You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by vv...@apache.org on 2017/01/30 06:04:12 UTC
[20/52] [abbrv] hadoop git commit: HADOOP-13988. KMSClientProvider
does not work with WebHDFS and Apache Knox w/ProxyUser. Contributed by Greg
Senia and Xiaoyu Yao.
HADOOP-13988. KMSClientProvider does not work with WebHDFS and Apache Knox w/ProxyUser. Contributed by Greg Senia and Xiaoyu Yao.
Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo
Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/a46933e8
Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/a46933e8
Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/a46933e8
Branch: refs/heads/YARN-3926
Commit: a46933e8ce4c1715c11e3e3283bf0e8c2b53b837
Parents: 7fc3e68
Author: Xiaoyu Yao <xy...@apache.org>
Authored: Wed Jan 25 13:26:50 2017 -0800
Committer: Xiaoyu Yao <xy...@apache.org>
Committed: Wed Jan 25 13:33:06 2017 -0800
----------------------------------------------------------------------
.../hadoop/crypto/key/kms/KMSClientProvider.java | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hadoop/blob/a46933e8/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java
index df6768d..ccc8968 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java
@@ -1071,10 +1071,9 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension,
return dtService;
}
- private boolean currentUgiContainsKmsDt() throws IOException {
- // Add existing credentials from current UGI, since provider is cached.
- Credentials creds = UserGroupInformation.getCurrentUser().
- getCredentials();
+ private boolean containsKmsDt(UserGroupInformation ugi) throws IOException {
+ // Add existing credentials from the UGI, since provider is cached.
+ Credentials creds = ugi.getCredentials();
if (!creds.getAllTokens().isEmpty()) {
org.apache.hadoop.security.token.Token<? extends TokenIdentifier>
dToken = creds.getToken(getDelegationTokenService());
@@ -1096,11 +1095,15 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension,
if (currentUgi.getRealUser() != null) {
// Use real user for proxy user
actualUgi = currentUgi.getRealUser();
- } else if (!currentUgiContainsKmsDt() &&
- !currentUgi.hasKerberosCredentials()) {
+ }
+
+ if (!containsKmsDt(actualUgi) &&
+ !actualUgi.hasKerberosCredentials()) {
// Use login user for user that does not have either
// Kerberos credential or KMS delegation token for KMS operations
- actualUgi = currentUgi.getLoginUser();
+ LOG.debug("using loginUser no KMS Delegation Token "
+ + "no Kerberos Credentials");
+ actualUgi = UserGroupInformation.getLoginUser();
}
return actualUgi;
}
---------------------------------------------------------------------
To unsubscribe, e-mail: common-commits-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-commits-help@hadoop.apache.org