You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ambari.apache.org by ey...@apache.org on 2017/08/22 03:59:26 UTC
ambari git commit: AMBARI-17898. Add Kerberos HTTP SPNEGO
authentication support to Ambari Metrics Monitor. (Qin Liu via Eric Yang)
Repository: ambari
Updated Branches:
refs/heads/trunk 6de8094a4 -> d260c8926
AMBARI-17898. Add Kerberos HTTP SPNEGO authentication support to Ambari Metrics Monitor. (Qin Liu via Eric Yang)
Project: http://git-wip-us.apache.org/repos/asf/ambari/repo
Commit: http://git-wip-us.apache.org/repos/asf/ambari/commit/d260c892
Tree: http://git-wip-us.apache.org/repos/asf/ambari/tree/d260c892
Diff: http://git-wip-us.apache.org/repos/asf/ambari/diff/d260c892
Branch: refs/heads/trunk
Commit: d260c89263ee0471514b4cfb8ce938134eceea12
Parents: 6de8094
Author: Eric Yang <ey...@apache.org>
Authored: Mon Aug 21 20:57:34 2017 -0700
Committer: Eric Yang <ey...@apache.org>
Committed: Mon Aug 21 20:57:34 2017 -0700
----------------------------------------------------------------------
.../conf/unix/metric_monitor.ini | 2 +
.../src/main/python/core/config_reader.py | 8 +
.../src/main/python/core/emitter.py | 58 ++++++-
.../src/main/python/core/krberr.py | 42 +++++
.../main/python/core/spnego_kerberos_auth.py | 164 +++++++++++++++++++
.../src/test/python/core/TestEmitter.py | 24 +++
.../AMBARI_METRICS/0.1.0/kerberos.json | 26 +++
.../AMBARI_METRICS/0.1.0/metainfo.xml | 8 +
.../AMBARI_METRICS/0.1.0/package/scripts/ams.py | 33 +++-
.../0.1.0/package/scripts/params.py | 7 +-
.../package/templates/metric_monitor.ini.j2 | 2 +
11 files changed, 360 insertions(+), 14 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/ambari/blob/d260c892/ambari-metrics/ambari-metrics-host-monitoring/conf/unix/metric_monitor.ini
----------------------------------------------------------------------
diff --git a/ambari-metrics/ambari-metrics-host-monitoring/conf/unix/metric_monitor.ini b/ambari-metrics/ambari-metrics-host-monitoring/conf/unix/metric_monitor.ini
index 7fe7397..38fff1e 100644
--- a/ambari-metrics/ambari-metrics-host-monitoring/conf/unix/metric_monitor.ini
+++ b/ambari-metrics/ambari-metrics-host-monitoring/conf/unix/metric_monitor.ini
@@ -27,6 +27,8 @@ skip_network_interfaces_patterns =
[emitter]
send_interval = 60
+kinit_cmd = /usr/bin/kinit -kt /etc/security/keytabs/ams.monitor.keytab amsmon/localhost
+klist_cmd = /usr/bin/klist
[collector]
collector_sleep_interval = 5
http://git-wip-us.apache.org/repos/asf/ambari/blob/d260c892/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/config_reader.py
----------------------------------------------------------------------
diff --git a/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/config_reader.py b/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/config_reader.py
index d1429ed..017ad24 100644
--- a/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/config_reader.py
+++ b/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/config_reader.py
@@ -115,6 +115,8 @@ enable_value_threshold = false
[emitter]
send_interval = 60
+kinit_cmd = /usr/bin/kinit -kt /etc/security/keytabs/ams.monitor.keytab amsmon/localhost
+klist_cmd = /usr/bin/klist
[collector]
collector_sleep_interval = 5
@@ -218,6 +220,12 @@ class Configuration:
def get_send_interval(self):
return int(self.get("emitter", "send_interval", 60))
+ def get_kinit_cmd(self):
+ return self.get("emitter", "kinit_cmd")
+
+ def get_klist_cmd(self):
+ return self.get("emitter", "klist_cmd")
+
def get_collector_sleep_interval(self):
return int(self.get("collector", "collector_sleep_interval", 10))
http://git-wip-us.apache.org/repos/asf/ambari/blob/d260c892/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/emitter.py
----------------------------------------------------------------------
diff --git a/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/emitter.py b/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/emitter.py
index 77b8c23..f19434d 100644
--- a/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/emitter.py
+++ b/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/emitter.py
@@ -24,6 +24,7 @@ import threading
from security import CachedHTTPSConnection, CachedHTTPConnection
from blacklisted_set import BlacklistedSet
from config_reader import ROUND_ROBIN_FAILOVER_STRATEGY
+from spnego_kerberos_auth import SPNEGOKerberosAuth
logger = logging.getLogger()
@@ -31,6 +32,10 @@ class Emitter(threading.Thread):
AMS_METRICS_POST_URL = "/ws/v1/timeline/metrics/"
RETRY_SLEEP_INTERVAL = 5
MAX_RETRY_COUNT = 3
+ cookie_cached = {}
+ kinit_cmd = None
+ klist_cmd = None
+ spnego_krb_auth = None
"""
Wake up every send interval seconds and empty the application metric map.
"""
@@ -39,6 +44,10 @@ class Emitter(threading.Thread):
logger.debug('Initializing Emitter thread.')
self.lock = threading.Lock()
self.send_interval = config.get_send_interval()
+ self.kinit_cmd = config.get_kinit_cmd()
+ if self.kinit_cmd:
+ logger.debug(self.kinit_cmd)
+ self.klist_cmd = config.get_klist_cmd()
self.hostname = config.get_hostname_config()
self.hostname_hash = self.compute_hash(self.hostname)
self._stop_handler = stop_handler
@@ -71,6 +80,7 @@ class Emitter(threading.Thread):
self.submit_metrics()
except Exception, e:
logger.warn('Unable to emit events. %s' % str(e))
+ self.cookie_cached = {}
pass
#Wait for the service stop event instead of sleeping blindly
if 0 == self._stop_handler.wait(self.send_interval):
@@ -108,17 +118,50 @@ class Emitter(threading.Thread):
headers = {"Content-Type" : "application/json", "Accept" : "*/*"}
connection = self.get_connection(collector_host)
logger.debug("message to send: %s" % data)
+
+ try:
+ if self.cookie_cached[connection.host]:
+ headers["Cookie"] = self.cookie_cached[connection.host]
+ logger.debug("Cookie: %s" % self.cookie_cached[connection.host])
+ except Exception, e:
+ self.cookie_cached = {}
+ pass
+
retry_count = 0
while retry_count < self.MAX_RETRY_COUNT:
response = self.get_response_from_submission(connection, data, headers)
- if response and response.status == 200:
- return True
- else:
- logger.warn("Retrying after {0} ...".format(self.RETRY_SLEEP_INTERVAL))
- retry_count += 1
- #Wait for the service stop event instead of sleeping blindly
- if 0 == self._stop_handler.wait(self.RETRY_SLEEP_INTERVAL):
+ if response:
+ if response.status == 200:
return True
+ if response.status == 401:
+ self.cookie_cached = {}
+ auth_header = response.getheader('www-authenticate', None)
+ if auth_header == None:
+ logger.warn('www-authenticate header not found')
+ else:
+ self.spnego_krb_auth = SPNEGOKerberosAuth()
+ if self.spnego_krb_auth.get_negotiate_value(auth_header) == '':
+ response = self.spnego_krb_auth.authenticate_handshake(connection, "POST", self.AMS_METRICS_POST_URL, data, headers, self.kinit_cmd, self.klist_cmd)
+ if response:
+ logger.debug("response from authenticate_client: retcode = {0}, reason = {1}"
+ .format(response.status, response.reason))
+ logger.debug(str(response.read()))
+ if response.status == 200:
+ logger.debug("response headers: {0}".format(response.getheaders()))
+ logger.debug("cookie_cached: %s" % self.cookie_cached)
+ set_cookie_header = response.getheader('set-cookie', None)
+ if set_cookie_header and self.spnego_krb_auth:
+ set_cookie_val = self.spnego_krb_auth.get_hadoop_auth_cookie(set_cookie_header)
+ logger.debug("set_cookie: %s" % set_cookie_val)
+ if set_cookie_val:
+ self.cookie_cached[connection.host] = set_cookie_val
+ return True
+ #No response or failed
+ logger.warn("Retrying after {0} ...".format(self.RETRY_SLEEP_INTERVAL))
+ retry_count += 1
+ #Wait for the service stop event instead of sleeping blindly
+ if 0 == self._stop_handler.wait(self.RETRY_SLEEP_INTERVAL):
+ return True
pass
if retry_count >= self.MAX_RETRY_COUNT:
@@ -150,6 +193,7 @@ class Emitter(threading.Thread):
return response
except Exception, e:
logger.warn('Error sending metrics to server. %s' % str(e))
+ self.cookie_cached = {}
return None
def get_collector_host_shard(self):
http://git-wip-us.apache.org/repos/asf/ambari/blob/d260c892/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/krberr.py
----------------------------------------------------------------------
diff --git a/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/krberr.py b/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/krberr.py
new file mode 100644
index 0000000..c5e0163
--- /dev/null
+++ b/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/krberr.py
@@ -0,0 +1,42 @@
+#!/usr/bin/env python
+
+'''
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+'''
+
+"""
+Python Kerberos GSS APIs used by spnego_kerberos_auth.py.
+It is used as a place holder for kerberos.py which is not available.
+"""
+
+class KrbError(Exception):
+ pass
+
+class GSSError(KrbError):
+ pass
+
+def authGSSClientInit(service):
+ pass
+
+def authGSSClientClean(context):
+ pass
+
+def authGSSClientStep(context, challenge):
+ pass
+
+def authGSSClientResponse(context):
+ pass
http://git-wip-us.apache.org/repos/asf/ambari/blob/d260c892/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/spnego_kerberos_auth.py
----------------------------------------------------------------------
diff --git a/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/spnego_kerberos_auth.py b/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/spnego_kerberos_auth.py
new file mode 100644
index 0000000..e49712f
--- /dev/null
+++ b/ambari-metrics/ambari-metrics-host-monitoring/src/main/python/core/spnego_kerberos_auth.py
@@ -0,0 +1,164 @@
+#!/usr/bin/env python
+
+'''
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+'''
+
+import logging
+import httplib
+import os
+
+logger = logging.getLogger()
+try:
+ import kerberos
+except ImportError:
+ import krberr as kerberos
+ logger.warn('import kerberos exception: %s' % str(ImportError))
+pass
+
+class SPNEGOKerberosAuth:
+ def __init__(self):
+ self.krb_context = None
+
+ def authenticate_handshake (self, connection, method, service_url, body, headers, kinit_cmd, klist_cmd):
+ # kinit to ensure ticket valid
+ self.execute_kinit(kinit_cmd, klist_cmd)
+
+ try:
+ # Authenticate the client request
+ response = self.authenticate_client(connection, method, service_url, body, headers)
+
+ # Authenticate the response from the server
+ if response:
+ self.authenticate_server(response)
+ return response
+ finally:
+ # Clean the client context after the handshake
+ self.clean_client_context()
+ pass
+
+ def execute_kinit(self, kinit_cmd, klist_cmd):
+ exit_status = os.system(kinit_cmd)
+ logger.debug("kinit exit_status: {0}".format(exit_status))
+ logger.debug(os.system(klist_cmd))
+ return exit_status
+
+ def authenticate_client(self, connection, method, service_url, body, headers):
+ service = "HTTP@%s" % connection.host.lower()
+ logger.debug("connection: %s", connection)
+ logger.debug("service: %s", service)
+
+ auth_header = self.get_authorization_header(service)
+ logger.debug("Authorization: %s" % auth_header)
+
+ # Send 2nd HTTP request with authorization header
+ headers['Authorization'] = auth_header
+ try:
+ connection.request(method, service_url, body, headers)
+ response = connection.getresponse()
+ except Exception, e:
+ logger.warn('2nd HTTP request exception from server: %s' % str(e))
+ return None
+ pass
+ if response:
+ logger.debug("2nd HTTP response from server: retcode = {0}, reason = {1}"
+ .format(response.status, response.reason))
+ logger.debug(str(response.read()))
+ logger.debug("response headers: {0}".format(response.getheaders()))
+ return response
+
+ def get_authorization_header(self, service):
+ # Initialize the context object for client-side authentication with a service principal
+ try:
+ result, self.krb_context = kerberos.authGSSClientInit(service)
+ if result == -1:
+ logger.warn('authGSSClientInit result: {0}'.format(result))
+ return None
+ except kerberos.GSSError, e:
+ logger.warn('authGSSClientInit exception: %s' % str(e))
+ return None
+ pass
+
+ # Process the first client-side step with the context
+ try:
+ result = kerberos.authGSSClientStep(self.krb_context, "")
+ if result == -1:
+ logger.warn('authGSSClientStep result for authenticate client: {0}'.format(result))
+ return None
+ except kerberos.GSSError, e:
+ logger.warn('authGSSClientStep exception for authenticate client: %s' % str(e))
+ return None
+ pass
+
+ # Get the client response from the first client-side step
+ try:
+ negotiate_value = kerberos.authGSSClientResponse(self.krb_context)
+ logger.debug("authGSSClientResponse response:{0}".format(negotiate_value))
+ except kerberos.GSSError, e:
+ logger.warn('authGSSClientResponse exception: %s' % str(e))
+ return None
+ pass
+
+ # Build the authorization header
+ return "Negotiate %s" % negotiate_value
+
+ def authenticate_server(self, response):
+ auth_header = response.getheader('www-authenticate', None)
+ negotiate_value = self.get_negotiate_value(auth_header)
+ if negotiate_value == None:
+ logger.warn('www-authenticate header not found')
+
+ # Process the client-side step with the context and the negotiate value from 2nd HTTP response
+ try:
+ result = kerberos.authGSSClientStep(self.krb_context, negotiate_value)
+ if result == -1:
+ logger.warn('authGSSClientStep result for authenticate server: {0}'.format(result))
+ except kerberos.GSSError, e:
+ logger.warn('authGSSClientStep exception for authenticate server: %s' % str(e))
+ result = -1
+ pass
+ return result
+
+ def clean_client_context(self):
+ # Destroy the context for client-side authentication
+ try:
+ result = kerberos.authGSSClientClean(self.krb_context)
+ logger.debug("authGSSClientClean result:{0}".format(result))
+ except kerberos.GSSError, e:
+ logger.warn('authGSSClientClean exception: %s' % str(e))
+ result = -1
+ pass
+ return result
+
+ def get_hadoop_auth_cookie(self, set_cookie_header):
+ if set_cookie_header:
+ for field in set_cookie_header.split(";"):
+ if field.startswith('hadoop.auth='):
+ return field
+ else:
+ return None
+ return None
+
+ def get_negotiate_value(self, auth_header):
+ if auth_header:
+ for field in auth_header.split(","):
+ key, __, value = field.strip().partition(" ")
+ if key.lower() == "negotiate":
+ return value.strip()
+ else:
+ return None
+ return None
http://git-wip-us.apache.org/repos/asf/ambari/blob/d260c892/ambari-metrics/ambari-metrics-host-monitoring/src/test/python/core/TestEmitter.py
----------------------------------------------------------------------
diff --git a/ambari-metrics/ambari-metrics-host-monitoring/src/test/python/core/TestEmitter.py b/ambari-metrics/ambari-metrics-host-monitoring/src/test/python/core/TestEmitter.py
index 4056ae3..8b3eb66 100644
--- a/ambari-metrics/ambari-metrics-host-monitoring/src/test/python/core/TestEmitter.py
+++ b/ambari-metrics/ambari-metrics-host-monitoring/src/test/python/core/TestEmitter.py
@@ -27,6 +27,7 @@ from only_for_platform import get_platform, PLATFORM_WINDOWS
from mock.mock import patch, MagicMock
from security import CachedHTTPConnection
from blacklisted_set import BlacklistedSet
+from spnego_kerberos_auth import SPNEGOKerberosAuth
if get_platform() != PLATFORM_WINDOWS:
os_distro_value = ('Suse','11','Final')
@@ -86,6 +87,29 @@ class TestEmitter(TestCase):
self.assertEqual(request_mock.call_count, 3)
self.assertUrlData(request_mock)
+ @patch.object(OSCheck, "os_distribution", new = MagicMock(return_value = os_distro_value))
+ @patch.object(CachedHTTPConnection, "create_connection", new = MagicMock())
+ @patch.object(SPNEGOKerberosAuth, "authenticate_handshake")
+ @patch.object(CachedHTTPConnection, "getresponse")
+ @patch.object(CachedHTTPConnection, "request")
+ def test_spnego_negotiation(self, request_mock, getresponse_mock, auth_mock):
+ request_mock.return_value = MagicMock()
+ getresponse_mock.return_value.status = 401
+ getresponse_mock.return_value.getheader.return_value = "Negotiate "
+
+ auth_mock.return_value.status = 200
+
+ stop_handler = bind_signal_handlers()
+
+ config = Configuration()
+ application_metric_map = ApplicationMetricMap("host","10.10.10.10")
+ application_metric_map.clear()
+ application_metric_map.put_metric("APP1", {"metric1":1}, 1)
+ emitter = Emitter(config, application_metric_map, stop_handler)
+ emitter.submit_metrics()
+
+
+ self.assertEqual(request_mock.call_count, 1)
def assertUrlData(self, request_mock):
self.assertEqual(len(request_mock.call_args), 2)
data = request_mock.call_args[0][2]
http://git-wip-us.apache.org/repos/asf/ambari/blob/d260c892/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/kerberos.json
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/kerberos.json b/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/kerberos.json
index 51f541f..a6afda5 100644
--- a/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/kerberos.json
+++ b/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/kerberos.json
@@ -9,6 +9,32 @@
],
"components": [
{
+ "name": "METRICS_MONITOR",
+ "identities": [
+ {
+ "name": "ams_monitor",
+ "principal": {
+ "value": "amsmon/_HOST@${realm}",
+ "type": "service",
+ "configuration": "ams-hbase-security-site/ams.monitor.principal",
+ "local_username": "${ams-env/ambari_metrics_user}"
+ },
+ "keytab": {
+ "file": "${keytab_dir}/ams-monitor.keytab",
+ "owner": {
+ "name": "${ams-env/ambari_metrics_user}",
+ "access": "r"
+ },
+ "group": {
+ "name": "${cluster-env/user_group}",
+ "access": ""
+ },
+ "configuration": "ams-hbase-security-site/ams.monitor.keytab"
+ }
+ }
+ ]
+ },
+ {
"name": "METRICS_COLLECTOR",
"identities": [
{
http://git-wip-us.apache.org/repos/asf/ambari/blob/d260c892/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/metainfo.xml
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/metainfo.xml b/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/metainfo.xml
index 9031b46..43c3685 100644
--- a/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/metainfo.xml
+++ b/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/metainfo.xml
@@ -151,6 +151,14 @@
</packages>
</osSpecific>
<osSpecific>
+ <osFamily>redhat7,redhat6,centos6,centos7</osFamily>
+ <packages>
+ <package>
+ <name>python-kerberos</name>
+ </package>
+ </packages>
+ </osSpecific>
+ <osSpecific>
<osFamily>debian7,ubuntu12,ubuntu14</osFamily>
<packages>
<package>
http://git-wip-us.apache.org/repos/asf/ambari/blob/d260c892/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/scripts/ams.py
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/scripts/ams.py b/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/scripts/ams.py
index f49d47d..9a31ade 100644
--- a/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/scripts/ams.py
+++ b/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/scripts/ams.py
@@ -334,14 +334,12 @@ def ams(name=None, action=None):
mode=0644
)
- # Remove spnego configs from core-site, since AMS does not support spnego (AMBARI-14384)
+ # Remove spnego configs from core-site if platform does not have python-kerberos library
truncated_core_site = {}
truncated_core_site.update(params.config['configurations']['core-site'])
- if 'core-site' in params.config['configurations']:
- if 'hadoop.http.authentication.type' in params.config['configurations']['core-site']:
- truncated_core_site.pop('hadoop.http.authentication.type')
- if 'hadoop.http.filter.initializers' in params.config['configurations']['core-site']:
- truncated_core_site.pop('hadoop.http.filter.initializers')
+ if is_spnego_enabled(params) and is_redhat_centos_6_plus() == False:
+ truncated_core_site.pop('hadoop.http.authentication.type')
+ truncated_core_site.pop('hadoop.http.filter.initializers')
XmlConfig("core-site.xml",
conf_dir=params.ams_collector_conf_dir,
@@ -367,6 +365,13 @@ def ams(name=None, action=None):
pass
elif name == 'monitor':
+
+ if is_spnego_enabled(params) and is_redhat_centos_6_plus():
+ try:
+ import kerberos
+ except ImportError:
+ raise ImportError("python-kerberos package need to be installed to run AMS in SPNEGO mode")
+
Directory(params.ams_monitor_conf_dir,
owner=params.ams_user,
group=params.user_group,
@@ -481,6 +486,22 @@ def ams(name=None, action=None):
pass
+def is_spnego_enabled(params):
+ if 'core-site' in params.config['configurations'] \
+ and 'hadoop.http.authentication.type' in params.config['configurations']['core-site'] \
+ and params.config['configurations']['core-site']['hadoop.http.authentication.type'] == "kerberos" \
+ and 'hadoop.http.filter.initializers' in params.config['configurations']['core-site'] \
+ and params.config['configurations']['core-site']['hadoop.http.filter.initializers'] == "org.apache.hadoop.security.AuthenticationFilterInitializer":
+ return True
+ return False
+
+def is_redhat_centos_6_plus():
+ import platform
+
+ if platform.dist()[0] in ['redhat', 'centos'] and platform.dist()[1] > '6.0':
+ return True
+ return False
+
def export_ca_certs(dir_path):
# export ca certificates on every restart to handle changed truststore content
http://git-wip-us.apache.org/repos/asf/ambari/blob/d260c892/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/scripts/params.py
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/scripts/params.py b/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/scripts/params.py
index 486f568..6975bec 100644
--- a/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/scripts/params.py
+++ b/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/scripts/params.py
@@ -304,7 +304,10 @@ service_check_data = functions.get_unique_id_and_date()
user_group = config['configurations']['cluster-env']["user_group"]
hadoop_user = "hadoop"
+kinit_path_local = functions.get_kinit_path(default('/configurations/kerberos-env/executable_search_paths', None))
kinit_cmd = ""
+klist_path_local = functions.get_klist_path(default('/configurations/kerberos-env/executable_search_paths', None))
+klist_cmd = ""
if security_enabled:
_hostname_lowercase = config['hostname'].lower()
@@ -328,6 +331,9 @@ if security_enabled:
regionserver_keytab_path = config['configurations']['ams-hbase-security-site']['hbase.regionserver.keytab.file']
regionserver_jaas_princ = config['configurations']['ams-hbase-security-site']['hbase.regionserver.kerberos.principal'].replace('_HOST',_hostname_lowercase)
+ kinit_cmd = '%s -kt %s %s' % (kinit_path_local, config['configurations']['ams-hbase-security-site']['ams.monitor.keytab'], config['configurations']['ams-hbase-security-site']['ams.monitor.principal'].replace('_HOST',_hostname_lowercase))
+ klist_cmd = '%s' % klist_path_local
+
#Ambari metrics log4j settings
ams_hbase_log_maxfilesize = default('configurations/ams-hbase-log4j/ams_hbase_log_maxfilesize',256)
ams_hbase_log_maxbackupindex = default('configurations/ams-hbase-log4j/ams_hbase_log_maxbackupindex',20)
@@ -362,7 +368,6 @@ if hbase_wal_dir and re.search("^file://|/", hbase_wal_dir): #If wal dir is on l
hdfs_user_keytab = config['configurations']['hadoop-env']['hdfs_user_keytab']
hdfs_user = config['configurations']['hadoop-env']['hdfs_user']
hdfs_principal_name = config['configurations']['hadoop-env']['hdfs_principal_name']
-kinit_path_local = functions.get_kinit_path(default('/configurations/kerberos-env/executable_search_paths', None))
http://git-wip-us.apache.org/repos/asf/ambari/blob/d260c892/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/templates/metric_monitor.ini.j2
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/templates/metric_monitor.ini.j2 b/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/templates/metric_monitor.ini.j2
index b7dee50..245ba3b 100644
--- a/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/templates/metric_monitor.ini.j2
+++ b/ambari-server/src/main/resources/common-services/AMBARI_METRICS/0.1.0/package/templates/metric_monitor.ini.j2
@@ -30,6 +30,8 @@ set.instanceId={{set_instanceId}}
[emitter]
send_interval = {{metrics_report_interval}}
+kinit_cmd = {{kinit_cmd}}
+klist_cmd = {{klist_cmd}}
[collector]
collector_sleep_interval = 10