test_kinit(identity):
+ principal = get_property_value(identity, 'principal')
+
+ if principal is not None:
+ keytab_file = get_property_value(identity, 'keytab_file')
+ keytab = get_property_value(identity, 'keytab')
+ password = get_property_value(identity, 'password')
+
+ # If a test keytab file is available, simply use it
+ if (keytab_file is not None) and (os.path.isfile(keytab_file)):
+ command = 'kinit -k -t %s %s' % (keytab_file, principal)
+ Execute(command)
+ return shell.checked_call('kdestroy')
+
+ # If base64-encoded test keytab data is available; then decode it, write it to a temporary file
+ # use it, and then remove the temporary file
+ elif keytab is not None:
+ (fd, test_keytab_file) = tempfile.mkstemp()
+ os.write(fd, base64.b64decode(keytab))
+ os.close(fd)
+
+ try:
+ command = 'kinit -k -t %s %s' % (test_keytab_file, principal)
+ Execute(command)
+ return shell.checked_call('kdestroy')
+ except:
+ raise
+ finally:
+ if test_keytab_file is not None:
+ os.remove(test_keytab_file)
+
+ # If no keytab data is available and a password was supplied, simply use it.
+ elif password is not None:
+ process = subprocess.Popen(['kinit', principal], stdin=subprocess.PIPE)
+ stdout, stderr = process.communicate(password)
+ if process.returncode:
+ err_msg = Logger.filter_text("Execution of kinit returned %d. %s" % (process.returncode, stderr))
+ raise Fail(err_msg)
+ else:
+ return shell.checked_call('kdestroy')
+ else:
+ return 0, ''
+ else:
+ return 0, ''
+
+
+ @staticmethod
+ def write_keytab_file():
+ import params
+
+ if params.kerberos_command_params is not None:
+ for item in params.kerberos_command_params:
+ keytab_content_base64 = get_property_value(item, 'keytab_content_base64')
+ if (keytab_content_base64 is not None) and (len(keytab_content_base64) > 0):
+ keytab_file_path = get_property_value(item, 'keytab_file_path')
+ if (keytab_file_path is not None) and (len(keytab_file_path) > 0):
+ head, tail = os.path.split(keytab_file_path)
+ if head and not os.path.isdir(head):
+ os.makedirs(head)
+ with open(keytab_file_path, 'w') as f:
+ f.write(base64.b64decode(keytab_content_base64))
+ owner = get_property_value(item, 'keytab_file_owner')
+ owner_access = get_property_value(item, 'keytab_file_owner_access')
+ group = get_property_value(item, 'keytab_file_group')
+ group_access = get_property_value(item, 'keytab_file_group_access')
+ KerberosScript._set_file_access(keytab_file_path, owner, owner_access, group, group_access)
+
+
+ @staticmethod
+ def _set_file_access(file_path, owner, owner_access='rw', group=None, group_access=''):
+ if (file_path is not None) and os.path.isfile(file_path) and (owner is not None):
+ import stat
+ import pwd
+ import grp
+
+ pwnam = pwd.getpwnam(owner) if (owner is not None) and (len(owner) > 0) else None
+ uid = pwnam.pw_uid if pwnam is not None else os.geteuid()
+
+ grnam = grp.getgrnam(group) if (group is not None) and (len(group) > 0) else None
+ gid = grnam.gr_gid if grnam is not None else os.getegid()
+
+ chmod = 0
+
+ if owner_access == 'r':
+ chmod |= stat.S_IREAD
+ else:
+ chmod |= stat.S_IREAD | stat.S_IWRITE
+
+ if group_access == 'rw':
+ chmod |= stat.S_IRGRP | stat.S_IWGRP
+ elif group_access == 'r':
+ chmod |= stat.S_IRGRP
+
+ os.chmod(file_path, chmod)
+ os.chown(file_path, uid, gid)
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/kerberos_server.py
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/kerberos_server.py b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/kerberos_server.py
new file mode 100644
index 0000000..3e15f50
--- /dev/null
+++ b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/kerberos_server.py
@@ -0,0 +1,144 @@
+"""
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+"""
+
+from kerberos_common import *
+
+class KerberosServer(KerberosScript):
+ @staticmethod
+ def write_kadm5_acl():
+ import params
+
+ Directory(params.kadm5_acl_dir,
+ owner='root',
+ recursive=True,
+ group='root',
+ mode=0700
+ )
+
+ if (params.kadm5_acl_template is None) or not params.kadm5_acl_template.strip():
+ content = Template('kadm5_acl.j2')
+ else:
+ content = InlineTemplate(params.kadm5_acl_template)
+
+ File(params.kadm5_acl_path,
+ content=content,
+ owner='root',
+ group='root',
+ mode=0600
+ )
+
+ @staticmethod
+ def write_kdc_conf():
+ import params
+
+ Directory(params.kdc_conf_dir,
+ owner='root',
+ recursive=True,
+ group='root',
+ mode=0700
+ )
+
+ if (params.kdc_conf_template is None) or not params.kdc_conf_template.strip():
+ content = Template('kdc_conf.j2')
+ else:
+ content = InlineTemplate(params.kdc_conf_template)
+
+ File(params.kdc_conf_path,
+ content=content,
+ owner='root',
+ group='root',
+ mode=0600
+ )
+
+ def install(self, env):
+ import params
+
+ self.install_packages(env)
+ self.configure(env)
+
+ # Create the Kerberos database (only on install, for now)
+ Execute(
+ "%s create -s -P '%s'" % (params.kdb5_util_path, KerberosScript.create_random_password()))
+
+ # Create or update the administrator account
+ KerberosScript.create_or_update_administrator_identity()
+
+
+ def start(self, env):
+ os_family = System.get_instance().os_family
+
+ # Attempt to reconfigure the service before starting
+ self.configure(env)
+
+ # Create or update the administrator account
+ KerberosScript.create_or_update_administrator_identity()
+
+ if os_family == "suse":
+ Execute('rckadmind start')
+ Execute('rckrb5kdc start')
+ elif os_family == 'ubuntu':
+ Execute('service krb5-kdc start')
+ Execute('service krb5-admin-server start')
+ else:
+ Execute('service krb5kdc start')
+ Execute('service kadmin start')
+
+ def stop(self, env):
+ os_family = System.get_instance().os_family
+
+ if os_family == "suse":
+ Execute('rckadmind stop')
+ Execute('rckrb5kdc stop')
+ elif os_family == 'ubuntu':
+ Execute('service krb5-kdc stop')
+ Execute('service krb5-admin-server stop')
+ else:
+ Execute('service krb5kdc stop')
+ Execute('service kadmin stop')
+
+
+ def configure(self, env):
+ import params
+ env.set_params(params)
+
+ KerberosServer.write_krb5_conf()
+ KerberosServer.write_kdc_conf()
+ KerberosServer.write_kadm5_acl()
+
+ def status(self, env):
+ import params
+
+ if params.os_family == "suse":
+ try:
+ Execute('checkproc `which krb5kdc`')
+ Execute('checkproc `which kadmind`')
+ except Fail as ex:
+ raise ComponentIsNotRunning()
+
+ elif params.os_family == 'ubuntu':
+ check_process_status(params.kdamin_pid_path)
+ check_process_status(params.krb5kdc_pid_path)
+
+ else:
+ check_process_status(params.kdamin_pid_path)
+ check_process_status(params.krb5kdc_pid_path)
+
+
+if __name__ == "__main__":
+ KerberosServer().execute()
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/params.py
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/params.py b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/params.py
new file mode 100644
index 0000000..58549bc
--- /dev/null
+++ b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/params.py
@@ -0,0 +1,203 @@
+"""
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+"""
+
+from resource_management import *
+from utils import get_property_value, get_unstructured_data
+
+os_family = System.get_instance().os_family
+
+krb5_conf_dir = '/etc'
+krb5_conf_file = 'krb5.conf'
+krb5_conf_path = krb5_conf_dir + '/' + krb5_conf_file
+
+if os_family == 'suse':
+ kdc_conf_dir = '/var/lib/kerberos/krb5kdc'
+elif os_family == 'ubuntu':
+ kdc_conf_dir = '/etc/krb5kdc'
+else:
+ kdc_conf_dir = '/var/kerberos/krb5kdc'
+kdc_conf_file = 'kdc.conf'
+kdc_conf_path = kdc_conf_dir + '/' + kdc_conf_file
+
+kadm5_acl_dir = kdc_conf_dir # Typically kadm5.acl and kdc.conf exist in the same directory
+kadm5_acl_file = 'kadm5.acl'
+kadm5_acl_path = kadm5_acl_dir + '/' + kadm5_acl_file
+
+config = Script.get_config()
+
+command_params = None
+configurations = None
+keytab_details = None
+default_group = None
+cluster_env = None
+kdc_server_host = None
+cluster_host_info = None
+
+kdb5_util_path = 'kdb5_util'
+
+kdamin_pid_path = '/var/run/kadmind.pid'
+krb5kdc_pid_path = '/var/run/krb5kdc.pid'
+
+smoke_test_principal = None
+smoke_test_keytab_file = None
+
+# If a test keytab file is available, simply use it
+
+
+if config is not None:
+ command_params = get_property_value(config, 'commandParams')
+ if command_params is not None:
+ keytab_details = get_unstructured_data(command_params, 'keytab')
+
+ kerberos_command_params = get_property_value(config, 'kerberosCommandParams')
+
+ configurations = get_property_value(config, 'configurations')
+ if configurations is not None:
+ cluster_env = get_property_value(configurations, 'cluster-env')
+
+ if cluster_env is not None:
+ smoke_test_principal = get_property_value(cluster_env, 'smokeuser', None, True, None)
+ smoke_test_keytab_file = get_property_value(cluster_env, 'smokeuser_keytab', None, True, None)
+
+ default_group = get_property_value(cluster_env, 'user_group')
+
+ if default_group is None:
+ default_group = get_property_value(cluster_env, 'user-group')
+
+ cluster_host_info = get_property_value(config, 'clusterHostInfo')
+ if cluster_host_info is not None:
+ kdc_server_hosts = get_property_value(cluster_host_info, 'kdc_server_hosts')
+
+ if (kdc_server_hosts is not None) and (len(kdc_server_hosts) > 0):
+ kdc_server_host = kdc_server_hosts[0]
+
+ # ################################################################################################
+ # Get krb5.conf template data
+ # ################################################################################################
+ logging_default = 'FILE:/var/log/krb5libs.log'
+ logging_kdc = 'FILE:/var/log/krb5kdc.log'
+ logging_admin_server = 'FILE:/var/log/kadmind.log'
+ libdefaults_dns_lookup_realm = 'false'
+ libdefaults_dns_lookup_kdc = 'false'
+ libdefaults_ticket_lifetime = '24h'
+ libdefaults_renew_lifetime = '7d'
+ libdefaults_forwardable = 'true'
+ libdefaults_default_tgs_enctypes = 'aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 ' \
+ 'arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac ' \
+ 'des-cbc-crc des-cbc-md5 des-cbc-md4'
+ libdefaults_default_tkt_enctypes = 'aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 ' \
+ 'arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac ' \
+ 'des-cbc-crc des-cbc-md5 des-cbc-md4'
+ realm = 'EXAMPLE.COM'
+ domains = ''
+ kdc_host = 'localhost'
+ admin_server_host = None
+ admin_principal = None
+ admin_password = None
+ admin_keytab = None
+ test_principal = None
+ test_password = None
+ test_keytab = None
+ test_keytab_file = None
+
+ krb5_conf_template = None
+
+ krb5_conf_data = get_property_value(configurations, 'krb5-conf')
+
+ if krb5_conf_data is not None:
+ logging_default = get_property_value(krb5_conf_data, 'logging_default', logging_default)
+ logging_kdc = get_property_value(krb5_conf_data, 'logging_kdc', logging_kdc)
+ logging_admin_server = get_property_value(krb5_conf_data, 'logging_admin_server',
+ logging_admin_server)
+ libdefaults_dns_lookup_realm = get_property_value(krb5_conf_data,
+ 'libdefaults_dns_lookup_realm',
+ libdefaults_dns_lookup_realm)
+ libdefaults_dns_lookup_kdc = get_property_value(krb5_conf_data, 'libdefaults_dns_lookup_kdc',
+ libdefaults_dns_lookup_kdc)
+ libdefaults_ticket_lifetime = get_property_value(krb5_conf_data, 'libdefaults_ticket_lifetime',
+ libdefaults_ticket_lifetime)
+ libdefaults_renew_lifetime = get_property_value(krb5_conf_data, 'libdefaults_renew_lifetime',
+ libdefaults_renew_lifetime)
+ libdefaults_forwardable = get_property_value(krb5_conf_data, 'libdefaults_forwardable',
+ libdefaults_forwardable)
+ libdefaults_default_tgs_enctypes = get_property_value(krb5_conf_data,
+ 'libdefaults_default_tgs_enctypes',
+ libdefaults_default_tgs_enctypes)
+ libdefaults_default_tkt_enctypes = get_property_value(krb5_conf_data,
+ 'libdefaults_default_tkt_enctypes',
+ libdefaults_default_tkt_enctypes)
+ realm = get_property_value(krb5_conf_data, 'realm', realm)
+ domains = get_property_value(krb5_conf_data, 'domains', domains)
+ kdc_host = get_property_value(krb5_conf_data, 'kdc_host', kdc_host)
+ admin_server_host = get_property_value(krb5_conf_data, 'admin_server_host', admin_server_host)
+
+ admin_principal = get_property_value(krb5_conf_data, 'admin_principal', admin_principal, True,
+ None)
+ admin_password = get_property_value(krb5_conf_data, 'admin_password', admin_password, True,
+ None)
+ admin_keytab = get_property_value(krb5_conf_data, 'admin_keytab', admin_keytab, True, None)
+
+ test_principal = get_property_value(krb5_conf_data, 'test_principal', test_principal, True,
+ None)
+ test_password = get_property_value(krb5_conf_data, 'test_password', test_password, True, None)
+ test_keytab = get_property_value(krb5_conf_data, 'test_keytab', test_keytab, True, None)
+ test_keytab_file = get_property_value(krb5_conf_data, 'test_keytab_file', test_keytab_file,
+ True, None)
+
+ krb5_conf_template = get_property_value(krb5_conf_data, 'content', krb5_conf_template)
+ krb5_conf_dir = get_property_value(krb5_conf_data, 'conf_dir', krb5_conf_dir)
+ krb5_conf_file = get_property_value(krb5_conf_data, 'conf_file', krb5_conf_file)
+ krb5_conf_path = krb5_conf_dir + '/' + krb5_conf_file
+
+ # ################################################################################################
+ # Get kdc.conf template data
+ # ################################################################################################
+ kdcdefaults_kdc_ports = "88"
+ kdcdefaults_kdc_tcp_ports = "88"
+
+ kdc_conf_template = None
+
+ kdc_conf_data = get_property_value(configurations, 'kdc-conf')
+
+ if kdc_conf_data is not None:
+ kdcdefaults_kdc_ports = get_property_value(kdc_conf_data, 'kdcdefaults_kdc_ports',
+ kdcdefaults_kdc_ports)
+ kdcdefaults_kdc_tcp_ports = get_property_value(kdc_conf_data, 'kdcdefaults_kdc_tcp_ports',
+ kdcdefaults_kdc_tcp_ports)
+
+ kdc_conf_template = get_property_value(kdc_conf_data, 'content', kdc_conf_template)
+ kdc_conf_dir = get_property_value(kdc_conf_data, 'conf_dir', kdc_conf_dir)
+ kdc_conf_file = get_property_value(kdc_conf_data, 'conf_file', kdc_conf_file)
+ kdc_conf_path = kdc_conf_dir + '/' + kdc_conf_file
+
+ # ################################################################################################
+ # Get kadm5.acl template data
+ # ################################################################################################
+ kdcdefaults_kdc_ports = '88'
+ kdcdefaults_kdc_tcp_ports = '88'
+
+ kadm5_acl_template = None
+
+ kadm5_acl_data = get_property_value(configurations, 'kadm5-acl')
+
+ if kadm5_acl_data is not None:
+ kadm5_acl_template = get_property_value(kadm5_acl_data, 'content', kadm5_acl_template)
+ kadm5_acl_dir = get_property_value(kadm5_acl_data, 'conf_dir', kadm5_acl_dir)
+ kadm5_acl_file = get_property_value(kadm5_acl_data, 'conf_file', kadm5_acl_file)
+ kadm5_acl_path = kadm5_acl_dir + '/' + kadm5_acl_file
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/service_check.py
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/service_check.py b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/service_check.py
new file mode 100644
index 0000000..13d4975
--- /dev/null
+++ b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/service_check.py
@@ -0,0 +1,65 @@
+"""
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+Ambari Agent
+
+"""
+
+from kerberos_common import *
+from resource_management import *
+
+class KerberosServiceCheck(KerberosScript):
+ def service_check(self, env):
+ import params
+
+ # First attempt to test using the smoke test user, if data is available
+ if ((params.smoke_test_principal is not None) and
+ (params.smoke_test_keytab_file is not None) and
+ os.path.isfile(params.smoke_test_keytab_file)):
+ print "Performing kinit using smoke test user: %s" % params.smoke_test_principal
+ code, out = self.test_kinit({
+ 'principal': params.smoke_test_principal,
+ 'keytab_file': params.smoke_test_keytab_file
+ })
+ test_performed = True
+
+ # Else if a test credentials is specified, try to test using that
+ elif params.test_principal is not None:
+ print "Performing kinit using test user: %s" % params.test_principal
+ code, out = self.test_kinit({
+ 'principal': params.test_principal,
+ 'keytab_file': params.test_keytab_file,
+ 'keytab': params.test_keytab,
+ 'password': params.test_password
+ })
+ test_performed = True
+
+ else:
+ code = 0
+ out = ''
+ test_performed = False
+
+ if test_performed:
+ if code == 0:
+ print "Test executed successfully."
+ else:
+ print "Test failed with error code %d: %s." % (code, out)
+ else:
+ print "Test not performed - no test principal was available"
+
+if __name__ == "__main__":
+ KerberosServiceCheck().execute()
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/utils.py
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/utils.py b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/utils.py
new file mode 100644
index 0000000..199e6d7
--- /dev/null
+++ b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/scripts/utils.py
@@ -0,0 +1,105 @@
+"""
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+"""
+
+def get_property_value(dictionary, property_name, default_value=None, trim_string=False,
+ empty_value=""):
+ """
+ Get a property value from a dictionary, applying applying rules as necessary.
+
+ If dictionary does not contain a value for property_name or the value for property_name is None,
+ null_value is used as the value to return. Then, if trim_string is True and the value is None
+ or the value is an empty string, empty_value will be return else the (current) value is returned.
+
+ Note: the property value will most likely be a string or a unicode string, however in the event
+ it is not (for example a number), this method will behave properly and return the value as is.
+
+ :param dictionary: a dictionary of values
+ :param property_name: the name of a dictionary item to retrieve
+ :param default_value: the value to use if the item is not in the dictionary or the value of the item is None
+ :param trim_string: a Boolean value indicating whether to strip whitespace from the value (True) or not (False)
+ :param empty_value: the value to use if the (current) value is None or an empty string, if trim_string is True
+ :return: the requested property value with rules applied
+ """
+ # If property_name is not in the dictionary, set value to null_value
+ if property_name in dictionary:
+ value = dictionary[property_name]
+ if value is None:
+ value = default_value
+ else:
+ value = default_value
+
+ if trim_string:
+ # If the value is none, consider it empty...
+ if value is None:
+ value = empty_value
+ elif (type(value) == str) or (type(value) == unicode):
+ value = value.strip()
+
+ if len(value) == 0:
+ value = empty_value
+
+ return value
+
+def get_unstructured_data(dictionary, property_name):
+ prefix = property_name + '/'
+ prefix_len = len(prefix)
+ return dict((k[prefix_len:], v) for k, v in dictionary.iteritems() if k.startswith(prefix))
+
+def split_host_and_port(host):
+ """
+ Splits a string into its host and port components
+
+ :param host: a string matching the following pattern: <host name | ip address>[:port]
+ :return: a Dictionary containing 'host' and 'port' entries for the input value
+ """
+
+ if host is None:
+ host_and_port = None
+ else:
+ host_and_port = {}
+ parts = host.split(":")
+
+ if parts is not None:
+ length = len(parts)
+
+ if length > 0:
+ host_and_port['host'] = parts[0]
+
+ if length > 1:
+ host_and_port['port'] = int(parts[1])
+
+ return host_and_port
+
+def set_port(host, port):
+ """
+ Sets the port for a host specification, potentially replacing an existing port declaration
+
+ :param host: a string matching the following pattern: <host name | ip address>[:port]
+ :param port: a string or integer declaring the (new) port
+ :return: a string declaring the new host/port specification
+ """
+ if port is None:
+ return host
+ else:
+ host_and_port = split_host_and_port(host)
+
+ if (host_and_port is not None) and ('host' in host_and_port):
+ return "%s:%s" % (host_and_port['host'], port)
+ else:
+ return host
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/templates/kadm5_acl.j2
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/templates/kadm5_acl.j2 b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/templates/kadm5_acl.j2
new file mode 100644
index 0000000..d82ae23
--- /dev/null
+++ b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/templates/kadm5_acl.j2
@@ -0,0 +1,20 @@
+{#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#}
+*/admin@{{realm}} *
+
+{# Append additional realm declarations should be placed below #}
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/templates/kdc_conf.j2
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/templates/kdc_conf.j2 b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/templates/kdc_conf.j2
new file mode 100644
index 0000000..c067bae
--- /dev/null
+++ b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/templates/kdc_conf.j2
@@ -0,0 +1,30 @@
+{#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#}
+[kdcdefaults]
+ kdc_ports = {{kdcdefaults_kdc_ports}}
+ kdc_tcp_ports = {{kdcdefaults_kdc_tcp_ports}}
+
+[realms]
+ {{realm}} = {
+ acl_file = {{kadm5_acl_path}}
+ dict_file = /usr/share/dict/words
+ admin_keytab = {{kadm5_acl_dir}}/kadm5.keytab
+ supported_enctypes = {{libdefaults_default_tgs_enctypes}}
+ }
+
+{# Append additional realm declarations should be placed below #}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/templates/krb5_conf.j2
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/templates/krb5_conf.j2 b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/templates/krb5_conf.j2
new file mode 100644
index 0000000..db1015a
--- /dev/null
+++ b/ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/package/templates/krb5_conf.j2
@@ -0,0 +1,47 @@
+{#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#}
+[libdefaults]
+ renew_lifetime = {{libdefaults_renew_lifetime}}
+ forwardable = {{libdefaults_forwardable}}
+ default_realm = {{realm|upper()}}
+ ticket_lifetime = {{libdefaults_ticket_lifetime}}
+ dns_lookup_realm = {{libdefaults_dns_lookup_realm}}
+ dns_lookup_kdc = {{libdefaults_dns_lookup_kdc}}
+
+{% if domains %}
+[domain_realm]
+{% for domain in domains.split(',') %}
+ {{domain}} = {{realm|upper()}}
+{% endfor %}
+{% endif %}
+
+[logging]
+ default = {{logging_default}}
+{#
+# The following options are unused unless a managed KDC is installed
+ admin_server = {{logging_admin_server}}
+ kdc = {{logging_admin_kdc}}
+#}
+
+[realms]
+ {{realm}} = {
+ admin_server = {{admin_server_host|default(kdc_host, True)}}
+ kdc = {{kdc_host}}
+ }
+
+{# Append additional realm declarations below #}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/configuration/krb5-conf.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/configuration/krb5-conf.xml b/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/configuration/krb5-conf.xml
deleted file mode 100644
index c10ae73..0000000
--- a/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/configuration/krb5-conf.xml
+++ /dev/null
@@ -1,160 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
-<!--
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
--->
-
-<configuration>
- <property>
- <name>logging_default</name>
- <value>FILE:/var/log/krb5libs.log</value>
- </property>
- <property>
- <name>logging_kdc</name>
- <value>FILE:/var/log/krb5kdc.log</value>
- </property>
- <property>
- <name>logging_admin_server</name>
- <value>FILE:/var/log/kadmind.log</value>
- </property>
-
- <property>
- <name>libdefaults_dns_lookup_realm</name>
- <value>false</value>
- </property>
- <property>
- <name>libdefaults_dns_lookup_kdc</name>
- <value>false</value>
- </property>
- <property>
- <name>libdefaults_ticket_lifetime</name>
- <value>24h</value>
- </property>
- <property>
- <name>libdefaults_renew_lifetime</name>
- <value>7d</value>
- </property>
- <property>
- <name>libdefaults_forwardable</name>
- <value>true</value>
- </property>
- <property>
- <name>libdefaults_default_tgs_enctypes</name>
- <description>
- a space-delimited list of session key encryption types supported by the KDC or Active
- Directory
- </description>
- <value>
- aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 arcfour-hmac-md5
- camellia256-cts-cmac camellia128-cts-cmac des-cbc-crc des-cbc-md5 des-cbc-md4
- </value>
- </property>
- <property>
- <name>libdefaults_default_tkt_enctypes</name>
- <description>
- a space-delimited list of session key encryption types supported by the KDC or Active
- Directory
- </description>
- <value>
- aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 arcfour-hmac-md5
- camellia256-cts-cmac camellia128-cts-cmac des-cbc-crc des-cbc-md5 des-cbc-md4
- </value>
- </property>
-
- <property require-input="true">
- <name>realm</name>
- <description>
- The realm to use when creating service principals
- </description>
- <value/>
- </property>
- <property require-input="true">
- <name>domains</name>
- <description>
- A comma-delimited list of domain names that the realm serves (optional)
- </description>
- <value/>
- </property>
- <property require-input="true">
- <name>kdc_type</name>
- <description>
- The type of KDC being used. Either mit-kdc or active-directory
- </description>
- <value>mit-kdc</value>
- </property>
- <property require-input="true">
- <name>kdc_host</name>
- <description>
- The IP address or FQDN of the KDC or Active Directory server, optionally a port number may be
- provided
- </description>
- <value/>
- </property>
- <property>
- <name>admin_server_host</name>
- <description>
- The IP address or FQDN of the administrative Kerberos server, optionally a port number may be
- provided
- </description>
- <value/>
- </property>
-
-
- <property>
- <name>conf_dir</name>
- <description>The krb5.conf configuration directory</description>
- <value>/etc</value>
- </property>
- <property>
- <name>content</name>
- <description>The jinja template for the krb5.conf file</description>
- <value>
-[libdefaults]
- renew_lifetime = {{libdefaults_renew_lifetime}}
- forwardable = {{libdefaults_forwardable}}
- default_realm = {{realm|upper()}}
- ticket_lifetime = {{libdefaults_ticket_lifetime}}
- dns_lookup_realm = {{libdefaults_dns_lookup_realm}}
- dns_lookup_kdc = {{libdefaults_dns_lookup_kdc}}
-
-{% if domains %}
-[domain_realm]
-{% for domain in domains.split(',') %}
- {{domain}} = {{realm|upper()}}
-{% endfor %}
-{% endif %}
-
-[logging]
- default = {{logging_default}}
-{#
-# The following options are unused unless a managed KDC is installed
- admin_server = {{logging_admin_server}}
- kdc = {{logging_admin_kdc}}
-#}
-
-[realms]
- {{realm}} = {
- admin_server = {{admin_server_host|default(kdc_host, True)}}
- kdc = {{kdc_host}}
- }
-
-{# Append additional realm declarations below #}
- </value>
- </property>
-</configuration>
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/metainfo.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/metainfo.xml b/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/metainfo.xml
index 64f42c1..25cfcc6 100644
--- a/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/metainfo.xml
+++ b/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/metainfo.xml
@@ -20,110 +20,7 @@
<services>
<service>
<name>KERBEROS</name>
- <displayName>Kerberos</displayName>
- <comment>A computer network authentication protocol which works on
- the basis of 'tickets' to allow nodes communicating over a
- non-secure network to prove their identity to one another in a
- secure manner.
- </comment>
- <version>1.10.3-10</version>
-
- <components>
- <component>
- <name>KERBEROS_CLIENT</name>
- <displayName>Kerberos Client</displayName>
- <category>CLIENT</category>
- <cardinality>ALL</cardinality>
- <auto-deploy>
- <enabled>true</enabled>
- </auto-deploy>
- <commandScript>
- <script>scripts/kerberos_client.py</script>
- <scriptType>PYTHON</scriptType>
- <timeout>1200</timeout>
- </commandScript>
- <customCommands>
- <customCommand>
- <name>SET_KEYTAB</name>
- <commandScript>
- <script>scripts/kerberos_client.py</script>
- <scriptType>PYTHON</scriptType>
- <timeout>1000</timeout>
- </commandScript>
- </customCommand>
- </customCommands>
- <configFiles>
- <configFile>
- <type>env</type>
- <fileName>krb5.conf</fileName>
- <dictionaryName>krb5-conf</dictionaryName>
- </configFile>
- </configFiles>
- </component>
- </components>
-
- <osSpecifics>
- <osSpecific>
- <osFamily>redhat5,redhat6</osFamily>
- <packages>
- <package>
- <name>krb5-server</name>
- </package>
- <package>
- <name>krb5-libs</name>
- </package>
- <package>
- <name>krb5-workstation</name>
- </package>
- </packages>
- </osSpecific>
-
- <osSpecific>
- <osFamily>ubuntu12</osFamily>
- <packages>
- <package>
- <name>krb5-kdc</name>
- </package>
- <package>
- <name>krb5-admin-server</name>
- </package>
- <package>
- <name>krb5-user</name>
- </package>
- <package>
- <name>krb5-config</name>
- </package>
- </packages>
- </osSpecific>
-
- <osSpecific>
- <osFamily>suse11</osFamily>
- <packages>
- <package>
- <name>krb5</name>
- </package>
- <package>
- <name>krb5-client</name>
- </package>
- <package>
- <name>krb5-server</name>
- </package>
- </packages>
- </osSpecific>
- </osSpecifics>
-
- <commandScript>
- <script>scripts/service_check.py</script>
- <scriptType>PYTHON</scriptType>
- <timeout>300</timeout>
- </commandScript>
-
- <configuration-dependencies>
- <config-type>krb5-conf</config-type>
- <config-type>kdc-conf</config-type>
- <config-type>kadm5-acl</config-type>
- </configuration-dependencies>
- <restartRequiredAfterChange>true</restartRequiredAfterChange>
+ <extends>common-services/KERBEROS/1.10.3-10</extends>
</service>
</services>
</metainfo>
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/package/scripts/kerberos_client.py
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/package/scripts/kerberos_client.py b/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/package/scripts/kerberos_client.py
deleted file mode 100644
index a341e8d..0000000
--- a/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/package/scripts/kerberos_client.py
+++ /dev/null
@@ -1,40 +0,0 @@
-"""
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements. See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership. The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-
-"""
-
-from kerberos_common import *
-
-class KerberosClient(KerberosScript):
- def install(self, env):
- self.install_packages(env, ['krb5-server', 'krb5-libs', 'krb5-auth-dialog', 'krb5', 'krb5-kdc', 'krb5-admin-server'])
- self.configure(env)
-
-
- def configure(self, env):
- import params
- env.set_params(params)
- self.write_krb5_conf()
-
- def status(self, env):
- raise ClientComponentHasNoStatus()
-
- def set_keytab(self, env):
- KerberosScript.write_keytab_file()
-
-if __name__ == "__main__":
- KerberosClient().execute()
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/package/scripts/kerberos_common.py
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/package/scripts/kerberos_common.py b/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/package/scripts/kerberos_common.py
deleted file mode 100644
index 42e195c..0000000
--- a/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/package/scripts/kerberos_common.py
+++ /dev/null
@@ -1,398 +0,0 @@
-"""
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements. See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership. The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-
-"""
-
-import base64
-import os
-import string
-import subprocess
-import sys
-import tempfile
-
-from resource_management import *
-from utils import get_property_value
-
-class KerberosScript(Script):
- KRB5_REALM_PROPERTIES = [
- 'kdc',
- 'admin_server',
- 'default_domain',
- 'master_kdc'
- ]
-
- KRB5_SECTION_NAMES = [
- 'libdefaults',
- 'logging',
- 'realms',
- 'domain_realm',
- 'capaths',
- 'ca_paths',
- 'appdefaults',
- 'plugins'
- ]
-
- @staticmethod
- def create_random_password():
- import random
-
- chars = string.digits + string.ascii_letters
- return ''.join(random.choice(chars) for x in range(13))
-
- @staticmethod
- def write_conf_section(output_file, section_name, section_data):
- if section_name is not None:
- output_file.write('[%s]\n' % section_name)
-
- if section_data is not None:
- for key, value in section_data.iteritems():
- output_file.write(" %s = %s\n" % (key, value))
-
-
- @staticmethod
- def _write_conf_realm(output_file, realm_name, realm_data):
- """ Writes out realm details
-
- Example:
-
- EXAMPLE.COM = {
- kdc = kerberos.example.com
- admin_server = kerberos.example.com
- }
-
- """
- if realm_name is not None:
- output_file.write(" %s = {\n" % realm_name)
-
- if realm_data is not None:
- for key, value in realm_data.iteritems():
- if key in KerberosScript.KRB5_REALM_PROPERTIES:
- output_file.write(" %s = %s\n" % (key, value))
-
- output_file.write(" }\n")
-
- @staticmethod
- def write_conf_realms_section(output_file, section_name, realms_data):
- if section_name is not None:
- output_file.write('[%s]\n' % section_name)
-
- if realms_data is not None:
- for realm, realm_data in realms_data.iteritems():
- KerberosScript._write_conf_realm(output_file, realm, realm_data)
- output_file.write('\n')
-
- @staticmethod
- def write_krb5_conf():
- import params
-
- Directory(params.krb5_conf_dir,
- owner='root',
- recursive=True,
- group='root',
- mode=0755
- )
-
- if (params.krb5_conf_template is None) or not params.krb5_conf_template.strip():
- content = Template('krb5_conf.j2')
- else:
- content = InlineTemplate(params.krb5_conf_template)
-
- File(params.krb5_conf_path,
- content=content,
- owner='root',
- group='root',
- mode=0644
- )
-
- @staticmethod
- def invoke_kadmin(query, admin_identity=None, default_realm=None):
- """
- Executes the kadmin or kadmin.local command (depending on whether auth_identity is set or not
- and returns command result code and standard out data.
-
- :param query: the kadmin query to execute
- :param admin_identity: the identity for the administrative user (optional)
- :param default_realm: the default realm to assume
- :return: return_code, out
- """
- if (query is not None) and (len(query) > 0):
- auth_principal = None
- auth_keytab_file = None
-
- if admin_identity is not None:
- auth_principal = get_property_value(admin_identity, 'principal')
-
- if auth_principal is None:
- kadmin = 'kadmin.local'
- credential = ''
- else:
- kadmin = 'kadmin -p "%s"' % auth_principal
-
- auth_password = get_property_value(admin_identity, 'password')
-
- if auth_password is None:
- auth_keytab = get_property_value(admin_identity, 'keytab')
-
- if auth_keytab is not None:
- (fd, auth_keytab_file) = tempfile.mkstemp()
- os.write(fd, base64.b64decode(auth_keytab))
- os.close(fd)
-
- credential = '-k -t %s' % auth_keytab_file
- else:
- credential = '-w "%s"' % auth_password
-
- if (default_realm is not None) and (len(default_realm) > 0):
- realm = '-r %s' % default_realm
- else:
- realm = ''
-
- try:
- command = '%s %s %s -q "%s"' % (kadmin, credential, realm, query.replace('"', '\\"'))
- return shell.checked_call(command)
- except:
- raise
- finally:
- if auth_keytab_file is not None:
- os.remove(auth_keytab_file)
-
- @staticmethod
- def create_keytab_file(principal, path, auth_identity=None):
- success = False
-
- if (principal is not None) and (len(principal) > 0):
- if (auth_identity is None) or (len(auth_identity) == 0):
- norandkey = '-norandkey'
- else:
- norandkey = ''
-
- if (path is not None) and (len(path) > 0):
- keytab_file = '-k %s' % path
- else:
- keytab_file = ''
-
- try:
- result_code, output = KerberosScript.invoke_kadmin(
- 'ktadd %s %s %s' % (keytab_file, norandkey, principal),
- auth_identity)
-
- success = (result_code == 0)
- except:
- raise Fail("Failed to create keytab for principal: %s (in %s)" % (principal, path))
-
- return success
-
- @staticmethod
- def create_keytab(principal, auth_identity=None):
- keytab = None
-
- (fd, temp_path) = tempfile.mkstemp()
- os.remove(temp_path)
-
- try:
- if KerberosScript.create_keytab_file(principal, temp_path, auth_identity):
- with open(temp_path, 'r') as f:
- keytab = base64.b64encode(f.read())
- finally:
- if os.path.isfile(temp_path):
- os.remove(temp_path)
-
- return keytab
-
- @staticmethod
- def principal_exists(identity, auth_identity=None):
- exists = False
-
- if identity is not None:
- principal = get_property_value(identity, 'principal')
-
- if (principal is not None) and (len(principal) > 0):
- try:
- result_code, output = KerberosScript.invoke_kadmin('getprinc %s' % principal,
- auth_identity)
- exists = (output is not None) and (("Principal: %s" % principal) in output)
- except:
- raise Fail("Failed to determine if principal exists: %s" % principal)
-
- return exists
-
- @staticmethod
- def change_principal_password(identity, auth_identity=None):
- success = False
-
- if identity is not None:
- principal = get_property_value(identity, 'principal')
-
- if (principal is not None) and (len(principal) > 0):
- password = get_property_value(identity, 'password')
-
- if password is None:
- credentials = '-randkey'
- else:
- credentials = '-pw "%s"' % password
-
- try:
- result_code, output = KerberosScript.invoke_kadmin(
- 'change_password %s %s' % (credentials, principal),
- auth_identity)
-
- success = (result_code == 0)
- except:
- raise Fail("Failed to create principal: %s" % principal)
-
- return success
-
- @staticmethod
- def create_principal(identity, auth_identity=None):
- success = False
-
- if identity is not None:
- principal = get_property_value(identity, 'principal')
-
- if (principal is not None) and (len(principal) > 0):
- password = get_property_value(identity, 'password')
-
- if password is None:
- credentials = '-randkey'
- else:
- credentials = '-pw "%s"' % password
-
- try:
- result_code, out = KerberosScript.invoke_kadmin(
- 'addprinc %s %s' % (credentials, principal),
- auth_identity)
-
- success = (result_code == 0)
- except:
- raise Fail("Failed to create principal: %s" % principal)
-
- return success
-
- @staticmethod
- def create_principals(identities, auth_identity=None):
- if identities is not None:
- for identity in identities:
- KerberosScript.create_principal(identity, auth_identity)
-
- @staticmethod
- def create_or_update_administrator_identity():
- import params
-
- if params.realm is not None:
- admin_identity = params.get_property_value(params.realm, 'admin_identity')
-
- if KerberosScript.principal_exists(admin_identity):
- KerberosScript.change_principal_password(admin_identity)
- else:
- KerberosScript.create_principal(admin_identity)
-
- @staticmethod
- def test_kinit(identity):
- principal = get_property_value(identity, 'principal')
-
- if principal is not None:
- keytab_file = get_property_value(identity, 'keytab_file')
- keytab = get_property_value(identity, 'keytab')
- password = get_property_value(identity, 'password')
-
- # If a test keytab file is available, simply use it
- if (keytab_file is not None) and (os.path.isfile(keytab_file)):
- command = 'kinit -k -t %s %s' % (keytab_file, principal)
- Execute(command)
- return shell.checked_call('kdestroy')
-
- # If base64-encoded test keytab data is available; then decode it, write it to a temporary file
- # use it, and then remove the temporary file
- elif keytab is not None:
- (fd, test_keytab_file) = tempfile.mkstemp()
- os.write(fd, base64.b64decode(keytab))
- os.close(fd)
-
- try:
- command = 'kinit -k -t %s %s' % (test_keytab_file, principal)
- Execute(command)
- return shell.checked_call('kdestroy')
- except:
- raise
- finally:
- if test_keytab_file is not None:
- os.remove(test_keytab_file)
-
- # If no keytab data is available and a password was supplied, simply use it.
- elif password is not None:
- process = subprocess.Popen(['kinit', principal], stdin=subprocess.PIPE)
- stdout, stderr = process.communicate(password)
- if process.returncode:
- err_msg = Logger.filter_text("Execution of kinit returned %d. %s" % (process.returncode, stderr))
- raise Fail(err_msg)
- else:
- return shell.checked_call('kdestroy')
- else:
- return 0, ''
- else:
- return 0, ''
-
-
- @staticmethod
- def write_keytab_file():
- import params
-
- if params.kerberos_command_params is not None:
- for item in params.kerberos_command_params:
- keytab_content_base64 = get_property_value(item, 'keytab_content_base64')
- if (keytab_content_base64 is not None) and (len(keytab_content_base64) > 0):
- keytab_file_path = get_property_value(item, 'keytab_file_path')
- if (keytab_file_path is not None) and (len(keytab_file_path) > 0):
- head, tail = os.path.split(keytab_file_path)
- if head and not os.path.isdir(head):
- os.makedirs(head)
- with open(keytab_file_path, 'w') as f:
- f.write(base64.b64decode(keytab_content_base64))
- owner = get_property_value(item, 'keytab_file_owner')
- owner_access = get_property_value(item, 'keytab_file_owner_access')
- group = get_property_value(item, 'keytab_file_group')
- group_access = get_property_value(item, 'keytab_file_group_access')
- KerberosScript._set_file_access(keytab_file_path, owner, owner_access, group, group_access)
-
-
- @staticmethod
- def _set_file_access(file_path, owner, owner_access='rw', group=None, group_access=''):
- if (file_path is not None) and os.path.isfile(file_path) and (owner is not None):
- import stat
- import pwd
- import grp
-
- pwnam = pwd.getpwnam(owner) if (owner is not None) and (len(owner) > 0) else None
- uid = pwnam.pw_uid if pwnam is not None else os.geteuid()
-
- grnam = grp.getgrnam(group) if (group is not None) and (len(group) > 0) else None
- gid = grnam.gr_gid if grnam is not None else os.getegid()
-
- chmod = 0
-
- if owner_access == 'r':
- chmod |= stat.S_IREAD
- else:
- chmod |= stat.S_IREAD | stat.S_IWRITE
-
- if group_access == 'rw':
- chmod |= stat.S_IRGRP | stat.S_IWGRP
- elif group_access == 'r':
- chmod |= stat.S_IRGRP
-
- os.chmod(file_path, chmod)
- os.chown(file_path, uid, gid)
http://git-wip-us.apache.org/repos/asf/ambari/blob/0d7976bc/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/package/scripts/kerberos_server.py
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/package/scripts/kerberos_server.py b/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/package/scripts/kerberos_server.py
deleted file mode 100644
index 3e15f50..0000000
--- a/ambari-server/src/main/resources/stacks/HDP/2.2/services/KERBEROS/package/scripts/kerberos_server.py
+++ /dev/null
@@ -1,144 +0,0 @@
-"""
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements. See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership. The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-
-"""
-
-from kerberos_common import *
-
-class KerberosServer(KerberosScript):
- @staticmethod
- def write_kadm5_acl():
- import params
-
- Directory(params.kadm5_acl_dir,
- owner='root',
- recursive=True,
- group='root',
- mode=0700
- )
-
- if (params.kadm5_acl_template is None) or not params.kadm5_acl_template.strip():
- content = Template('kadm5_acl.j2')
- else:
- content = InlineTemplate(params.kadm5_acl_template)
-
- File(params.kadm5_acl_path,
- content=content,
- owner='root',
- group='root',
- mode=0600
- )
-
- @staticmethod
- def write_kdc_conf():
- import params
-
- Directory(params.kdc_conf_dir,
- owner='root',
- recursive=True,
- group='root',
- mode=0700
- )
-
- if (params.kdc_conf_template is None) or not params.kdc_conf_template.strip():
- content = Template('kdc_conf.j2')
- else:
- content = InlineTemplate(params.kdc_conf_template)
-
- File(params.kdc_conf_path,
- content=content,
- owner='root',
- group='root',
- mode=0600
- )
-
- def install(self, env):
- import params
-
- self.install_packages(env)
- self.configure(env)
-
- # Create the Kerberos database (only on install, for now)
- Execute(
- "%s create -s -P '%s'" % (params.kdb5_util_path, KerberosScript.create_random_password()))
-
- # Create or update the administrator account
- KerberosScript.create_or_update_administrator_identity()
-
-
- def start(self, env):
- os_family = System.get_instance().os_family
-
- # Attempt to reconfigure the service before starting
- self.configure(env)
-
- # Create or update the administrator account
- KerberosScript.create_or_update_administrator_identity()
-
- if os_family == "suse":
- Execute('rckadmind start')
- Execute('rckrb5kdc start')
- elif os_family == 'ubuntu':
- Execute('service krb5-kdc start')
- Execute('service krb5-admin-server start')
- else:
- Execute('service krb5kdc start')
- Execute('service kadmin start')
-
- def stop(self, env):
- os_family = System.get_instance().os_family
-
- if os_family == "suse":
- Execute('rckadmind stop')
- Execute('rckrb5kdc stop')
- elif os_family == 'ubuntu':
- Execute('service krb5-kdc stop')
- Execute('service krb5-admin-server stop')
- else:
- Execute('service krb5kdc stop')
- Execute('service kadmin stop')
-
-
- def configure(self, env):
- import params
- env.set_params(params)
-
- KerberosServer.write_krb5_conf()
- KerberosServer.write_kdc_conf()
- KerberosServer.write_kadm5_acl()
-
- def status(self, env):
- import params
-
- if params.os_family == "suse":
- try:
- Execute('checkproc `which krb5kdc`')
- Execute('checkproc `which kadmind`')
- except Fail as ex:
- raise ComponentIsNotRunning()
-
- elif params.os_family == 'ubuntu':
- check_process_status(params.kdamin_pid_path)
- check_process_status(params.krb5kdc_pid_path)
-
- else:
- check_process_status(params.kdamin_pid_path)
- check_process_status(params.krb5kdc_pid_path)
-
-
-if __name__ == "__main__":
- KerberosServer().execute()