You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by xi...@apache.org on 2018/04/03 18:14:29 UTC
hadoop git commit: HADOOP-14987. Improve KMSClientProvider log around
delegation token checking. Contributed by Xiaoyu Yao and Xiao Chen.
Repository: hadoop
Updated Branches:
refs/heads/branch-2 254ec1e4d -> b8d8c25a1
HADOOP-14987. Improve KMSClientProvider log around delegation token checking. Contributed by Xiaoyu Yao and Xiao Chen.
(cherry picked from commit 59d78a5088700350a5122c3a3ba5e76cd26d6a80)
Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo
Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/b8d8c25a
Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/b8d8c25a
Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/b8d8c25a
Branch: refs/heads/branch-2
Commit: b8d8c25a18df467263b25677d45c9c60b43d4e68
Parents: 254ec1e
Author: Xiao Chen <xi...@apache.org>
Authored: Tue Apr 3 11:07:11 2018 -0700
Committer: Xiao Chen <xi...@apache.org>
Committed: Tue Apr 3 11:14:26 2018 -0700
----------------------------------------------------------------------
.../crypto/key/kms/KMSClientProvider.java | 46 +++++++++++--------
.../hadoop/security/UserGroupInformation.java | 47 ++++++++++++++++----
.../kms/TestLoadBalancingKMSClientProvider.java | 15 +++++++
3 files changed, 81 insertions(+), 27 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hadoop/blob/b8d8c25a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java
index 42c97d3..cdd494f 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java
@@ -127,6 +127,13 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension,
private static final ObjectWriter WRITER =
new ObjectMapper().writerWithDefaultPrettyPrinter();
+ private final Text dtService;
+
+ // Allow fallback to default kms server port 9600 for certain tests that do
+ // not specify the port explicitly in the kms provider url.
+ @VisibleForTesting
+ public static volatile boolean fallbackDefaultPortForTesting = false;
+
private class EncryptedQueueRefiller implements
ValueQueue.QueueRefiller<EncryptedKeyVersion> {
@@ -372,7 +379,7 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension,
return s;
}
- private String kmsUrl;
+ private URL kmsUrl;
private SSLFactory sslFactory;
private ConnectionConfigurator configurator;
private DelegationTokenAuthenticatedURL.Token authToken;
@@ -424,7 +431,15 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension,
public KMSClientProvider(URI uri, Configuration conf) throws IOException {
super(conf);
kmsUrl = createServiceURL(extractKMSPath(uri));
- if ("https".equalsIgnoreCase(new URL(kmsUrl).getProtocol())) {
+ int kmsPort = kmsUrl.getPort();
+ if ((kmsPort == -1) && fallbackDefaultPortForTesting) {
+ kmsPort = 9600;
+ }
+
+ InetSocketAddress addr = new InetSocketAddress(kmsUrl.getHost(), kmsPort);
+ dtService = SecurityUtil.buildTokenService(addr);
+
+ if ("https".equalsIgnoreCase(kmsUrl.getProtocol())) {
sslFactory = new SSLFactory(SSLFactory.Mode.CLIENT, conf);
try {
sslFactory.init();
@@ -460,19 +475,20 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension,
KMS_CLIENT_ENC_KEY_CACHE_NUM_REFILL_THREADS_DEFAULT),
new EncryptedQueueRefiller());
authToken = new DelegationTokenAuthenticatedURL.Token();
+ LOG.info("KMSClientProvider for KMS url: {} delegation token service: {}" +
+ " created.", kmsUrl, dtService);
}
private static Path extractKMSPath(URI uri) throws MalformedURLException, IOException {
return ProviderUtils.unnestUri(uri);
}
- private static String createServiceURL(Path path) throws IOException {
+ private static URL createServiceURL(Path path) throws IOException {
String str = new URL(path.toString()).toExternalForm();
if (str.endsWith("/")) {
str = str.substring(0, str.length() - 1);
}
- return new URL(str + KMSRESTConstants.SERVICE_VERSION + "/").
- toExternalForm();
+ return new URL(str + KMSRESTConstants.SERVICE_VERSION + "/");
}
private URL createURL(String collection, String resource, String subResource,
@@ -989,7 +1005,6 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension,
public Token<?>[] addDelegationTokens(final String renewer,
Credentials credentials) throws IOException {
Token<?>[] tokens = null;
- Text dtService = getDelegationTokenService();
Token<?> token = credentials.getToken(dtService);
if (token == null) {
final URL url = createURL(null, null, null, null);
@@ -1026,21 +1041,14 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension,
}
return tokens;
}
-
- private Text getDelegationTokenService() throws IOException {
- URL url = new URL(kmsUrl);
- InetSocketAddress addr = new InetSocketAddress(url.getHost(),
- url.getPort());
- Text dtService = SecurityUtil.buildTokenService(addr);
- return dtService;
- }
private boolean containsKmsDt(UserGroupInformation ugi) throws IOException {
// Add existing credentials from the UGI, since provider is cached.
Credentials creds = ugi.getCredentials();
if (!creds.getAllTokens().isEmpty()) {
+ LOG.debug("Searching for token that matches service: {}", dtService);
org.apache.hadoop.security.token.Token<? extends TokenIdentifier>
- dToken = creds.getToken(getDelegationTokenService());
+ dToken = creds.getToken(dtService);
if (dToken != null) {
return true;
}
@@ -1051,9 +1059,9 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension,
private UserGroupInformation getActualUgi() throws IOException {
final UserGroupInformation currentUgi = UserGroupInformation
.getCurrentUser();
- if (LOG.isDebugEnabled()) {
- UserGroupInformation.logAllUserInfo(currentUgi);
- }
+
+ UserGroupInformation.logAllUserInfo(LOG, currentUgi);
+
// Use current user by default
UserGroupInformation actualUgi = currentUgi;
if (currentUgi.getRealUser() != null) {
@@ -1092,6 +1100,6 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension,
@VisibleForTesting
String getKMSUrl() {
- return kmsUrl;
+ return kmsUrl.toString();
}
}
http://git-wip-us.apache.org/repos/asf/hadoop/blob/b8d8c25a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
index 2655655..e11de3b 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
@@ -1917,20 +1917,51 @@ public class UserGroupInformation {
}
}
- public static void logAllUserInfo(UserGroupInformation ugi) throws
+ /**
+ * Log current UGI and token information into specified log.
+ * @param ugi - UGI
+ * @throws IOException
+ */
+ @InterfaceAudience.LimitedPrivate({"HDFS", "KMS"})
+ @InterfaceStability.Unstable
+ public static void logUserInfo(Logger log, String caption,
+ UserGroupInformation ugi) throws IOException {
+ if (log.isDebugEnabled()) {
+ log.debug(caption + " UGI: " + ugi);
+ for (Token<?> token : ugi.getTokens()) {
+ log.debug("+token:" + token);
+ }
+ }
+ }
+
+ /**
+ * Log all (current, real, login) UGI and token info into specified log.
+ * @param ugi - UGI
+ * @throws IOException
+ */
+ @InterfaceAudience.LimitedPrivate({"HDFS", "KMS"})
+ @InterfaceStability.Unstable
+ public static void logAllUserInfo(Logger log, UserGroupInformation ugi) throws
IOException {
- if (LOG.isDebugEnabled()) {
- LOG.debug("UGI: " + ugi);
+ if (log.isDebugEnabled()) {
+ logUserInfo(log, "Current", ugi.getCurrentUser());
if (ugi.getRealUser() != null) {
- LOG.debug("+RealUGI: " + ugi.getRealUser());
- }
- LOG.debug("+LoginUGI: " + ugi.getLoginUser());
- for (Token<?> token : ugi.getTokens()) {
- LOG.debug("+UGI token:" + token);
+ logUserInfo(log, "Real", ugi.getRealUser());
}
+ logUserInfo(log, "Login", ugi.getLoginUser());
}
}
+ /**
+ * Log all (current, real, login) UGI and token info into UGI debug log.
+ * @param ugi - UGI
+ * @throws IOException
+ */
+ public static void logAllUserInfo(UserGroupInformation ugi) throws
+ IOException {
+ logAllUserInfo(LOG, ugi);
+ }
+
private void print() throws IOException {
System.out.println("User: " + getUserName());
System.out.print("Group Ids: ");
http://git-wip-us.apache.org/repos/asf/hadoop/blob/b8d8c25a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/kms/TestLoadBalancingKMSClientProvider.java
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/kms/TestLoadBalancingKMSClientProvider.java b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/kms/TestLoadBalancingKMSClientProvider.java
index f2164e9..0270d26 100644
--- a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/kms/TestLoadBalancingKMSClientProvider.java
+++ b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/kms/TestLoadBalancingKMSClientProvider.java
@@ -39,8 +39,11 @@ import org.apache.hadoop.crypto.key.KeyProviderCryptoExtension;
import org.apache.hadoop.fs.CommonConfigurationKeysPublic;
import org.apache.hadoop.net.ConnectTimeoutException;
import org.apache.hadoop.security.AccessControlException;
+import org.apache.hadoop.security.SecurityUtil;
import org.apache.hadoop.security.authentication.client.AuthenticationException;
import org.apache.hadoop.security.authorize.AuthorizationException;
+import org.junit.After;
+import org.junit.BeforeClass;
import org.junit.Test;
import org.mockito.Mockito;
@@ -48,9 +51,20 @@ import com.google.common.collect.Sets;
public class TestLoadBalancingKMSClientProvider {
+ @BeforeClass
+ public static void setup() throws IOException {
+ SecurityUtil.setTokenServiceUseIp(false);
+ }
+
+ @After
+ public void teardown() throws IOException {
+ KMSClientProvider.fallbackDefaultPortForTesting = false;
+ }
+
@Test
public void testCreation() throws Exception {
Configuration conf = new Configuration();
+ KMSClientProvider.fallbackDefaultPortForTesting = true;
KeyProvider kp = new KMSClientProvider.Factory().createProvider(new URI(
"kms://http@host1/kms/foo"), conf);
assertTrue(kp instanceof LoadBalancingKMSClientProvider);
@@ -231,6 +245,7 @@ public class TestLoadBalancingKMSClientProvider {
@Test
public void testClassCastException() throws Exception {
Configuration conf = new Configuration();
+ KMSClientProvider.fallbackDefaultPortForTesting = true;
KMSClientProvider p1 = new MyKMSClientProvider(
new URI("kms://http@host1/kms/foo"), conf);
LoadBalancingKMSClientProvider kp = new LoadBalancingKMSClientProvider(
---------------------------------------------------------------------
To unsubscribe, e-mail: common-commits-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-commits-help@hadoop.apache.org