You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@storm.apache.org by bo...@apache.org on 2018/09/07 21:32:00 UTC
[1/3] storm git commit: STORM-3215: Add back in impersonation to UI
Repository: storm
Updated Branches:
refs/heads/master bc06df529 -> f2ced23fa
STORM-3215: Add back in impersonation to UI
Project: http://git-wip-us.apache.org/repos/asf/storm/repo
Commit: http://git-wip-us.apache.org/repos/asf/storm/commit/4300e944
Tree: http://git-wip-us.apache.org/repos/asf/storm/tree/4300e944
Diff: http://git-wip-us.apache.org/repos/asf/storm/diff/4300e944
Branch: refs/heads/master
Commit: 4300e944a0d453191c23ef4d818956a8f84eb5f0
Parents: 17a69e0
Author: Robert (Bobby) Evans <ev...@yahoo-inc.com>
Authored: Thu Sep 6 10:57:05 2018 -0500
Committer: Robert (Bobby) Evans <ev...@yahoo-inc.com>
Committed: Thu Sep 6 10:57:05 2018 -0500
----------------------------------------------------------------------
.../org/apache/storm/utils/NimbusClient.java | 123 ++++++++++++++++---
.../auth/DefaultHttpCredentialsPlugin.java | 22 ++--
.../apache/storm/daemon/ui/TestingFilter.java | 74 +++++++++++
3 files changed, 194 insertions(+), 25 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/storm/blob/4300e944/storm-client/src/jvm/org/apache/storm/utils/NimbusClient.java
----------------------------------------------------------------------
diff --git a/storm-client/src/jvm/org/apache/storm/utils/NimbusClient.java b/storm-client/src/jvm/org/apache/storm/utils/NimbusClient.java
index 47ccbe1..008d589 100644
--- a/storm-client/src/jvm/org/apache/storm/utils/NimbusClient.java
+++ b/storm-client/src/jvm/org/apache/storm/utils/NimbusClient.java
@@ -22,12 +22,15 @@ import org.apache.storm.generated.NimbusSummary;
import org.apache.storm.security.auth.ReqContext;
import org.apache.storm.security.auth.ThriftClient;
import org.apache.storm.security.auth.ThriftConnectionType;
-import org.apache.storm.shade.com.google.common.collect.Lists;
-import org.apache.storm.shade.org.apache.commons.lang.StringUtils;
import org.apache.storm.thrift.transport.TTransportException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+/**
+ * Client used for connecting to nimbus. Typically you want to use a variant of the
+ * `getConfiguredClient` static method to get a client to use, as directly putting in
+ * a host and port does not support nimbus high availability.
+ */
public class NimbusClient extends ThriftClient {
private static final Logger LOG = LoggerFactory.getLogger(NimbusClient.class);
private static volatile Nimbus.Iface _localOverrideClient = null;
@@ -35,61 +38,112 @@ public class NimbusClient extends ThriftClient {
/**
* Indicates if this is a special client that is overwritten for local mode.
*/
- public final boolean _isLocal;
- private Nimbus.Iface _client;
+ public final boolean isLocal;
+ private final Nimbus.Iface client;
+ /**
+ * Constructor, Please try to use `getConfiguredClient` instead of calling this directly.
+ * @param conf the conf for the client.
+ * @param host the host the client is to talk to.
+ * @param port the port the client is to talk to.
+ * @throws TTransportException on any error.
+ */
+ @Deprecated
public NimbusClient(Map<String, Object> conf, String host, int port) throws TTransportException {
this(conf, host, port, null, null);
}
+ /**
+ * Constructor, Please try to use `getConfiguredClient` instead of calling this directly.
+ * @param conf the conf for the client.
+ * @param host the host the client is to talk to.
+ * @param port the port the client is to talk to.
+ * @param timeout the timeout to use when connecting.
+ * @throws TTransportException on any error.
+ */
public NimbusClient(Map<String, Object> conf, String host, int port, Integer timeout) throws TTransportException {
super(conf, ThriftConnectionType.NIMBUS, host, port, timeout, null);
- _client = new Nimbus.Client(_protocol);
- _isLocal = false;
+ client = new Nimbus.Client(_protocol);
+ isLocal = false;
}
+ /**
+ * Constructor, Please try to use `getConfiguredClientAs` instead of calling this directly.
+ * @param conf the conf for the client.
+ * @param host the host the client is to talk to.
+ * @param port the port the client is to talk to.
+ * @param timeout the timeout to use when connecting.
+ * @param asUser the name of the user you want to impersonate (use with caution as it is not always supported).
+ * @throws TTransportException on any error.
+ */
public NimbusClient(Map<String, Object> conf, String host, Integer port, Integer timeout, String asUser) throws TTransportException {
super(conf, ThriftConnectionType.NIMBUS, host, port, timeout, asUser);
- _client = new Nimbus.Client(_protocol);
- _isLocal = false;
+ client = new Nimbus.Client(_protocol);
+ isLocal = false;
}
+ /**
+ * Constructor, Please try to use `getConfiguredClient` instead of calling this directly.
+ * @param conf the conf for the client.
+ * @param host the host the client is to talk to.
+ * @throws TTransportException on any error.
+ */
public NimbusClient(Map<String, Object> conf, String host) throws TTransportException {
super(conf, ThriftConnectionType.NIMBUS, host, null, null, null);
- _client = new Nimbus.Client(_protocol);
- _isLocal = false;
+ client = new Nimbus.Client(_protocol);
+ isLocal = false;
}
private NimbusClient(Nimbus.Iface client) {
super(new HashMap<>(), ThriftConnectionType.LOCAL_FAKE, "localhost", null, null, null);
- _client = client;
- _isLocal = true;
+ this.client = client;
+ isLocal = true;
}
/**
+ * Is the local override set or not.
* @return true of new clients will be overridden to connect to a local cluster and not the configured remote cluster.
*/
public static boolean isLocalOverride() {
return _localOverrideClient != null;
}
+ /**
+ * Execute cb with a configured nimbus client that will be closed one cb returns.
+ * @param cb the callback to send to nimbus.
+ * @throws Exception on any kind of error.
+ */
public static void withConfiguredClient(WithNimbus cb) throws Exception {
withConfiguredClient(cb, ConfigUtils.readStormConfig());
}
+ /**
+ * Execute cb with a configured nimbus client that will be closed one cb returns.
+ * @param cb the callback to send to nimbus.
+ * @param conf the conf to use instead of reading the global storm conf.
+ * @throws Exception on any kind of error.
+ */
public static void withConfiguredClient(WithNimbus cb, Map<String, Object> conf) throws Exception {
- ReqContext context = ReqContext.context();
- Principal principal = context.principal();
- String user = principal == null ? null : principal.getName();
- try (NimbusClient client = getConfiguredClientAs(conf, user);) {
+ try (NimbusClient client = getConfiguredClientAs(conf, null)) {
cb.run(client.getClient());
}
}
+ /**
+ * Get a nimbus client as configured by conf.
+ * @param conf the configuration to use.
+ * @return the client, don't forget to close it when done.
+ */
public static NimbusClient getConfiguredClient(Map<String, Object> conf) {
return getConfiguredClientAs(conf, null);
}
+ /**
+ * Get a nimbus client as configured by conf.
+ * @param conf the configuration to use.
+ * @param timeout the timeout to use when connecting.
+ * @return the client, don't forget to close it when done.
+ */
public static NimbusClient getConfiguredClient(Map<String, Object> conf, Integer timeout) {
return getConfiguredClientAs(conf, null, timeout);
}
@@ -115,10 +169,23 @@ public class NimbusClient extends ThriftClient {
return true;
}
+ /**
+ * Get a nimbus client as configured by conf.
+ * @param conf the configuration to use.
+ * @param asUser the user to impersonate (this does not always work).
+ * @return the client, don't forget to close it when done.
+ */
public static NimbusClient getConfiguredClientAs(Map<String, Object> conf, String asUser) {
return getConfiguredClientAs(conf, asUser, null);
}
+ /**
+ * Get a nimbus client as configured by conf.
+ * @param conf the configuration to use.
+ * @param asUser the user to impersonate (this does not always work).
+ * @param timeout the timeout to use when connecting.
+ * @return the client, don't forget to close it when done.
+ */
public static NimbusClient getConfiguredClientAs(Map<String, Object> conf, String asUser, Integer timeout) {
Nimbus.Iface override = _localOverrideClient;
if (override != null) {
@@ -136,6 +203,14 @@ public class NimbusClient extends ThriftClient {
asUser = (String) conf.get(Config.STORM_DO_AS_USER);
}
+ if (asUser == null || asUser.isEmpty()) {
+ //The user is not set so lets see what the request context is.
+ ReqContext context = ReqContext.context();
+ Principal principal = context.principal();
+ asUser = principal == null ? null : principal.getName();
+ LOG.debug("Will impersonate {} based off of request context.", asUser);
+ }
+
List<String> seeds = (List<String>) conf.get(Config.NIMBUS_SEEDS);
for (String host : seeds) {
@@ -178,12 +253,24 @@ public class NimbusClient extends ThriftClient {
+ Config.NIMBUS_SEEDS + "?");
}
+ /**
+ * Get the underlying thrift client.
+ * @return the underlying thrift client.
+ */
public Nimbus.Iface getClient() {
- return _client;
+ return client;
}
+ /**
+ * An interface to allow callbacks with a thrift nimbus client.
+ */
public interface WithNimbus {
- public void run(Nimbus.Iface client) throws Exception;
+ /**
+ * Run what you need with the nimbus client.
+ * @param client the client.
+ * @throws Exception on any error.
+ */
+ void run(Nimbus.Iface client) throws Exception;
}
public static final class LocalOverride implements AutoCloseable {
http://git-wip-us.apache.org/repos/asf/storm/blob/4300e944/storm-server/src/main/java/org/apache/storm/security/auth/DefaultHttpCredentialsPlugin.java
----------------------------------------------------------------------
diff --git a/storm-server/src/main/java/org/apache/storm/security/auth/DefaultHttpCredentialsPlugin.java b/storm-server/src/main/java/org/apache/storm/security/auth/DefaultHttpCredentialsPlugin.java
index 37c038f..b6f4b3b 100644
--- a/storm-server/src/main/java/org/apache/storm/security/auth/DefaultHttpCredentialsPlugin.java
+++ b/storm-server/src/main/java/org/apache/storm/security/auth/DefaultHttpCredentialsPlugin.java
@@ -43,15 +43,23 @@ public class DefaultHttpCredentialsPlugin implements IHttpCredentialsPlugin {
*/
@Override
public String getUserName(HttpServletRequest req) {
- Principal princ;
- if (req != null && (princ = req.getUserPrincipal()) != null) {
- String userName = princ.getName();
- if (userName != null && !userName.isEmpty()) {
- LOG.debug("HTTP request had user (" + userName + ")");
- return userName;
+ String ret = null;
+ if (req != null) {
+ Principal princ = req.getUserPrincipal();
+ if (princ != null) {
+ ret = princ.getName();
+ }
+
+ if (ret != null && !ret.isEmpty()) {
+ LOG.debug("Get user name {} from http request principal", ret);
+ } else {
+ ret = req.getRemoteUser();
+ if (ret != null && !ret.isEmpty()) {
+ LOG.debug("Get user name {} from http request remote user", ret);
+ }
}
}
- return null;
+ return ret;
}
/**
http://git-wip-us.apache.org/repos/asf/storm/blob/4300e944/storm-webapp/src/main/java/org/apache/storm/daemon/ui/TestingFilter.java
----------------------------------------------------------------------
diff --git a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/TestingFilter.java b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/TestingFilter.java
new file mode 100644
index 0000000..5d920b9
--- /dev/null
+++ b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/TestingFilter.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.storm.daemon.ui;
+
+import java.io.IOException;
+import java.security.Principal;
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequestWrapper;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * A simple UI filter that should only be used for testing purposes. To set a given user name,
+ * set an init parameter of USER_NAME to be the name of the user you want the UI to always impersonate.
+ */
+public class TestingFilter implements Filter {
+ private static final Logger LOG = LoggerFactory.getLogger(TestingFilter.class);
+
+ private String userName = "unknown_user";
+
+ @Override
+ public void init(FilterConfig filterConfig) throws ServletException {
+ String userName = filterConfig.getInitParameter("USER_NAME");
+ if (userName != null) {
+ this.userName = userName;
+ LOG.info("Will use {} as the user name for all http requests", userName);
+ }
+ }
+
+ @Override
+ public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
+ throws IOException, ServletException {
+ ServletRequest filteredRequest = new HttpServletRequestWrapper((HttpServletRequest) servletRequest) {
+ @Override
+ public String getRemoteUser() {
+ return userName;
+ }
+
+ @Override
+ public Principal getUserPrincipal() {
+ return () -> userName;
+ }
+ };
+ LOG.debug("Changing user name to {}", userName);
+ filterChain.doFilter(filteredRequest, servletResponse);
+ }
+
+ @Override
+ public void destroy() {
+ //NOOP
+ }
+}
[3/3] storm git commit: STORM-3215: Fixed comments
Posted by bo...@apache.org.
STORM-3215: Fixed comments
Project: http://git-wip-us.apache.org/repos/asf/storm/repo
Commit: http://git-wip-us.apache.org/repos/asf/storm/commit/f2ced23f
Tree: http://git-wip-us.apache.org/repos/asf/storm/tree/f2ced23f
Diff: http://git-wip-us.apache.org/repos/asf/storm/diff/f2ced23f
Branch: refs/heads/master
Commit: f2ced23fa4e3f699558663baef4ee582ee148fa2
Parents: c7d9d68
Author: Robert Evans <ev...@yahoo-inc.com>
Authored: Fri Sep 7 16:10:43 2018 -0500
Committer: Robert Evans <ev...@yahoo-inc.com>
Committed: Fri Sep 7 16:10:43 2018 -0500
----------------------------------------------------------------------
storm-client/src/jvm/org/apache/storm/utils/NimbusClient.java | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/storm/blob/f2ced23f/storm-client/src/jvm/org/apache/storm/utils/NimbusClient.java
----------------------------------------------------------------------
diff --git a/storm-client/src/jvm/org/apache/storm/utils/NimbusClient.java b/storm-client/src/jvm/org/apache/storm/utils/NimbusClient.java
index 008d589..234d849 100644
--- a/storm-client/src/jvm/org/apache/storm/utils/NimbusClient.java
+++ b/storm-client/src/jvm/org/apache/storm/utils/NimbusClient.java
@@ -109,7 +109,7 @@ public class NimbusClient extends ThriftClient {
}
/**
- * Execute cb with a configured nimbus client that will be closed one cb returns.
+ * Execute cb with a configured nimbus client that will be closed once cb returns.
* @param cb the callback to send to nimbus.
* @throws Exception on any kind of error.
*/
@@ -118,7 +118,7 @@ public class NimbusClient extends ThriftClient {
}
/**
- * Execute cb with a configured nimbus client that will be closed one cb returns.
+ * Execute cb with a configured nimbus client that will be closed once cb returns.
* @param cb the callback to send to nimbus.
* @param conf the conf to use instead of reading the global storm conf.
* @throws Exception on any kind of error.
[2/3] storm git commit: Merge branch 'STORM-3215' of
https://github.com/revans2/incubator-storm into STORM-3215
Posted by bo...@apache.org.
Merge branch 'STORM-3215' of https://github.com/revans2/incubator-storm into STORM-3215
STORM-3215: Add back in impersonation to UI
This closes #2820
Project: http://git-wip-us.apache.org/repos/asf/storm/repo
Commit: http://git-wip-us.apache.org/repos/asf/storm/commit/c7d9d68a
Tree: http://git-wip-us.apache.org/repos/asf/storm/tree/c7d9d68a
Diff: http://git-wip-us.apache.org/repos/asf/storm/diff/c7d9d68a
Branch: refs/heads/master
Commit: c7d9d68ade30ffa241a2688ce6552d6a2e18745d
Parents: bc06df5 4300e94
Author: Robert Evans <ev...@yahoo-inc.com>
Authored: Fri Sep 7 16:09:44 2018 -0500
Committer: Robert Evans <ev...@yahoo-inc.com>
Committed: Fri Sep 7 16:09:44 2018 -0500
----------------------------------------------------------------------
.../org/apache/storm/utils/NimbusClient.java | 123 ++++++++++++++++---
.../auth/DefaultHttpCredentialsPlugin.java | 22 ++--
.../apache/storm/daemon/ui/TestingFilter.java | 74 +++++++++++
3 files changed, 194 insertions(+), 25 deletions(-)
----------------------------------------------------------------------