svn commit: r1378142 - /hbase/trunk/hbase-server/src/main/java/org/apache/hadoop/hbase/security/token/TokenProvider.java

[te...@apache.org]

Author: tedyu
Date: Tue Aug 28 14:05:45 2012
New Revision: 1378142

URL: http://svn.apache.org/viewvc?rev=1378142&view=rev
Log:
HBASE-6671 Kerberos authenticated super user should be able to retrieve proxied delegation tokens (Francis)


Modified:
    hbase/trunk/hbase-server/src/main/java/org/apache/hadoop/hbase/security/token/TokenProvider.java

Modified: hbase/trunk/hbase-server/src/main/java/org/apache/hadoop/hbase/security/token/TokenProvider.java
URL: http://svn.apache.org/viewvc/hbase/trunk/hbase-server/src/main/java/org/apache/hadoop/hbase/security/token/TokenProvider.java?rev=1378142&r1=1378141&r2=1378142&view=diff
==============================================================================
--- hbase/trunk/hbase-server/src/main/java/org/apache/hadoop/hbase/security/token/TokenProvider.java (original)
+++ hbase/trunk/hbase-server/src/main/java/org/apache/hadoop/hbase/security/token/TokenProvider.java Tue Aug 28 14:05:45 2012
@@ -31,6 +31,7 @@ import org.apache.hadoop.hbase.ipc.RpcSe
 import org.apache.hadoop.hbase.security.AccessDeniedException;
 import org.apache.hadoop.hbase.security.User;
 import org.apache.hadoop.security.UserGroupInformation;
+import org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod;
 import org.apache.hadoop.security.token.SecretManager;
 import org.apache.hadoop.security.token.Token;
 
@@ -78,8 +79,7 @@ public class TokenProvider extends BaseE
     }
     if (currentUser == null) {
       throw new AccessDeniedException("No authenticated user for request!");
-    } else if (ugi.getAuthenticationMethod() !=
-        UserGroupInformation.AuthenticationMethod.KERBEROS) {
+    } else if (!isAllowedDelegationTokenOp(ugi)) {
       LOG.warn("Token generation denied for user="+currentUser.getName()
           +", authMethod="+ugi.getAuthenticationMethod());
       throw new AccessDeniedException(
@@ -89,6 +89,23 @@ public class TokenProvider extends BaseE
     return secretManager.generateToken(currentUser.getName());
   }
 
+  /**
+   * @param ugi
+   * @return true if delegation token operation is allowed
+   */
+  private boolean isAllowedDelegationTokenOp(UserGroupInformation ugi) throws IOException {
+    AuthenticationMethod authMethod = ugi.getAuthenticationMethod();
+    if (authMethod == AuthenticationMethod.PROXY) {
+      authMethod = ugi.getRealUser().getAuthenticationMethod();
+    }
+    if (authMethod != AuthenticationMethod.KERBEROS
+        && authMethod != AuthenticationMethod.KERBEROS_SSL
+        && authMethod != AuthenticationMethod.CERTIFICATE) {
+      return false;
+    }
+    return true;
+  }
+
   @Override
   public String whoami() {
     return RequestContext.getRequestUserName();