You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by xi...@apache.org on 2016/09/26 20:11:01 UTC
hadoop git commit: HADOOP-13638. KMS should set UGI's Configuration
object properly. Contributed by Wei-Chiu Chuang.
Repository: hadoop
Updated Branches:
refs/heads/trunk 4815d024c -> fa397e74f
HADOOP-13638. KMS should set UGI's Configuration object properly. Contributed by Wei-Chiu Chuang.
Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo
Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/fa397e74
Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/fa397e74
Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/fa397e74
Branch: refs/heads/trunk
Commit: fa397e74fe988bcbb05c816de73eb738794ace4b
Parents: 4815d02
Author: Xiao Chen <xi...@apache.org>
Authored: Mon Sep 26 13:00:57 2016 -0700
Committer: Xiao Chen <xi...@apache.org>
Committed: Mon Sep 26 13:00:57 2016 -0700
----------------------------------------------------------------------
.../hadoop/crypto/key/kms/server/KMSWebApp.java | 2 +
.../hadoop/crypto/key/kms/server/TestKMS.java | 76 ++++++++++----------
2 files changed, 42 insertions(+), 36 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hadoop/blob/fa397e74/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java b/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java
index e3d1a93..cd773dd 100644
--- a/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java
+++ b/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java
@@ -28,6 +28,7 @@ import org.apache.hadoop.crypto.key.KeyProvider;
import org.apache.hadoop.crypto.key.KeyProviderCryptoExtension;
import org.apache.hadoop.crypto.key.KeyProviderFactory;
import org.apache.hadoop.http.HttpServer2;
+import org.apache.hadoop.security.UserGroupInformation;
import org.apache.hadoop.security.authorize.AccessControlList;
import org.apache.hadoop.util.VersionInfo;
import org.apache.log4j.PropertyConfigurator;
@@ -121,6 +122,7 @@ public class KMSWebApp implements ServletContextListener {
}
kmsConf = KMSConfiguration.getKMSConf();
initLogging(confDir);
+ UserGroupInformation.setConfiguration(kmsConf);
LOG.info("-------------------------------------------------------------");
LOG.info(" Java runtime version : {}", System.getProperty(
"java.runtime.version"));
http://git-wip-us.apache.org/repos/asf/hadoop/blob/fa397e74/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java b/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java
index 61b9a90..9cbd08a 100644
--- a/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java
+++ b/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java
@@ -143,11 +143,31 @@ public class TestKMS {
}
protected Configuration createBaseKMSConf(File keyStoreDir) throws Exception {
- Configuration conf = new Configuration(false);
- conf.set(KMSConfiguration.KEY_PROVIDER_URI,
+ return createBaseKMSConf(keyStoreDir, null);
+ }
+
+ /**
+ * The Configuration object is shared by both KMS client and server in unit
+ * tests because UGI gets/sets it to a static variable.
+ * As a workaround, make sure the client configurations are copied to server
+ * so that client can read them.
+ * @param keyStoreDir where keystore is located.
+ * @param conf KMS client configuration
+ * @return KMS server configuration based on client.
+ * @throws Exception
+ */
+ protected Configuration createBaseKMSConf(File keyStoreDir,
+ Configuration conf) throws Exception {
+ Configuration newConf;
+ if (conf == null) {
+ newConf = new Configuration(false);
+ } else {
+ newConf = new Configuration(conf);
+ }
+ newConf.set(KMSConfiguration.KEY_PROVIDER_URI,
"jceks://file@" + new Path(keyStoreDir.getAbsolutePath(), "kms.keystore").toUri());
- conf.set("hadoop.kms.authentication.type", "simple");
- return conf;
+ newConf.set("hadoop.kms.authentication.type", "simple");
+ return newConf;
}
public static void writeConf(File confDir, Configuration conf)
@@ -280,9 +300,8 @@ public class TestKMS {
if (kerberos) {
conf.set("hadoop.security.authentication", "kerberos");
}
- UserGroupInformation.setConfiguration(conf);
File testDir = getTestDir();
- conf = createBaseKMSConf(testDir);
+ conf = createBaseKMSConf(testDir, conf);
final String keystore;
final String password;
@@ -404,9 +423,8 @@ public class TestKMS {
final String specialKey = "key %^[\n{]}|\"<>\\";
Configuration conf = new Configuration();
conf.set("hadoop.security.authentication", "kerberos");
- UserGroupInformation.setConfiguration(conf);
File confDir = getTestDir();
- conf = createBaseKMSConf(confDir);
+ conf = createBaseKMSConf(confDir, conf);
conf.set(KeyAuthorizationKeyProvider.KEY_ACL + specialKey + ".ALL", "*");
writeConf(confDir, conf);
@@ -439,9 +457,8 @@ public class TestKMS {
public void testKMSProvider() throws Exception {
Configuration conf = new Configuration();
conf.set("hadoop.security.authentication", "kerberos");
- UserGroupInformation.setConfiguration(conf);
File confDir = getTestDir();
- conf = createBaseKMSConf(confDir);
+ conf = createBaseKMSConf(confDir, conf);
conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k1.ALL", "*");
conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k2.MANAGEMENT", "*");
conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k2.READ", "*");
@@ -699,9 +716,8 @@ public class TestKMS {
public void testKeyACLs() throws Exception {
Configuration conf = new Configuration();
conf.set("hadoop.security.authentication", "kerberos");
- UserGroupInformation.setConfiguration(conf);
final File testDir = getTestDir();
- conf = createBaseKMSConf(testDir);
+ conf = createBaseKMSConf(testDir, conf);
conf.set("hadoop.kms.authentication.type", "kerberos");
conf.set("hadoop.kms.authentication.kerberos.keytab",
keytab.getAbsolutePath());
@@ -977,9 +993,8 @@ public class TestKMS {
public void doKMSRestart(boolean useKrb) throws Exception {
Configuration conf = new Configuration();
conf.set("hadoop.security.authentication", "kerberos");
- UserGroupInformation.setConfiguration(conf);
final File testDir = getTestDir();
- conf = createBaseKMSConf(testDir);
+ conf = createBaseKMSConf(testDir, conf);
if (useKrb) {
conf.set("hadoop.kms.authentication.type", "kerberos");
}
@@ -1057,9 +1072,8 @@ public class TestKMS {
public void testKMSAuthFailureRetry() throws Exception {
Configuration conf = new Configuration();
conf.set("hadoop.security.authentication", "kerberos");
- UserGroupInformation.setConfiguration(conf);
final File testDir = getTestDir();
- conf = createBaseKMSConf(testDir);
+ conf = createBaseKMSConf(testDir, conf);
conf.set("hadoop.kms.authentication.kerberos.keytab",
keytab.getAbsolutePath());
conf.set("hadoop.kms.authentication.kerberos.principal", "HTTP/localhost");
@@ -1151,9 +1165,8 @@ public class TestKMS {
public void testACLs() throws Exception {
Configuration conf = new Configuration();
conf.set("hadoop.security.authentication", "kerberos");
- UserGroupInformation.setConfiguration(conf);
final File testDir = getTestDir();
- conf = createBaseKMSConf(testDir);
+ conf = createBaseKMSConf(testDir, conf);
conf.set("hadoop.kms.authentication.type", "kerberos");
conf.set("hadoop.kms.authentication.kerberos.keytab",
keytab.getAbsolutePath());
@@ -1461,9 +1474,8 @@ public class TestKMS {
public void testKMSBlackList() throws Exception {
Configuration conf = new Configuration();
conf.set("hadoop.security.authentication", "kerberos");
- UserGroupInformation.setConfiguration(conf);
File testDir = getTestDir();
- conf = createBaseKMSConf(testDir);
+ conf = createBaseKMSConf(testDir, conf);
conf.set("hadoop.kms.authentication.type", "kerberos");
conf.set("hadoop.kms.authentication.kerberos.keytab",
keytab.getAbsolutePath());
@@ -1550,9 +1562,8 @@ public class TestKMS {
public void testServicePrincipalACLs() throws Exception {
Configuration conf = new Configuration();
conf.set("hadoop.security.authentication", "kerberos");
- UserGroupInformation.setConfiguration(conf);
File testDir = getTestDir();
- conf = createBaseKMSConf(testDir);
+ conf = createBaseKMSConf(testDir, conf);
conf.set("hadoop.kms.authentication.type", "kerberos");
conf.set("hadoop.kms.authentication.kerberos.keytab",
keytab.getAbsolutePath());
@@ -1676,9 +1687,8 @@ public class TestKMS {
public void testDelegationTokenAccess() throws Exception {
Configuration conf = new Configuration();
conf.set("hadoop.security.authentication", "kerberos");
- UserGroupInformation.setConfiguration(conf);
final File testDir = getTestDir();
- conf = createBaseKMSConf(testDir);
+ conf = createBaseKMSConf(testDir, conf);
conf.set("hadoop.kms.authentication.type", "kerberos");
conf.set("hadoop.kms.authentication.kerberos.keytab",
keytab.getAbsolutePath());
@@ -1759,9 +1769,8 @@ public class TestKMS {
private void testDelegationTokensOps(Configuration conf,
final boolean useKrb) throws Exception {
- UserGroupInformation.setConfiguration(conf);
File confDir = getTestDir();
- conf = createBaseKMSConf(confDir);
+ conf = createBaseKMSConf(confDir, conf);
if (useKrb) {
conf.set("hadoop.kms.authentication.type", "kerberos");
conf.set("hadoop.kms.authentication.kerberos.keytab",
@@ -1885,9 +1894,8 @@ public class TestKMS {
@Test
public void testDelegationTokensUpdatedInUGI() throws Exception {
Configuration conf = new Configuration();
- UserGroupInformation.setConfiguration(conf);
File confDir = getTestDir();
- conf = createBaseKMSConf(confDir);
+ conf = createBaseKMSConf(confDir, conf);
conf.set(
"hadoop.kms.authentication.delegation-token.max-lifetime.sec", "5");
conf.set(
@@ -2024,9 +2032,8 @@ public class TestKMS {
Configuration conf = new Configuration();
conf.set("hadoop.security.authentication", "kerberos");
- UserGroupInformation.setConfiguration(conf);
final File testDir = getTestDir();
- conf = createBaseKMSConf(testDir);
+ conf = createBaseKMSConf(testDir, conf);
conf.set("hadoop.kms.authentication.type", "kerberos");
conf.set("hadoop.kms.authentication.kerberos.keytab", keytab.getAbsolutePath());
conf.set("hadoop.kms.authentication.kerberos.principal", "HTTP/localhost");
@@ -2114,9 +2121,8 @@ public class TestKMS {
public void doProxyUserTest(final boolean kerberos) throws Exception {
Configuration conf = new Configuration();
conf.set("hadoop.security.authentication", "kerberos");
- UserGroupInformation.setConfiguration(conf);
final File testDir = getTestDir();
- conf = createBaseKMSConf(testDir);
+ conf = createBaseKMSConf(testDir, conf);
if (kerberos) {
conf.set("hadoop.kms.authentication.type", "kerberos");
}
@@ -2226,9 +2232,8 @@ public class TestKMS {
Configuration conf = new Configuration();
conf.set("hadoop.security.authentication", "kerberos");
- UserGroupInformation.setConfiguration(conf);
final File testDir = getTestDir();
- conf = createBaseKMSConf(testDir);
+ conf = createBaseKMSConf(testDir, conf);
conf.set("hadoop.kms.authentication.type", "kerberos");
conf.set("hadoop.kms.authentication.kerberos.keytab",
keytab.getAbsolutePath());
@@ -2286,9 +2291,8 @@ public class TestKMS {
public void doWebHDFSProxyUserTest(final boolean kerberos) throws Exception {
Configuration conf = new Configuration();
conf.set("hadoop.security.authentication", "kerberos");
- UserGroupInformation.setConfiguration(conf);
final File testDir = getTestDir();
- conf = createBaseKMSConf(testDir);
+ conf = createBaseKMSConf(testDir, conf);
if (kerberos) {
conf.set("hadoop.kms.authentication.type", "kerberos");
}
---------------------------------------------------------------------
To unsubscribe, e-mail: common-commits-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-commits-help@hadoop.apache.org