You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@flink.apache.org by ga...@apache.org on 2023/06/28 15:50:51 UTC
[flink] branch release-1.17 updated: [FLINK-32465][runtime][security] Fix KerberosLoginProvider.isLoginPossible accidental login with keytab
This is an automated email from the ASF dual-hosted git repository.
gaborgsomogyi pushed a commit to branch release-1.17
in repository https://gitbox.apache.org/repos/asf/flink.git
The following commit(s) were added to refs/heads/release-1.17 by this push:
new 0472cc151ea [FLINK-32465][runtime][security] Fix KerberosLoginProvider.isLoginPossible accidental login with keytab
0472cc151ea is described below
commit 0472cc151ea446f2c5f9560b8515fb6bc74ca83c
Author: Gabor Somogyi <ga...@apple.com>
AuthorDate: Wed Jun 28 17:50:43 2023 +0200
[FLINK-32465][runtime][security] Fix KerberosLoginProvider.isLoginPossible accidental login with keytab
---
.../security/token/hadoop/KerberosLoginProvider.java | 6 ++----
.../token/hadoop/KerberosLoginProviderITCase.java | 19 +++++++++++++++++++
2 files changed, 21 insertions(+), 4 deletions(-)
diff --git a/flink-runtime/src/main/java/org/apache/flink/runtime/security/token/hadoop/KerberosLoginProvider.java b/flink-runtime/src/main/java/org/apache/flink/runtime/security/token/hadoop/KerberosLoginProvider.java
index 5a94fc3d1ad..aff5f410cd0 100644
--- a/flink-runtime/src/main/java/org/apache/flink/runtime/security/token/hadoop/KerberosLoginProvider.java
+++ b/flink-runtime/src/main/java/org/apache/flink/runtime/security/token/hadoop/KerberosLoginProvider.java
@@ -67,13 +67,11 @@ public class KerberosLoginProvider {
return false;
}
- UserGroupInformation currentUser = UserGroupInformation.getCurrentUser();
-
if (principal != null) {
LOG.debug("Login from keytab is possible");
return true;
- } else if (!HadoopUserUtils.isProxyUser(currentUser)) {
- if (useTicketCache && currentUser.hasKerberosCredentials()) {
+ } else if (!HadoopUserUtils.isProxyUser(UserGroupInformation.getCurrentUser())) {
+ if (useTicketCache && UserGroupInformation.getCurrentUser().hasKerberosCredentials()) {
LOG.debug("Login from ticket cache is possible");
return true;
}
diff --git a/flink-runtime/src/test/java/org/apache/flink/runtime/security/token/hadoop/KerberosLoginProviderITCase.java b/flink-runtime/src/test/java/org/apache/flink/runtime/security/token/hadoop/KerberosLoginProviderITCase.java
index b0cd1c055a2..71d732e47b8 100644
--- a/flink-runtime/src/test/java/org/apache/flink/runtime/security/token/hadoop/KerberosLoginProviderITCase.java
+++ b/flink-runtime/src/test/java/org/apache/flink/runtime/security/token/hadoop/KerberosLoginProviderITCase.java
@@ -49,6 +49,25 @@ import static org.mockito.Mockito.when;
*/
public class KerberosLoginProviderITCase {
+ @Test
+ public void isLoginPossibleMustNotDoAccidentalLoginWithKeytab(@TempDir Path tmpDir)
+ throws IOException {
+ Configuration configuration = new Configuration();
+ configuration.setString(KERBEROS_LOGIN_PRINCIPAL, "principal");
+ final Path keyTab = Files.createFile(tmpDir.resolve("test.keytab"));
+ configuration.setString(KERBEROS_LOGIN_KEYTAB, keyTab.toAbsolutePath().toString());
+ KerberosLoginProvider kerberosLoginProvider = new KerberosLoginProvider(configuration);
+
+ try (MockedStatic<UserGroupInformation> ugi = mockStatic(UserGroupInformation.class)) {
+ ugi.when(UserGroupInformation::isSecurityEnabled).thenReturn(true);
+ ugi.when(UserGroupInformation::getCurrentUser)
+ .thenThrow(
+ new IllegalStateException(
+ "isLoginPossible must not do login with keytab"));
+ kerberosLoginProvider.isLoginPossible(false);
+ }
+ }
+
@Test
public void isLoginPossibleMustReturnFalseByDefault() throws IOException {
Configuration configuration = new Configuration();