ambari-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From lpus...@apache.org
Subject [26/57] [abbrv] ambari git commit: AMBARI-21904 Remove redundant smokeuser entry from Ranger KMS Kerberos descriptor (mugdha)
Date Tue, 12 Sep 2017 10:04:43 GMT
AMBARI-21904 Remove redundant smokeuser entry from Ranger KMS Kerberos descriptor (mugdha)


Project: http://git-wip-us.apache.org/repos/asf/ambari/repo
Commit: http://git-wip-us.apache.org/repos/asf/ambari/commit/a0594787
Tree: http://git-wip-us.apache.org/repos/asf/ambari/tree/a0594787
Diff: http://git-wip-us.apache.org/repos/asf/ambari/diff/a0594787

Branch: refs/heads/feature-branch-AMBARI-21307
Commit: a05947873b39d646575e6568e9b7cd086a10fac3
Parents: b7f53dc
Author: Mugdha Varadkar <mugdha@apache.org>
Authored: Fri Sep 8 12:08:00 2017 +0530
Committer: Mugdha Varadkar <mugdha@apache.org>
Committed: Fri Sep 8 14:24:18 2017 +0530

----------------------------------------------------------------------
 .../server/upgrade/UpgradeCatalog260.java       |  40 +++++++
 .../RANGER_KMS/0.5.0.2.3/kerberos.json          |   6 --
 .../RANGER_KMS/1.0.0.3.0/kerberos.json          |   6 --
 .../HDP/2.5/services/RANGER_KMS/kerberos.json   |   6 --
 .../server/upgrade/UpgradeCatalog260Test.java   |  53 +++++++++
 .../test_kerberos_descriptor_ranger_kms.json    | 108 +++++++++++++++++++
 6 files changed, 201 insertions(+), 18 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/ambari/blob/a0594787/ambari-server/src/main/java/org/apache/ambari/server/upgrade/UpgradeCatalog260.java
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/java/org/apache/ambari/server/upgrade/UpgradeCatalog260.java
b/ambari-server/src/main/java/org/apache/ambari/server/upgrade/UpgradeCatalog260.java
index d1de998..d05f39a 100644
--- a/ambari-server/src/main/java/org/apache/ambari/server/upgrade/UpgradeCatalog260.java
+++ b/ambari-server/src/main/java/org/apache/ambari/server/upgrade/UpgradeCatalog260.java
@@ -30,10 +30,17 @@ import javax.persistence.Query;
 
 import org.apache.ambari.server.AmbariException;
 import org.apache.ambari.server.orm.DBAccessor;
+import org.apache.ambari.server.orm.dao.ArtifactDAO;
+import org.apache.ambari.server.orm.entities.ArtifactEntity;
 import org.apache.ambari.server.orm.entities.ClusterConfigEntity;
 import org.apache.ambari.server.state.Cluster;
 import org.apache.ambari.server.state.Clusters;
 import org.apache.ambari.server.state.Config;
+import org.apache.ambari.server.state.kerberos.KerberosComponentDescriptor;
+import org.apache.ambari.server.state.kerberos.KerberosDescriptor;
+import org.apache.ambari.server.state.kerberos.KerberosDescriptorFactory;
+import org.apache.ambari.server.state.kerberos.KerberosIdentityDescriptor;
+import org.apache.ambari.server.state.kerberos.KerberosServiceDescriptor;
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -387,6 +394,7 @@ public class UpgradeCatalog260 extends AbstractUpgradeCatalog {
     setUnmappedForOrphanedConfigs();
     removeSupersetFromDruid();
     ensureZeppelinProxyUserConfigs();
+    updateKerberosDescriptorArtifacts();
   }
 
   public int getCurrentVersionID() throws AmbariException, SQLException {
@@ -495,4 +503,36 @@ public class UpgradeCatalog260 extends AbstractUpgradeCatalog {
       }
     }
   }
+
+  /**
+   * {@inheritDoc}
+   */
+  @Override
+  protected void updateKerberosDescriptorArtifact(ArtifactDAO artifactDAO, ArtifactEntity
artifactEntity) throws AmbariException {
+    if (artifactEntity != null) {
+      Map<String, Object> data = artifactEntity.getArtifactData();
+      if (data != null) {
+        final KerberosDescriptor kerberosDescriptor = new KerberosDescriptorFactory().createInstance(data);
+        if (kerberosDescriptor != null) {
+          KerberosServiceDescriptor rangerKmsServiceDescriptor = kerberosDescriptor.getService("RANGER_KMS");
+          if (rangerKmsServiceDescriptor != null) {
+
+            KerberosIdentityDescriptor rangerKmsServiceIdentity = rangerKmsServiceDescriptor.getIdentity("/smokeuser");
+            if (rangerKmsServiceIdentity != null) {
+              rangerKmsServiceDescriptor.removeIdentity("/smokeuser");
+            }
+            KerberosComponentDescriptor rangerKmscomponentDescriptor = rangerKmsServiceDescriptor.getComponent("RANGER_KMS_SERVER");
+            if (rangerKmscomponentDescriptor != null) {
+              KerberosIdentityDescriptor rangerKmsComponentIdentity = rangerKmscomponentDescriptor.getIdentity("/smokeuser");
+              if (rangerKmsComponentIdentity != null) {
+                rangerKmscomponentDescriptor.removeIdentity("/smokeuser");
+              }
+            }
+          }
+          artifactEntity.setArtifactData(kerberosDescriptor.toMap());
+          artifactDAO.merge(artifactEntity);
+        }
+      }
+    }
+  }
 }

http://git-wip-us.apache.org/repos/asf/ambari/blob/a0594787/ambari-server/src/main/resources/common-services/RANGER_KMS/0.5.0.2.3/kerberos.json
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/RANGER_KMS/0.5.0.2.3/kerberos.json
b/ambari-server/src/main/resources/common-services/RANGER_KMS/0.5.0.2.3/kerberos.json
index 69d6b6c..208a04d 100644
--- a/ambari-server/src/main/resources/common-services/RANGER_KMS/0.5.0.2.3/kerberos.json
+++ b/ambari-server/src/main/resources/common-services/RANGER_KMS/0.5.0.2.3/kerberos.json
@@ -8,9 +8,6 @@
           "keytab": {
             "configuration": "kms-site/hadoop.kms.authentication.kerberos.keytab"
           }
-        },
-        {
-          "name": "/smokeuser"
         }
       ],
       "configurations": [
@@ -33,9 +30,6 @@
               "keytab": {
                 "configuration": "kms-site/hadoop.kms.authentication.signer.secret.provider.zookeeper.kerberos.keytab"
               }
-            },
-            {
-              "name": "/smokeuser"
             }
           ]
         }

http://git-wip-us.apache.org/repos/asf/ambari/blob/a0594787/ambari-server/src/main/resources/common-services/RANGER_KMS/1.0.0.3.0/kerberos.json
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/common-services/RANGER_KMS/1.0.0.3.0/kerberos.json
b/ambari-server/src/main/resources/common-services/RANGER_KMS/1.0.0.3.0/kerberos.json
index a54783e..8bf4cd8 100644
--- a/ambari-server/src/main/resources/common-services/RANGER_KMS/1.0.0.3.0/kerberos.json
+++ b/ambari-server/src/main/resources/common-services/RANGER_KMS/1.0.0.3.0/kerberos.json
@@ -8,9 +8,6 @@
           "keytab": {
             "configuration": "kms-site/hadoop.kms.authentication.kerberos.keytab"
           }
-        },
-        {
-          "name": "/smokeuser"
         }
       ],
       "auth_to_local_properties" : [
@@ -48,9 +45,6 @@
               }
             },
             {
-              "name": "/smokeuser"
-            },
-            {
               "name": "rangerkms",
               "principal": {
                 "value": "rangerkms/_HOST@${realm}",

http://git-wip-us.apache.org/repos/asf/ambari/blob/a0594787/ambari-server/src/main/resources/stacks/HDP/2.5/services/RANGER_KMS/kerberos.json
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/resources/stacks/HDP/2.5/services/RANGER_KMS/kerberos.json
b/ambari-server/src/main/resources/stacks/HDP/2.5/services/RANGER_KMS/kerberos.json
index a54783e..8bf4cd8 100644
--- a/ambari-server/src/main/resources/stacks/HDP/2.5/services/RANGER_KMS/kerberos.json
+++ b/ambari-server/src/main/resources/stacks/HDP/2.5/services/RANGER_KMS/kerberos.json
@@ -8,9 +8,6 @@
           "keytab": {
             "configuration": "kms-site/hadoop.kms.authentication.kerberos.keytab"
           }
-        },
-        {
-          "name": "/smokeuser"
         }
       ],
       "auth_to_local_properties" : [
@@ -48,9 +45,6 @@
               }
             },
             {
-              "name": "/smokeuser"
-            },
-            {
               "name": "rangerkms",
               "principal": {
                 "value": "rangerkms/_HOST@${realm}",

http://git-wip-us.apache.org/repos/asf/ambari/blob/a0594787/ambari-server/src/test/java/org/apache/ambari/server/upgrade/UpgradeCatalog260Test.java
----------------------------------------------------------------------
diff --git a/ambari-server/src/test/java/org/apache/ambari/server/upgrade/UpgradeCatalog260Test.java
b/ambari-server/src/test/java/org/apache/ambari/server/upgrade/UpgradeCatalog260Test.java
index 2a62f2e..33c29bc 100644
--- a/ambari-server/src/test/java/org/apache/ambari/server/upgrade/UpgradeCatalog260Test.java
+++ b/ambari-server/src/test/java/org/apache/ambari/server/upgrade/UpgradeCatalog260Test.java
@@ -22,6 +22,7 @@ import static org.easymock.EasyMock.anyObject;
 import static org.easymock.EasyMock.anyString;
 import static org.easymock.EasyMock.capture;
 import static org.easymock.EasyMock.createMock;
+import static org.easymock.EasyMock.createMockBuilder;
 import static org.easymock.EasyMock.eq;
 import static org.easymock.EasyMock.expect;
 import static org.easymock.EasyMock.expectLastCall;
@@ -30,6 +31,8 @@ import static org.easymock.EasyMock.replay;
 import static org.easymock.EasyMock.reset;
 import static org.easymock.EasyMock.verify;
 
+import java.io.File;
+import java.net.URL;
 import java.sql.Connection;
 import java.sql.ResultSet;
 import java.sql.SQLException;
@@ -51,11 +54,17 @@ import org.apache.ambari.server.controller.KerberosHelper;
 import org.apache.ambari.server.controller.MaintenanceStateHelper;
 import org.apache.ambari.server.orm.DBAccessor;
 import org.apache.ambari.server.orm.DBAccessor.DBColumnInfo;
+import org.apache.ambari.server.orm.dao.ArtifactDAO;
+import org.apache.ambari.server.orm.entities.ArtifactEntity;
 import org.apache.ambari.server.state.Cluster;
 import org.apache.ambari.server.state.Clusters;
 import org.apache.ambari.server.state.Config;
 import org.apache.ambari.server.state.Service;
 import org.apache.ambari.server.state.StackId;
+import org.apache.ambari.server.state.kerberos.KerberosComponentDescriptor;
+import org.apache.ambari.server.state.kerberos.KerberosDescriptor;
+import org.apache.ambari.server.state.kerberos.KerberosDescriptorFactory;
+import org.apache.ambari.server.state.kerberos.KerberosServiceDescriptor;
 import org.apache.ambari.server.state.stack.OsFamily;
 import org.easymock.Capture;
 import org.easymock.EasyMockRunner;
@@ -620,4 +629,48 @@ public class UpgradeCatalog260Test {
     Assert.assertEquals("existing_value", captureCoreSiteConfProperties.getValue().get("hadoop.proxyuser.zeppelin_user.hosts"));
     Assert.assertEquals("*", captureCoreSiteConfProperties.getValue().get("hadoop.proxyuser.zeppelin_user.groups"));
   }
+
+  @Test
+  public void testUpdateKerberosDescriptorArtifact() throws Exception {
+
+    URL systemResourceURL = ClassLoader.getSystemResource("kerberos/test_kerberos_descriptor_ranger_kms.json");
+    Assert.assertNotNull(systemResourceURL);
+
+    final KerberosDescriptor kerberosDescriptor = new KerberosDescriptorFactory().createInstance(new
File(systemResourceURL.getFile()));
+    Assert.assertNotNull(kerberosDescriptor);
+
+    KerberosServiceDescriptor serviceDescriptor;
+    serviceDescriptor = kerberosDescriptor.getService("RANGER_KMS");
+    Assert.assertNotNull(serviceDescriptor);
+    Assert.assertNotNull(serviceDescriptor.getIdentity("/smokeuser"));
+
+    KerberosComponentDescriptor componentDescriptor;
+    componentDescriptor = serviceDescriptor.getComponent("RANGER_KMS_SERVER");
+    Assert.assertNotNull(componentDescriptor);
+    Assert.assertNotNull(componentDescriptor.getIdentity("/smokeuser"));
+
+    ArtifactEntity artifactEntity = createMock(ArtifactEntity.class);
+
+    expect(artifactEntity.getArtifactData()).andReturn(kerberosDescriptor.toMap()).once();
+
+    Capture<Map<String, Object>> captureMap = newCapture();
+    artifactEntity.setArtifactData(capture(captureMap));
+    expectLastCall().once();
+
+    ArtifactDAO artifactDAO = createMock(ArtifactDAO.class);
+    expect(artifactDAO.merge(artifactEntity)).andReturn(artifactEntity).atLeastOnce();
+
+    replay(artifactDAO, artifactEntity);
+
+    UpgradeCatalog260 upgradeCatalog260 = createMockBuilder(UpgradeCatalog260.class).createMock();
+    upgradeCatalog260.updateKerberosDescriptorArtifact(artifactDAO, artifactEntity);
+    verify(artifactDAO, artifactEntity);
+
+    KerberosDescriptor kerberosDescriptorUpdated = new KerberosDescriptorFactory().createInstance(captureMap.getValue());
+    Assert.assertNotNull(kerberosDescriptorUpdated);
+
+    Assert.assertNull(kerberosDescriptorUpdated.getService("RANGER_KMS").getIdentity("/smokeuser"));
+    Assert.assertNull(kerberosDescriptorUpdated.getService("RANGER_KMS").getComponent("RANGER_KMS_SERVER").getIdentity("/smokeuser"));
+
+  }
 }

http://git-wip-us.apache.org/repos/asf/ambari/blob/a0594787/ambari-server/src/test/resources/kerberos/test_kerberos_descriptor_ranger_kms.json
----------------------------------------------------------------------
diff --git a/ambari-server/src/test/resources/kerberos/test_kerberos_descriptor_ranger_kms.json
b/ambari-server/src/test/resources/kerberos/test_kerberos_descriptor_ranger_kms.json
new file mode 100644
index 0000000..d7e048f
--- /dev/null
+++ b/ambari-server/src/test/resources/kerberos/test_kerberos_descriptor_ranger_kms.json
@@ -0,0 +1,108 @@
+{
+  "properties": {
+    "realm": "${kerberos-env/realm}",
+    "keytab_dir": "/etc/security/keytabs"
+  },
+  "identities": [
+    {
+      "name": "spnego",
+      "principal": {
+        "value": "HTTP/_HOST@${realm}",
+        "type": "service"
+      },
+      "keytab": {
+        "file": "${keytab_dir}/spnego.service.keytab",
+        "owner": {
+          "name": "root",
+          "access": "r"
+        },
+        "group": {
+          "name": "${cluster-env/user_group}",
+          "access": "r"
+        }
+      }
+    }
+  ],
+  "services": [
+    {
+      "name": "RANGER_KMS",
+      "identities": [
+        {
+          "name": "/spnego",
+          "keytab": {
+            "configuration": "kms-site/hadoop.kms.authentication.kerberos.keytab"
+          }
+        },
+        {
+          "name": "/smokeuser"
+        }
+      ],
+      "auth_to_local_properties" : [
+        "kms-site/hadoop.kms.authentication.kerberos.name.rules"
+      ],
+      "configurations": [
+        {
+          "kms-site": {
+            "hadoop.kms.authentication.type": "kerberos",
+            "hadoop.kms.authentication.kerberos.principal": "*"
+          }
+        },
+        {
+          "ranger-kms-audit": {
+            "xasecure.audit.jaas.Client.loginModuleName": "com.sun.security.auth.module.Krb5LoginModule",
+            "xasecure.audit.jaas.Client.loginModuleControlFlag": "required",
+            "xasecure.audit.jaas.Client.option.useKeyTab": "true",
+            "xasecure.audit.jaas.Client.option.storeKey": "false",
+            "xasecure.audit.jaas.Client.option.serviceName": "solr",
+            "xasecure.audit.destination.solr.force.use.inmemory.jaas.config": "true"
+          }
+        }
+      ],
+      "components": [
+        {
+          "name": "RANGER_KMS_SERVER",
+          "identities": [
+            {
+              "name": "/spnego",
+              "principal": {
+                "configuration": "kms-site/hadoop.kms.authentication.signer.secret.provider.zookeeper.kerberos.principal"
+              },
+              "keytab": {
+                "configuration": "kms-site/hadoop.kms.authentication.signer.secret.provider.zookeeper.kerberos.keytab"
+              }
+            },
+            {
+              "name": "/smokeuser"
+            },
+            {
+              "name": "rangerkms",
+              "principal": {
+                "value": "rangerkms/_HOST@${realm}",
+                "type" : "service",
+                "configuration": "dbks-site/ranger.ks.kerberos.principal",
+                "local_username" : "keyadmin"
+              },
+              "keytab": {
+                "file": "${keytab_dir}/rangerkms.service.keytab",
+                "owner": {
+                  "name": "${kms-env/kms_user}",
+                  "access": "r"
+                },
+                "configuration": "dbks-site/ranger.ks.kerberos.keytab"
+              }
+            },
+            {
+              "name": "/RANGER_KMS/RANGER_KMS_SERVER/rangerkms",
+              "principal": {
+                "configuration": "ranger-kms-audit/xasecure.audit.jaas.Client.option.principal"
+              },
+              "keytab": {
+                "configuration": "ranger-kms-audit/xasecure.audit.jaas.Client.option.keyTab"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file


Mime
View raw message