You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@flink.apache.org by gy...@apache.org on 2021/08/11 13:21:46 UTC
[flink] branch master updated (6ded624 -> f22b6dd)
This is an automated email from the ASF dual-hosted git repository.
gyfora pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/flink.git.
from 6ded624 [FLINK-23695][runtime] Fix DispatcherFailoverITCase so it works with the AdaptiveScheduler.
new 0a0e37e [FLINK-23688][hadoop] Make JaasModule.getAppConfigurationEntries public
new f22b6dd [FLINK-23693][tests] Add principal creation possibilities to SecureTestEnvironment
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../flink/runtime/security/KerberosUtils.java | 12 +++++
.../flink/runtime/security/modules/JaasModule.java | 2 +-
.../flink/test/util/SecureTestEnvironment.java | 60 ++++++++++++++--------
3 files changed, 52 insertions(+), 22 deletions(-)
[flink] 01/02: [FLINK-23688][hadoop] Make
JaasModule.getAppConfigurationEntries public
Posted by gy...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
gyfora pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/flink.git
commit 0a0e37e6f2656c99a01305d9e736cea8d8a9febd
Author: Gabor Somogyi <ga...@gmail.com>
AuthorDate: Mon Aug 9 12:49:15 2021 +0200
[FLINK-23688][hadoop] Make JaasModule.getAppConfigurationEntries public
Closes #16758
---
.../main/java/org/apache/flink/runtime/security/modules/JaasModule.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flink-runtime/src/main/java/org/apache/flink/runtime/security/modules/JaasModule.java b/flink-runtime/src/main/java/org/apache/flink/runtime/security/modules/JaasModule.java
index 4f6c4e5..a498619 100644
--- a/flink-runtime/src/main/java/org/apache/flink/runtime/security/modules/JaasModule.java
+++ b/flink-runtime/src/main/java/org/apache/flink/runtime/security/modules/JaasModule.java
@@ -125,7 +125,7 @@ public class JaasModule implements SecurityModule {
return currentConfig;
}
- private static AppConfigurationEntry[] getAppConfigurationEntries(
+ public static AppConfigurationEntry[] getAppConfigurationEntries(
SecurityConfiguration securityConfig) {
AppConfigurationEntry userKerberosAce = null;
[flink] 02/02: [FLINK-23693][tests] Add principal creation
possibilities to SecureTestEnvironment
Posted by gy...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
gyfora pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/flink.git
commit f22b6ddc08dcd046458b4aeebfe828073410952a
Author: Gabor Somogyi <ga...@gmail.com>
AuthorDate: Mon Aug 9 17:39:42 2021 +0200
[FLINK-23693][tests] Add principal creation possibilities to SecureTestEnvironment
Closes #16764
---
.../flink/runtime/security/KerberosUtils.java | 12 +++++
.../flink/test/util/SecureTestEnvironment.java | 60 ++++++++++++++--------
2 files changed, 51 insertions(+), 21 deletions(-)
diff --git a/flink-runtime/src/main/java/org/apache/flink/runtime/security/KerberosUtils.java b/flink-runtime/src/main/java/org/apache/flink/runtime/security/KerberosUtils.java
index 36ce851..3b44164 100644
--- a/flink-runtime/src/main/java/org/apache/flink/runtime/security/KerberosUtils.java
+++ b/flink-runtime/src/main/java/org/apache/flink/runtime/security/KerberosUtils.java
@@ -45,6 +45,8 @@ public class KerberosUtils {
private static final boolean IBM_JAVA;
+ private static final String DEFAULT_KERBEROS_INIT_APP_ENTRY_NAME;
+
private static final Map<String, String> debugOptions = new HashMap<>();
private static final Map<String, String> kerberosCacheOptions = new HashMap<>();
@@ -58,9 +60,19 @@ public class KerberosUtils {
: "com.sun.security.auth.module.Krb5LoginModule";
}
+ public static String getDefaultKerberosInitAppEntryName() {
+ return DEFAULT_KERBEROS_INIT_APP_ENTRY_NAME;
+ }
+
static {
IBM_JAVA = JAVA_VENDOR_NAME.contains("IBM");
+ if (IBM_JAVA) {
+ DEFAULT_KERBEROS_INIT_APP_ENTRY_NAME = "com.ibm.security.jgss.krb5.initiate";
+ } else {
+ DEFAULT_KERBEROS_INIT_APP_ENTRY_NAME = "com.sun.security.jgss.krb5.initiate";
+ }
+
if (LOG.isDebugEnabled()) {
debugOptions.put("debug", "true");
}
diff --git a/flink-test-utils-parent/flink-test-utils/src/main/java/org/apache/flink/test/util/SecureTestEnvironment.java b/flink-test-utils-parent/flink-test-utils/src/main/java/org/apache/flink/test/util/SecureTestEnvironment.java
index bd09896..9dffa0b 100644
--- a/flink-test-utils-parent/flink-test-utils/src/main/java/org/apache/flink/test/util/SecureTestEnvironment.java
+++ b/flink-test-utils-parent/flink-test-utils/src/main/java/org/apache/flink/test/util/SecureTestEnvironment.java
@@ -21,8 +21,10 @@ package org.apache.flink.test.util;
import org.apache.flink.configuration.Configuration;
import org.apache.flink.configuration.GlobalConfiguration;
import org.apache.flink.configuration.SecurityOptions;
+import org.apache.flink.runtime.security.KerberosUtils;
import org.apache.flink.runtime.security.SecurityConfiguration;
+import org.apache.commons.lang3.ArrayUtils;
import org.apache.hadoop.minikdc.MiniKdc;
import org.junit.rules.TemporaryFolder;
import org.slf4j.Logger;
@@ -35,6 +37,9 @@ import java.util.HashMap;
import java.util.Map;
import java.util.Properties;
+import static org.apache.flink.util.Preconditions.checkArgument;
+import static org.apache.flink.util.Preconditions.checkNotNull;
+
/**
* Helper {@link SecureTestEnvironment} to handle MiniKDC lifecycle. This class can be used to
* start/stop MiniKDC and create secure configurations for MiniDFSCluster and MiniYarn.
@@ -75,12 +80,12 @@ public class SecureTestEnvironment {
protected static final Logger LOG = LoggerFactory.getLogger(SecureTestEnvironment.class);
+ public static final String HOST_NAME = "localhost";
+
private static MiniKdc kdc;
private static String testKeytab = null;
- private static String testPrincipal = null;
-
private static String testZkServerPrincipal = null;
private static String testZkClientPrincipal = null;
@@ -89,43 +94,47 @@ public class SecureTestEnvironment {
private static String hadoopServicePrincipal = null;
- public static void prepare(TemporaryFolder tempFolder) {
+ private static String testPrincipal = null;
+
+ public static void prepare(TemporaryFolder tempFolder, String... additionalPrincipals) {
+ checkArgument(additionalPrincipals != null, "Valid principals must be provided");
try {
File baseDirForSecureRun = tempFolder.newFolder();
LOG.info("Base Directory for Secure Environment: {}", baseDirForSecureRun);
- String hostName = "localhost";
Properties kdcConf = MiniKdc.createConf();
if (LOG.isDebugEnabled()) {
kdcConf.setProperty(MiniKdc.DEBUG, "true");
}
- kdcConf.setProperty(MiniKdc.KDC_BIND_ADDRESS, hostName);
+ kdcConf.setProperty(MiniKdc.KDC_BIND_ADDRESS, HOST_NAME);
kdc = new MiniKdc(kdcConf, baseDirForSecureRun);
kdc.start();
LOG.info("Started Mini KDC");
File keytabFile = new File(baseDirForSecureRun, "test-users.keytab");
testKeytab = keytabFile.getAbsolutePath();
- testZkServerPrincipal = "zookeeper/" + hostName;
- testZkClientPrincipal = "zk-client/" + hostName;
- testKafkaServerPrincipal = "kafka/" + hostName;
- hadoopServicePrincipal = "hadoop/" + hostName;
- testPrincipal = "client/" + hostName;
-
- kdc.createPrincipal(
- keytabFile,
- testPrincipal,
- testZkServerPrincipal,
- hadoopServicePrincipal,
- testZkClientPrincipal,
- testKafkaServerPrincipal);
+ testZkServerPrincipal = "zookeeper/" + HOST_NAME;
+ testZkClientPrincipal = "zk-client/" + HOST_NAME;
+ testKafkaServerPrincipal = "kafka/" + HOST_NAME;
+ hadoopServicePrincipal = "hadoop/" + HOST_NAME;
+ testPrincipal = "client/" + HOST_NAME;
+
+ String[] embeddedPrincipals = {
+ testZkServerPrincipal,
+ testZkClientPrincipal,
+ testKafkaServerPrincipal,
+ hadoopServicePrincipal,
+ testPrincipal
+ };
+ String[] principals = ArrayUtils.addAll(embeddedPrincipals, additionalPrincipals);
+ kdc.createPrincipal(keytabFile, principals);
- testPrincipal = testPrincipal + "@" + kdc.getRealm();
testZkServerPrincipal = testZkServerPrincipal + "@" + kdc.getRealm();
testZkClientPrincipal = testZkClientPrincipal + "@" + kdc.getRealm();
testKafkaServerPrincipal = testKafkaServerPrincipal + "@" + kdc.getRealm();
hadoopServicePrincipal = hadoopServicePrincipal + "@" + kdc.getRealm();
+ testPrincipal = testPrincipal + "@" + kdc.getRealm();
LOG.info("-------------------------------------------------------------------");
LOG.info("Test Principal: {}", testPrincipal);
@@ -146,7 +155,9 @@ public class SecureTestEnvironment {
flinkConfig.setString(SecurityOptions.KERBEROS_LOGIN_KEYTAB, testKeytab);
flinkConfig.setBoolean(SecurityOptions.KERBEROS_LOGIN_USETICKETCACHE, false);
flinkConfig.setString(SecurityOptions.KERBEROS_LOGIN_PRINCIPAL, testPrincipal);
- flinkConfig.setString(SecurityOptions.KERBEROS_LOGIN_CONTEXTS, "Client,KafkaClient");
+ flinkConfig.setString(
+ SecurityOptions.KERBEROS_LOGIN_CONTEXTS,
+ "Client,KafkaClient," + KerberosUtils.getDefaultKerberosInitAppEntryName());
SecurityConfiguration ctx = new SecurityConfiguration(flinkConfig);
TestingSecurityContext.install(ctx, getClientSecurityConfigurationMap());
@@ -169,9 +180,11 @@ public class SecureTestEnvironment {
resetSystemEnvVariables();
testKeytab = null;
- testPrincipal = null;
testZkServerPrincipal = null;
+ testZkClientPrincipal = null;
+ testKafkaServerPrincipal = null;
hadoopServicePrincipal = null;
+ testPrincipal = null;
}
private static void populateJavaPropertyVariables() {
@@ -245,6 +258,11 @@ public class SecureTestEnvironment {
return clientSecurityConfigurationMap;
}
+ public static String getRealm() {
+ checkNotNull(kdc, "KDC must be initialized");
+ return kdc.getRealm();
+ }
+
public static String getTestKeytab() {
return testKeytab;
}