You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "shuan1026 (via GitHub)" <gi...@apache.org> on 2026/07/26 05:12:21 UTC
[PR] HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests [ozone]
shuan1026 opened a new pull request, #10873:
URL: https://github.com/apache/ozone/pull/10873
## What changes were proposed in this pull request?
Currently, `TestSecretKeySnapshot`, `TestSecretKeysApi`, `TestDelegationToken`, and `TestSecureOzoneCluster` are independent integration test classes testing SecretKey functionalities in a secure cluster environment. However, they share a significant amount of duplicated boilerplate for setting up the secure environment.
This PR extracts the duplicated Kerberos and MiniKDC initialization logic into a shared abstract base class, `AbstractKerberosTest` (`org.apache.hadoop.ozone`), and migrates all four test classes to extend it. To ensure behavior remains identical to before the migration, the base owns the MiniKdc lifecycle (`startMiniKdc`/`stopMiniKdc`), `setSecureConfig()`, and `createCredentialsInKDC()`, exposing four protected hooks so subclasses can describe how their setup differs instead of duplicating the whole thing:
* `useSharedServicePrincipal()` — SCM/OM share one `scm/...` principal+keytab (`TestSecretKeysApi`, `TestSecretKeySnapshot`) vs. separate `scm/...` / `om/...` principals (`TestDelegationToken`, `TestSecureOzoneCluster`)
* `createTestUserPrincipal()` — whether a `test@REALM` principal is created
* `enableSecurityAuthorizationByDefault()` — whether `hadoop.security.authorization` defaults to `true`
* `kerberosAuthenticationValue()` — preserves a pre-existing inconsistency where two classes set `hadoop.security.authentication` to the literal lowercase `"kerberos"` instead of the enum's `"KERBEROS"`
The trickiest part was `TestSecureOzoneCluster`: it sets up the KDC **once per class** (`@BeforeAll`/`@AfterAll`, static fields), while the other three do it fresh **per test method**. JUnit 5's `@TempDir` on an instance field is scoped per-test-method regardless of `@TestInstance` lifecycle, so the base class's `workDir` was changed from a JUnit-managed `@TempDir` field to a manually created and cleaned directory using `Files.createTempDirectory` and `FileUtils.deleteQuietly`, both already-established patterns elsewhere in this test module. This lets `TestSecureOzoneCluster` use `@TestInstance(Lifecycle.PER_CLASS)` with instance-level `@BeforeAll`/`@AfterAll` while the other three keep their existing per-test behavior unchanged. Under JUnit Jupiter's default `PER_METHOD` lifecycle, each test method runs on a fresh instance of the test class, so `workDir` is `null` again each time.
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-15913
## How was this patch tested?
* Ran `mvn -pl :ozone-integration-test test-compile`; compile succeeded.
* Ran `mvn -pl :ozone-integration-test test -Dtest=TestSecretKeysApi,TestSecretKeySnapshot,TestDelegationToken,TestSecureOzoneCluster`; all 4 classes passed.
* Ran `./hadoop-ozone/dev-support/checks/checkstyle.sh`; no violations.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests [ozone]
Posted by "chungen0126 (via GitHub)" <gi...@apache.org>.
chungen0126 commented on code in PR #10873:
URL: https://github.com/apache/ozone/pull/10873#discussion_r3749353944
##########
hadoop-ozone/integration-test/src/test/java/org/apache/ozone/test/KerberosTests.java:
##########
@@ -0,0 +1,198 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ozone.test;
+
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION;
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHORIZATION;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ADMINISTRATORS;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod.KERBEROS;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.InetAddress;
+import java.nio.file.Files;
+import java.util.Properties;
+import org.apache.commons.io.FileUtils;
+import org.apache.hadoop.hdds.conf.OzoneConfiguration;
+import org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig;
+import org.apache.hadoop.minikdc.MiniKdc;
+import org.apache.hadoop.security.UserGroupInformation;
+
+/**
+ * Shared MiniKdc / Kerberos setup for secure cluster integration tests (HDDS-15913).
+ */
+public abstract class KerberosTests {
+
+ private MiniKdc miniKdc;
+ private OzoneConfiguration conf;
+
+ private File workDir;
+
+ /** Service keytab (scm.keytab); shared by SCM/OM/DN when useSharedServicePrincipal(). */
+ private File ozoneKeytab;
+ private File spnegoKeytab;
+ private File testUserKeytab;
+ private String testUserPrincipal;
+ /** e.g. scm/host@REALM when useSharedServicePrincipal(). */
+ private String ozonePrincipal;
+
+ /** Separate OM keytab, only used when useSharedServicePrincipal() is false. */
+ private File omKeytab;
+
+ protected OzoneConfiguration getConf() {
+ return conf;
+ }
+
+ protected OzoneConfiguration createOzoneConfig() {
+ return new OzoneConfiguration();
+ }
+
+ protected File getOzoneKeytab() {
+ return ozoneKeytab;
+ }
+
+ protected String getOzonePrincipal() {
+ return ozonePrincipal;
+ }
+
+ protected File getTestUserKeytab() {
+ return testUserKeytab;
+ }
+
+ protected String getTestUserPrincipal() {
+ return testUserPrincipal;
+ }
+
+ protected void initKerberos() throws Exception {
+ if (conf == null) {
+ conf = createOzoneConfig();
+ }
+ startMiniKdc();
+ setSecureConfig();
+ createCredentialsInKDC();
+ }
+
+ protected void startMiniKdc() throws Exception {
+ if (workDir == null) {
+ workDir = Files.createTempDirectory("kerberos").toFile();
+ }
+ Properties securityProperties = MiniKdc.createConf();
+ miniKdc = new MiniKdc(securityProperties, workDir);
+ miniKdc.start();
+ }
+
+ protected void stopMiniKdc() {
+ if (miniKdc != null) {
+ miniKdc.stop();
+ }
+ FileUtils.deleteQuietly(workDir);
+ }
+
+ protected void createPrincipal(File keytab, String... principal)
+ throws Exception {
+ miniKdc.createPrincipal(keytab, principal);
+ }
+
+ protected void setSecureConfig() throws IOException {
+ conf.setBoolean(OZONE_SECURITY_ENABLED_KEY, true);
+ String host = InetAddress.getLocalHost().getCanonicalHostName()
+ .toLowerCase();
+
+ conf.set(HADOOP_SECURITY_AUTHENTICATION, KERBEROS.name());
+
+ String curUser = UserGroupInformation.getCurrentUser().getUserName();
+ conf.set(OZONE_ADMINISTRATORS, curUser);
+
+ String realm = miniKdc.getRealm();
+ String hostAndRealm = host + "@" + realm;
+
+ ozoneKeytab = new File(workDir, "scm.keytab");
+ spnegoKeytab = new File(workDir, "http.keytab");
+
+ if (useSharedServicePrincipal()) {
+ ozonePrincipal = "scm/" + hostAndRealm;
+ conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ conf.set(HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY,
+ ozoneKeytab.getAbsolutePath());
+ } else {
+ ozonePrincipal = "scm/" + hostAndRealm;
+ conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ omKeytab = new File(workDir, "om.keytab");
+ conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, "om/" + hostAndRealm);
+ conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY, omKeytab.getAbsolutePath());
+ }
+
+ conf.set(HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_SCM/" + hostAndRealm);
+ conf.set(OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_OM/" + hostAndRealm);
+ conf.set(HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY,
+ spnegoKeytab.getAbsolutePath());
+ conf.set(OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE,
+ spnegoKeytab.getAbsolutePath());
+
+ if (createTestUserPrincipal()) {
+ testUserKeytab = new File(workDir, "testuser.keytab");
+ testUserPrincipal = "test@" + realm;
+ }
+
+ if (enableSecurityAuthorizationByDefault()) {
+ conf.setBoolean(HADOOP_SECURITY_AUTHORIZATION, true);
+ }
+ }
+
+ protected void createCredentialsInKDC() throws Exception {
+ SCMHTTPServerConfig httpServerConfig =
+ conf.getObject(SCMHTTPServerConfig.class);
+ createPrincipal(ozoneKeytab, conf.get(HDDS_SCM_KERBEROS_PRINCIPAL_KEY));
+ if (!useSharedServicePrincipal()) {
+ createPrincipal(omKeytab, conf.get(OZONE_OM_KERBEROS_PRINCIPAL_KEY));
+ }
+ createPrincipal(spnegoKeytab, httpServerConfig.getKerberosPrincipal());
+ if (createTestUserPrincipal()) {
+ createPrincipal(testUserKeytab, testUserPrincipal);
+ }
+ }
+
+ /** Whether SCM/OM (and optionally DN) share a single "scm/..." principal and keytab. */
+ protected boolean useSharedServicePrincipal() {
+ return true;
+ }
+
+ protected boolean createTestUserPrincipal() {
+ return true;
+ }
+
+ protected boolean enableSecurityAuthorizationByDefault() {
+ return true;
+ }
Review Comment:
Rather than overriding these methods to tweak the configuration, I'd prefer to directly override `setSecureConfig` and `createCredentialsInKDC` themselves.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on PR #10873:
URL: https://github.com/apache/ozone/pull/10873#issuecomment-5821423203
Thanks @shuan1026 for the patch, @chihsuan, @chungen0126, @yandrey321 for the review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests [ozone]
Posted by "yandrey321 (via GitHub)" <gi...@apache.org>.
yandrey321 commented on code in PR #10873:
URL: https://github.com/apache/ozone/pull/10873#discussion_r3913977371
##########
hadoop-ozone/integration-test/src/test/java/org/apache/ozone/test/KerberosTests.java:
##########
@@ -0,0 +1,198 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ozone.test;
+
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION;
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHORIZATION;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_CLIENT_ADDRESS_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ADMINISTRATORS;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod.KERBEROS;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.InetAddress;
+import java.nio.file.Files;
+import java.util.Properties;
+import org.apache.commons.io.FileUtils;
+import org.apache.hadoop.hdds.conf.OzoneConfiguration;
+import org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig;
+import org.apache.hadoop.minikdc.MiniKdc;
+import org.apache.hadoop.security.UserGroupInformation;
+
+/**
+ * Shared MiniKdc / Kerberos setup for secure cluster integration tests (HDDS-15913).
+ */
+public abstract class KerberosTests {
+
+ private MiniKdc miniKdc;
+ private OzoneConfiguration conf;
+
+ private File workDir;
+
+ /** Service keytab (scm.keytab); shared by SCM/OM/DN when using {@link #configureSharedServicePrincipal}. */
+ private File ozoneKeytab;
+ private File spnegoKeytab;
+ private File testUserKeytab;
+ private String testUserPrincipal;
+ /** e.g. scm/host@REALM. */
+ private String ozonePrincipal;
+
+ /** Separate OM keytab, only used with {@link #configureSeparateServicePrincipals}. */
+ private File omKeytab;
+
+ protected OzoneConfiguration getConf() {
+ return conf;
+ }
+
+ protected OzoneConfiguration createOzoneConfig() {
+ return new OzoneConfiguration();
+ }
+
+ protected File getOzoneKeytab() {
+ return ozoneKeytab;
+ }
+
+ protected String getOzonePrincipal() {
+ return ozonePrincipal;
+ }
+
+ protected File getTestUserKeytab() {
+ return testUserKeytab;
+ }
+
+ protected String getTestUserPrincipal() {
+ return testUserPrincipal;
+ }
+
+ protected void initKerberos() throws Exception {
+ if (conf == null) {
+ conf = createOzoneConfig();
Review Comment:
any reason why we would not do that in ctor?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests [ozone]
Posted by "shuan1026 (via GitHub)" <gi...@apache.org>.
shuan1026 commented on PR #10873:
URL: https://github.com/apache/ozone/pull/10873#issuecomment-5082155462
PTAL @chungen0126 Thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests [ozone]
Posted by "chungen0126 (via GitHub)" <gi...@apache.org>.
chungen0126 commented on PR #10873:
URL: https://github.com/apache/ozone/pull/10873#issuecomment-5507426139
@yandrey321 Would you like to take a look?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests [ozone]
Posted by "chungen0126 (via GitHub)" <gi...@apache.org>.
chungen0126 commented on code in PR #10873:
URL: https://github.com/apache/ozone/pull/10873#discussion_r3891519297
##########
hadoop-ozone/integration-test/src/test/java/org/apache/ozone/test/KerberosTests.java:
##########
@@ -0,0 +1,209 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ozone.test;
+
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION;
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHORIZATION;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_CLIENT_ADDRESS_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ADMINISTRATORS;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod.KERBEROS;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.InetAddress;
+import java.nio.file.Files;
+import java.util.Properties;
+import org.apache.commons.io.FileUtils;
+import org.apache.hadoop.hdds.conf.OzoneConfiguration;
+import org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig;
+import org.apache.hadoop.minikdc.MiniKdc;
+import org.apache.hadoop.security.UserGroupInformation;
+
+/**
+ * Shared MiniKdc / Kerberos setup for secure cluster integration tests (HDDS-15913).
+ */
+public abstract class KerberosTests {
+
+ private MiniKdc miniKdc;
+ private OzoneConfiguration conf;
+
+ private File workDir;
+
+ /** Service keytab (scm.keytab); shared by SCM/OM/DN when using {@link #configureSharedServicePrincipal}. */
+ private File ozoneKeytab;
+ private File spnegoKeytab;
+ private File testUserKeytab;
+ private String testUserPrincipal;
+ /** e.g. scm/host@REALM. */
+ private String ozonePrincipal;
+
+ /** Separate OM keytab, only used with {@link #configureSeparateServicePrincipals}. */
+ private File omKeytab;
+
+ protected OzoneConfiguration getConf() {
+ return conf;
+ }
+
+ protected OzoneConfiguration createOzoneConfig() {
+ return new OzoneConfiguration();
+ }
+
+ protected File getOzoneKeytab() {
+ return ozoneKeytab;
+ }
+
+ protected String getOzonePrincipal() {
+ return ozonePrincipal;
+ }
+
+ protected File getTestUserKeytab() {
+ return testUserKeytab;
+ }
+
+ protected String getTestUserPrincipal() {
+ return testUserPrincipal;
+ }
+
+ protected void initKerberos() throws Exception {
+ if (conf == null) {
+ conf = createOzoneConfig();
+ }
+ startMiniKdc();
+ setSecureConfig();
+ createCredentialsInKDC();
+ }
+
+ protected void startMiniKdc() throws Exception {
+ if (workDir == null) {
+ workDir = Files.createTempDirectory("kerberos").toFile();
+ }
+ Properties securityProperties = MiniKdc.createConf();
+ miniKdc = new MiniKdc(securityProperties, workDir);
+ miniKdc.start();
+ }
+
+ protected void stopMiniKdc() {
+ if (miniKdc != null) {
+ miniKdc.stop();
+ }
+ FileUtils.deleteQuietly(workDir);
+ }
+
+ protected void createPrincipal(File keytab, String... principal)
+ throws Exception {
+ miniKdc.createPrincipal(keytab, principal);
+ }
+
+ protected void setSecureConfig() throws IOException {
+ configureSecurityBasics();
+ String host = InetAddress.getLocalHost().getCanonicalHostName()
+ .toLowerCase();
+ String hostAndRealm = host + "@" + getRealm();
+ configureSharedServicePrincipal(hostAndRealm);
+ configureSpnegoPrincipal(hostAndRealm);
+ createTestUserCredentials();
+ conf.setBoolean(HADOOP_SECURITY_AUTHORIZATION, true);
+ }
+
+ protected void createCredentialsInKDC() throws Exception {
+ createScmPrincipalCredential();
+ createSpnegoPrincipalCredential();
+ createTestUserPrincipalCredential();
+ }
+
+ protected String getRealm() {
+ return miniKdc.getRealm();
+ }
+
+ /** Security basics common to every subclass's setSecureConfig(). */
+ protected void configureSecurityBasics() throws IOException {
+ conf.setBoolean(OZONE_SECURITY_ENABLED_KEY, true);
+ conf.set(OZONE_SCM_CLIENT_ADDRESS_KEY, "localhost");
+ conf.set(HADOOP_SECURITY_AUTHENTICATION, KERBEROS.name());
+ String curUser = UserGroupInformation.getCurrentUser().getUserName();
+ conf.set(OZONE_ADMINISTRATORS, curUser);
+ }
+
+ /** SCM/OM/DN share a single "scm/..." principal and keytab. */
+ protected void configureSharedServicePrincipal(String hostAndRealm) {
+ ozonePrincipal = "scm/" + hostAndRealm;
+ ozoneKeytab = new File(workDir, "scm.keytab");
+ conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ conf.set(HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY,
+ ozoneKeytab.getAbsolutePath());
+ }
+
+ /** SCM and OM use separate "scm/..." and "om/..." principals and keytabs. */
+ protected void configureSeparateServicePrincipals(String hostAndRealm) {
+ ozonePrincipal = "scm/" + hostAndRealm;
+ ozoneKeytab = new File(workDir, "scm.keytab");
+ conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ omKeytab = new File(workDir, "om.keytab");
+ conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, "om/" + hostAndRealm);
+ conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY, omKeytab.getAbsolutePath());
+ }
+
+ protected void configureSpnegoPrincipal(String hostAndRealm) {
+ spnegoKeytab = new File(workDir, "http.keytab");
+ conf.set(HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_SCM/" + hostAndRealm);
+ conf.set(OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_OM/" + hostAndRealm);
+ conf.set(HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY,
+ spnegoKeytab.getAbsolutePath());
+ conf.set(OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE,
+ spnegoKeytab.getAbsolutePath());
+ }
+
+ protected void createTestUserCredentials() {
+ testUserKeytab = new File(workDir, "testuser.keytab");
+ testUserPrincipal = "test@" + getRealm();
+ }
+
+ protected void createScmPrincipalCredential() throws Exception {
+ createPrincipal(ozoneKeytab, conf.get(HDDS_SCM_KERBEROS_PRINCIPAL_KEY));
+ }
+
+ protected void createOmPrincipalCredential() throws Exception {
+ createPrincipal(omKeytab, conf.get(OZONE_OM_KERBEROS_PRINCIPAL_KEY));
+ }
+
+ protected void createSpnegoPrincipalCredential() throws Exception {
+ SCMHTTPServerConfig httpServerConfig =
+ conf.getObject(SCMHTTPServerConfig.class);
+ createPrincipal(spnegoKeytab, httpServerConfig.getKerberosPrincipal());
+ }
+
+ protected void createTestUserPrincipalCredential() throws Exception {
+ createPrincipal(testUserKeytab, testUserPrincipal);
+ }
Review Comment:
These wrapper methods are over-engineered. Let's drop them and just invoke `createPrincipal` directly to keep the code straightforward.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai merged PR #10873:
URL: https://github.com/apache/ozone/pull/10873
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests [ozone]
Posted by "yandrey321 (via GitHub)" <gi...@apache.org>.
yandrey321 commented on code in PR #10873:
URL: https://github.com/apache/ozone/pull/10873#discussion_r3749926318
##########
hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/TestSecretKeySnapshot.java:
##########
@@ -87,24 +67,26 @@ public final class TestSecretKeySnapshot {
public static final int ROTATE_DURATION_MS = 30_000;
public static final int EXPIRY_DURATION_MS = 61_000;
- private MiniKdc miniKdc;
- private OzoneConfiguration conf;
- @TempDir
- private File workDir;
- private File ozoneKeytab;
- private File spnegoKeytab;
private MiniOzoneHAClusterImpl cluster;
+ @Override
+ protected boolean createTestUserPrincipal() {
+ return false;
+ }
+
+ @Override
+ protected boolean enableSecurityAuthorizationByDefault() {
+ return false;
+ }
+
@BeforeEach
public void init() throws Exception {
- conf = new OzoneConfiguration();
- conf.set(OZONE_SCM_CLIENT_ADDRESS_KEY, "localhost");
-
ExitUtils.disableSystemExit();
- startMiniKdc();
- setSecureConfig();
- createCredentialsInKDC();
+ initKerberos();
+ OzoneConfiguration conf = getConf();
+ conf.set(OZONE_SCM_CLIENT_ADDRESS_KEY, "localhost");
Review Comment:
should it be default in the base class?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests [ozone]
Posted by "shuan1026 (via GitHub)" <gi...@apache.org>.
shuan1026 commented on code in PR #10873:
URL: https://github.com/apache/ozone/pull/10873#discussion_r3777434843
##########
hadoop-ozone/integration-test/src/test/java/org/apache/ozone/test/KerberosTests.java:
##########
@@ -0,0 +1,198 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ozone.test;
+
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION;
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHORIZATION;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ADMINISTRATORS;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod.KERBEROS;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.InetAddress;
+import java.nio.file.Files;
+import java.util.Properties;
+import org.apache.commons.io.FileUtils;
+import org.apache.hadoop.hdds.conf.OzoneConfiguration;
+import org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig;
+import org.apache.hadoop.minikdc.MiniKdc;
+import org.apache.hadoop.security.UserGroupInformation;
+
+/**
+ * Shared MiniKdc / Kerberos setup for secure cluster integration tests (HDDS-15913).
+ */
+public abstract class KerberosTests {
+
+ private MiniKdc miniKdc;
+ private OzoneConfiguration conf;
+
+ private File workDir;
+
+ /** Service keytab (scm.keytab); shared by SCM/OM/DN when useSharedServicePrincipal(). */
+ private File ozoneKeytab;
+ private File spnegoKeytab;
+ private File testUserKeytab;
+ private String testUserPrincipal;
+ /** e.g. scm/host@REALM when useSharedServicePrincipal(). */
+ private String ozonePrincipal;
+
+ /** Separate OM keytab, only used when useSharedServicePrincipal() is false. */
+ private File omKeytab;
+
+ protected OzoneConfiguration getConf() {
+ return conf;
+ }
+
+ protected OzoneConfiguration createOzoneConfig() {
+ return new OzoneConfiguration();
+ }
+
+ protected File getOzoneKeytab() {
+ return ozoneKeytab;
+ }
+
+ protected String getOzonePrincipal() {
+ return ozonePrincipal;
+ }
+
+ protected File getTestUserKeytab() {
+ return testUserKeytab;
+ }
+
+ protected String getTestUserPrincipal() {
+ return testUserPrincipal;
+ }
+
+ protected void initKerberos() throws Exception {
+ if (conf == null) {
+ conf = createOzoneConfig();
+ }
+ startMiniKdc();
+ setSecureConfig();
+ createCredentialsInKDC();
+ }
+
+ protected void startMiniKdc() throws Exception {
+ if (workDir == null) {
+ workDir = Files.createTempDirectory("kerberos").toFile();
+ }
+ Properties securityProperties = MiniKdc.createConf();
+ miniKdc = new MiniKdc(securityProperties, workDir);
+ miniKdc.start();
+ }
+
+ protected void stopMiniKdc() {
+ if (miniKdc != null) {
+ miniKdc.stop();
+ }
+ FileUtils.deleteQuietly(workDir);
+ }
+
+ protected void createPrincipal(File keytab, String... principal)
+ throws Exception {
+ miniKdc.createPrincipal(keytab, principal);
+ }
+
+ protected void setSecureConfig() throws IOException {
+ conf.setBoolean(OZONE_SECURITY_ENABLED_KEY, true);
+ String host = InetAddress.getLocalHost().getCanonicalHostName()
+ .toLowerCase();
+
+ conf.set(HADOOP_SECURITY_AUTHENTICATION, KERBEROS.name());
+
+ String curUser = UserGroupInformation.getCurrentUser().getUserName();
+ conf.set(OZONE_ADMINISTRATORS, curUser);
+
+ String realm = miniKdc.getRealm();
+ String hostAndRealm = host + "@" + realm;
+
+ ozoneKeytab = new File(workDir, "scm.keytab");
+ spnegoKeytab = new File(workDir, "http.keytab");
+
+ if (useSharedServicePrincipal()) {
+ ozonePrincipal = "scm/" + hostAndRealm;
+ conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ conf.set(HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY,
+ ozoneKeytab.getAbsolutePath());
+ } else {
+ ozonePrincipal = "scm/" + hostAndRealm;
+ conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ omKeytab = new File(workDir, "om.keytab");
+ conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, "om/" + hostAndRealm);
+ conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY, omKeytab.getAbsolutePath());
+ }
+
+ conf.set(HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_SCM/" + hostAndRealm);
+ conf.set(OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_OM/" + hostAndRealm);
+ conf.set(HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY,
+ spnegoKeytab.getAbsolutePath());
+ conf.set(OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE,
+ spnegoKeytab.getAbsolutePath());
+
+ if (createTestUserPrincipal()) {
+ testUserKeytab = new File(workDir, "testuser.keytab");
+ testUserPrincipal = "test@" + realm;
+ }
+
+ if (enableSecurityAuthorizationByDefault()) {
+ conf.setBoolean(HADOOP_SECURITY_AUTHORIZATION, true);
+ }
+ }
+
+ protected void createCredentialsInKDC() throws Exception {
+ SCMHTTPServerConfig httpServerConfig =
+ conf.getObject(SCMHTTPServerConfig.class);
+ createPrincipal(ozoneKeytab, conf.get(HDDS_SCM_KERBEROS_PRINCIPAL_KEY));
+ if (!useSharedServicePrincipal()) {
+ createPrincipal(omKeytab, conf.get(OZONE_OM_KERBEROS_PRINCIPAL_KEY));
+ }
+ createPrincipal(spnegoKeytab, httpServerConfig.getKerberosPrincipal());
+ if (createTestUserPrincipal()) {
+ createPrincipal(testUserKeytab, testUserPrincipal);
+ }
+ }
+
+ /** Whether SCM/OM (and optionally DN) share a single "scm/..." principal and keytab. */
+ protected boolean useSharedServicePrincipal() {
+ return true;
+ }
+
+ protected boolean createTestUserPrincipal() {
+ return true;
+ }
+
+ protected boolean enableSecurityAuthorizationByDefault() {
+ return true;
+ }
Review Comment:
Thanks @chungen0126! Replaced the three hooks with protected steps that each subclass's setSecureConfig()/createCredentialsInKDC() calls directly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests [ozone]
Posted by "shuan1026 (via GitHub)" <gi...@apache.org>.
shuan1026 commented on code in PR #10873:
URL: https://github.com/apache/ozone/pull/10873#discussion_r3903905697
##########
hadoop-ozone/integration-test/src/test/java/org/apache/ozone/test/KerberosTests.java:
##########
@@ -0,0 +1,209 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ozone.test;
+
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION;
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHORIZATION;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_CLIENT_ADDRESS_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ADMINISTRATORS;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod.KERBEROS;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.InetAddress;
+import java.nio.file.Files;
+import java.util.Properties;
+import org.apache.commons.io.FileUtils;
+import org.apache.hadoop.hdds.conf.OzoneConfiguration;
+import org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig;
+import org.apache.hadoop.minikdc.MiniKdc;
+import org.apache.hadoop.security.UserGroupInformation;
+
+/**
+ * Shared MiniKdc / Kerberos setup for secure cluster integration tests (HDDS-15913).
+ */
+public abstract class KerberosTests {
+
+ private MiniKdc miniKdc;
+ private OzoneConfiguration conf;
+
+ private File workDir;
+
+ /** Service keytab (scm.keytab); shared by SCM/OM/DN when using {@link #configureSharedServicePrincipal}. */
+ private File ozoneKeytab;
+ private File spnegoKeytab;
+ private File testUserKeytab;
+ private String testUserPrincipal;
+ /** e.g. scm/host@REALM. */
+ private String ozonePrincipal;
+
+ /** Separate OM keytab, only used with {@link #configureSeparateServicePrincipals}. */
+ private File omKeytab;
+
+ protected OzoneConfiguration getConf() {
+ return conf;
+ }
+
+ protected OzoneConfiguration createOzoneConfig() {
+ return new OzoneConfiguration();
+ }
+
+ protected File getOzoneKeytab() {
+ return ozoneKeytab;
+ }
+
+ protected String getOzonePrincipal() {
+ return ozonePrincipal;
+ }
+
+ protected File getTestUserKeytab() {
+ return testUserKeytab;
+ }
+
+ protected String getTestUserPrincipal() {
+ return testUserPrincipal;
+ }
+
+ protected void initKerberos() throws Exception {
+ if (conf == null) {
+ conf = createOzoneConfig();
+ }
+ startMiniKdc();
+ setSecureConfig();
+ createCredentialsInKDC();
+ }
+
+ protected void startMiniKdc() throws Exception {
+ if (workDir == null) {
+ workDir = Files.createTempDirectory("kerberos").toFile();
+ }
+ Properties securityProperties = MiniKdc.createConf();
+ miniKdc = new MiniKdc(securityProperties, workDir);
+ miniKdc.start();
+ }
+
+ protected void stopMiniKdc() {
+ if (miniKdc != null) {
+ miniKdc.stop();
+ }
+ FileUtils.deleteQuietly(workDir);
+ }
+
+ protected void createPrincipal(File keytab, String... principal)
+ throws Exception {
+ miniKdc.createPrincipal(keytab, principal);
+ }
+
+ protected void setSecureConfig() throws IOException {
+ configureSecurityBasics();
+ String host = InetAddress.getLocalHost().getCanonicalHostName()
+ .toLowerCase();
+ String hostAndRealm = host + "@" + getRealm();
+ configureSharedServicePrincipal(hostAndRealm);
+ configureSpnegoPrincipal(hostAndRealm);
+ createTestUserCredentials();
+ conf.setBoolean(HADOOP_SECURITY_AUTHORIZATION, true);
+ }
+
+ protected void createCredentialsInKDC() throws Exception {
+ createScmPrincipalCredential();
+ createSpnegoPrincipalCredential();
+ createTestUserPrincipalCredential();
+ }
+
+ protected String getRealm() {
+ return miniKdc.getRealm();
+ }
+
+ /** Security basics common to every subclass's setSecureConfig(). */
+ protected void configureSecurityBasics() throws IOException {
+ conf.setBoolean(OZONE_SECURITY_ENABLED_KEY, true);
+ conf.set(OZONE_SCM_CLIENT_ADDRESS_KEY, "localhost");
+ conf.set(HADOOP_SECURITY_AUTHENTICATION, KERBEROS.name());
+ String curUser = UserGroupInformation.getCurrentUser().getUserName();
+ conf.set(OZONE_ADMINISTRATORS, curUser);
+ }
+
+ /** SCM/OM/DN share a single "scm/..." principal and keytab. */
+ protected void configureSharedServicePrincipal(String hostAndRealm) {
+ ozonePrincipal = "scm/" + hostAndRealm;
+ ozoneKeytab = new File(workDir, "scm.keytab");
+ conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ conf.set(HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY,
+ ozoneKeytab.getAbsolutePath());
+ }
+
+ /** SCM and OM use separate "scm/..." and "om/..." principals and keytabs. */
+ protected void configureSeparateServicePrincipals(String hostAndRealm) {
+ ozonePrincipal = "scm/" + hostAndRealm;
+ ozoneKeytab = new File(workDir, "scm.keytab");
+ conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ omKeytab = new File(workDir, "om.keytab");
+ conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, "om/" + hostAndRealm);
+ conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY, omKeytab.getAbsolutePath());
+ }
+
+ protected void configureSpnegoPrincipal(String hostAndRealm) {
+ spnegoKeytab = new File(workDir, "http.keytab");
+ conf.set(HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_SCM/" + hostAndRealm);
+ conf.set(OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_OM/" + hostAndRealm);
+ conf.set(HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY,
+ spnegoKeytab.getAbsolutePath());
+ conf.set(OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE,
+ spnegoKeytab.getAbsolutePath());
+ }
+
+ protected void createTestUserCredentials() {
+ testUserKeytab = new File(workDir, "testuser.keytab");
+ testUserPrincipal = "test@" + getRealm();
+ }
+
+ protected void createScmPrincipalCredential() throws Exception {
+ createPrincipal(ozoneKeytab, conf.get(HDDS_SCM_KERBEROS_PRINCIPAL_KEY));
+ }
+
+ protected void createOmPrincipalCredential() throws Exception {
+ createPrincipal(omKeytab, conf.get(OZONE_OM_KERBEROS_PRINCIPAL_KEY));
+ }
+
+ protected void createSpnegoPrincipalCredential() throws Exception {
+ SCMHTTPServerConfig httpServerConfig =
+ conf.getObject(SCMHTTPServerConfig.class);
+ createPrincipal(spnegoKeytab, httpServerConfig.getKerberosPrincipal());
+ }
+
+ protected void createTestUserPrincipalCredential() throws Exception {
+ createPrincipal(testUserKeytab, testUserPrincipal);
+ }
Review Comment:
thank for the review!
Base createCredentialsInKDC() calls createPrincipal directly for whichever keytabs setSecureConfig() populated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests [ozone]
Posted by "chihsuan (via GitHub)" <gi...@apache.org>.
chihsuan commented on code in PR #10873:
URL: https://github.com/apache/ozone/pull/10873#discussion_r3694541370
##########
hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/TestSecretKeysApi.java:
##########
@@ -183,11 +98,11 @@ public void testSecretKeyApiSuccess() throws Exception {
enableBlockToken();
// set a low rotation period, of 1s, expiry is 3s, expect 3 active keys
// at any moment.
- conf.set(HDDS_SECRET_KEY_ROTATE_CHECK_DURATION, "100ms");
- conf.set(HDDS_SECRET_KEY_ROTATE_DURATION, "1s");
- conf.set(HDDS_SECRET_KEY_EXPIRY_DURATION, "3000ms");
- conf.set(DELEGATION_TOKEN_MAX_LIFETIME_KEY, "1500ms");
- conf.set(DELEGATION_REMOVER_SCAN_INTERVAL_KEY, "100ms");
+ getConf().set(HDDS_SECRET_KEY_ROTATE_CHECK_DURATION, "100ms");
+ getConf().set(HDDS_SECRET_KEY_ROTATE_DURATION, "1s");
+ getConf().set(HDDS_SECRET_KEY_EXPIRY_DURATION, "3000ms");
+ getConf().set(DELEGATION_TOKEN_MAX_LIFETIME_KEY, "1500ms");
+ getConf().set(DELEGATION_REMOVER_SCAN_INTERVAL_KEY, "100ms");
Review Comment:
nit: Suggest assigning `getConf()` to a local conf variable to reduce the mechanical diff here and in similar places when it is used repeatedly.
##########
hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/AbstractKerberosTest.java:
##########
@@ -0,0 +1,199 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hadoop.ozone;
+
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION;
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHORIZATION;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ADMINISTRATORS;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod.KERBEROS;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.InetAddress;
+import java.nio.file.Files;
+import java.util.Properties;
+import org.apache.commons.io.FileUtils;
+import org.apache.hadoop.hdds.conf.OzoneConfiguration;
+import org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig;
+import org.apache.hadoop.minikdc.MiniKdc;
+import org.apache.hadoop.security.UserGroupInformation;
+
+/**
+ * Shared MiniKdc / Kerberos setup for secure cluster integration tests (HDDS-15913).
+ */
+public abstract class AbstractKerberosTest {
Review Comment:
Maybe rename this to `KerberosTests` to follow the convention introduced in [#10672](https://github.com/apache/ozone/pull/10672)?
I wonder whether it should also live under `org.apache.ozone.test`, alongside the other shared test fixtures. cc @adoroszlai for your thoughts. 🙏
##########
hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/AbstractKerberosTest.java:
##########
@@ -0,0 +1,199 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hadoop.ozone;
+
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION;
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHORIZATION;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ADMINISTRATORS;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod.KERBEROS;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.InetAddress;
+import java.nio.file.Files;
+import java.util.Properties;
+import org.apache.commons.io.FileUtils;
+import org.apache.hadoop.hdds.conf.OzoneConfiguration;
+import org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig;
+import org.apache.hadoop.minikdc.MiniKdc;
+import org.apache.hadoop.security.UserGroupInformation;
+
+/**
+ * Shared MiniKdc / Kerberos setup for secure cluster integration tests (HDDS-15913).
+ */
+public abstract class AbstractKerberosTest {
+
+ private MiniKdc miniKdc;
+ private OzoneConfiguration conf;
+
+ private File workDir;
+
+ /** Service keytab (scm.keytab); shared by SCM/OM/DN when useSharedServicePrincipal(). */
+ private File ozoneKeytab;
+ private File spnegoKeytab;
+ private File testUserKeytab;
+ private String testUserPrincipal;
+ /** e.g. scm/host@REALM when useSharedServicePrincipal(). */
+ private String ozonePrincipal;
+
+ /** Separate OM keytab, only used when useSharedServicePrincipal() is false. */
+ private File omKeytab;
+
+ protected OzoneConfiguration getConf() {
+ return conf;
+ }
+
+ protected void setConf(OzoneConfiguration conf) {
+ this.conf = conf;
+ }
+
+ protected File getOzoneKeytab() {
+ return ozoneKeytab;
+ }
+
+ protected String getOzonePrincipal() {
+ return ozonePrincipal;
+ }
+
+ protected File getTestUserKeytab() {
+ return testUserKeytab;
+ }
+
+ protected String getTestUserPrincipal() {
+ return testUserPrincipal;
+ }
+
+ protected void initKerberos() throws Exception {
+ startMiniKdc();
+ setSecureConfig();
+ createCredentialsInKDC();
+ }
+
+ protected void startMiniKdc() throws Exception {
+ if (workDir == null) {
+ workDir = Files.createTempDirectory("kerberos").toFile();
+ }
+ Properties securityProperties = MiniKdc.createConf();
+ miniKdc = new MiniKdc(securityProperties, workDir);
+ miniKdc.start();
+ }
+
+ protected void stopMiniKdc() {
+ if (miniKdc != null) {
+ miniKdc.stop();
+ }
+ FileUtils.deleteQuietly(workDir);
+ }
+
+ protected void createPrincipal(File keytab, String... principal)
+ throws Exception {
+ miniKdc.createPrincipal(keytab, principal);
+ }
+
+ protected void setSecureConfig() throws IOException {
+ conf.setBoolean(OZONE_SECURITY_ENABLED_KEY, true);
+ String host = InetAddress.getLocalHost().getCanonicalHostName()
+ .toLowerCase();
+
+ conf.set(HADOOP_SECURITY_AUTHENTICATION, kerberosAuthenticationValue());
+
+ String curUser = UserGroupInformation.getCurrentUser().getUserName();
+ conf.set(OZONE_ADMINISTRATORS, curUser);
+
+ String realm = miniKdc.getRealm();
+ String hostAndRealm = host + "@" + realm;
+
+ ozoneKeytab = new File(workDir, "scm.keytab");
+ spnegoKeytab = new File(workDir, "http.keytab");
+
+ if (useSharedServicePrincipal()) {
+ ozonePrincipal = "scm/" + hostAndRealm;
+ conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ conf.set(HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY,
+ ozoneKeytab.getAbsolutePath());
+ } else {
+ ozonePrincipal = "scm/" + hostAndRealm;
+ conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ omKeytab = new File(workDir, "om.keytab");
+ conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, "om/" + hostAndRealm);
+ conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY, omKeytab.getAbsolutePath());
+ }
+
+ conf.set(HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_SCM/" + hostAndRealm);
+ conf.set(OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_OM/" + hostAndRealm);
+ conf.set(HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY,
+ spnegoKeytab.getAbsolutePath());
+ conf.set(OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE,
+ spnegoKeytab.getAbsolutePath());
+
+ if (createTestUserPrincipal()) {
+ testUserKeytab = new File(workDir, "testuser.keytab");
+ testUserPrincipal = "test@" + realm;
+ }
+
+ if (enableSecurityAuthorizationByDefault()) {
+ conf.setBoolean(HADOOP_SECURITY_AUTHORIZATION, true);
+ }
+ }
+
+ protected void createCredentialsInKDC() throws Exception {
+ SCMHTTPServerConfig httpServerConfig =
+ conf.getObject(SCMHTTPServerConfig.class);
+ createPrincipal(ozoneKeytab, conf.get(HDDS_SCM_KERBEROS_PRINCIPAL_KEY));
+ if (!useSharedServicePrincipal()) {
+ createPrincipal(omKeytab, conf.get(OZONE_OM_KERBEROS_PRINCIPAL_KEY));
+ }
+ createPrincipal(spnegoKeytab, httpServerConfig.getKerberosPrincipal());
+ if (createTestUserPrincipal()) {
+ createPrincipal(testUserKeytab, testUserPrincipal);
+ }
+ }
+
+ /** Whether SCM/OM (and optionally DN) share a single "scm/..." principal and keytab. */
+ protected boolean useSharedServicePrincipal() {
+ return true;
+ }
+
+ protected boolean createTestUserPrincipal() {
+ return true;
+ }
+
+ protected boolean enableSecurityAuthorizationByDefault() {
+ return true;
+ }
+
+ protected String kerberosAuthenticationValue() {
+ return KERBEROS.name();
Review Comment:
nit: I understand the intent here is to keep the migration byte-for-byte, but since we're updating this, it might be worth dropping this hook and using `KERBEROS.name()` unconditionally, since authentication parsing is case-insensitive. Fine to keep the existing literals in this PR.
##########
hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/AbstractKerberosTest.java:
##########
@@ -0,0 +1,199 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hadoop.ozone;
+
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION;
+import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHORIZATION;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ADMINISTRATORS;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod.KERBEROS;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.InetAddress;
+import java.nio.file.Files;
+import java.util.Properties;
+import org.apache.commons.io.FileUtils;
+import org.apache.hadoop.hdds.conf.OzoneConfiguration;
+import org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig;
+import org.apache.hadoop.minikdc.MiniKdc;
+import org.apache.hadoop.security.UserGroupInformation;
+
+/**
+ * Shared MiniKdc / Kerberos setup for secure cluster integration tests (HDDS-15913).
+ */
+public abstract class AbstractKerberosTest {
+
+ private MiniKdc miniKdc;
+ private OzoneConfiguration conf;
+
+ private File workDir;
+
+ /** Service keytab (scm.keytab); shared by SCM/OM/DN when useSharedServicePrincipal(). */
+ private File ozoneKeytab;
+ private File spnegoKeytab;
+ private File testUserKeytab;
+ private String testUserPrincipal;
+ /** e.g. scm/host@REALM when useSharedServicePrincipal(). */
+ private String ozonePrincipal;
+
+ /** Separate OM keytab, only used when useSharedServicePrincipal() is false. */
+ private File omKeytab;
+
+ protected OzoneConfiguration getConf() {
+ return conf;
+ }
+
+ protected void setConf(OzoneConfiguration conf) {
Review Comment:
Could the base class create the configuration via a `createOzoneConfig()` hook instead? `setConf()` requires every subclass to initialize it correctly and may otherwise cause an NPE.
##########
hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestSecureOzoneCluster.java:
##########
@@ -163,14 +156,16 @@
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestInstance;
import org.junit.jupiter.api.io.TempDir;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
/**
* Test class to for security enabled Ozone cluster.
*/
-final class TestSecureOzoneCluster {
+@TestInstance(TestInstance.Lifecycle.PER_CLASS)
Review Comment:
`PER_CLASS` also shares scm, om, and omClient across tests. Could we reset these fields after each test, or keep only the KDC class-scoped?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests [ozone]
Posted by "shuan1026 (via GitHub)" <gi...@apache.org>.
shuan1026 commented on code in PR #10873:
URL: https://github.com/apache/ozone/pull/10873#discussion_r3777390214
##########
hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/TestSecretKeySnapshot.java:
##########
@@ -87,24 +67,26 @@ public final class TestSecretKeySnapshot {
public static final int ROTATE_DURATION_MS = 30_000;
public static final int EXPIRY_DURATION_MS = 61_000;
- private MiniKdc miniKdc;
- private OzoneConfiguration conf;
- @TempDir
- private File workDir;
- private File ozoneKeytab;
- private File spnegoKeytab;
private MiniOzoneHAClusterImpl cluster;
+ @Override
+ protected boolean createTestUserPrincipal() {
+ return false;
+ }
+
+ @Override
+ protected boolean enableSecurityAuthorizationByDefault() {
+ return false;
+ }
+
@BeforeEach
public void init() throws Exception {
- conf = new OzoneConfiguration();
- conf.set(OZONE_SCM_CLIENT_ADDRESS_KEY, "localhost");
-
ExitUtils.disableSystemExit();
- startMiniKdc();
- setSecureConfig();
- createCredentialsInKDC();
+ initKerberos();
+ OzoneConfiguration conf = getConf();
+ conf.set(OZONE_SCM_CLIENT_ADDRESS_KEY, "localhost");
Review Comment:
Thanks @yandrey321! Moved it into the base's configureSecurityBasics().
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests [ozone]
Posted by "shuan1026 (via GitHub)" <gi...@apache.org>.
shuan1026 commented on PR #10873:
URL: https://github.com/apache/ozone/pull/10873#issuecomment-5513011948
Thanks for the review @yandrey321!
you're right, the constructor is the better place, conf is now a final field initialized at construction.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org