Return-Path: X-Original-To: apmail-hadoop-common-commits-archive@www.apache.org Delivered-To: apmail-hadoop-common-commits-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 6E7AC17E6F for ; Thu, 6 Nov 2014 01:50:05 +0000 (UTC) Received: (qmail 12051 invoked by uid 500); 6 Nov 2014 01:50:05 -0000 Delivered-To: apmail-hadoop-common-commits-archive@hadoop.apache.org Received: (qmail 11967 invoked by uid 500); 6 Nov 2014 01:50:05 -0000 Mailing-List: contact common-commits-help@hadoop.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: common-dev@hadoop.apache.org Delivered-To: mailing list common-commits@hadoop.apache.org Received: (qmail 11954 invoked by uid 99); 6 Nov 2014 01:50:05 -0000 Received: from tyr.zones.apache.org (HELO tyr.zones.apache.org) (140.211.11.114) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 06 Nov 2014 01:50:05 +0000 Received: by tyr.zones.apache.org (Postfix, from userid 65534) id C3B3890A5F0; Thu, 6 Nov 2014 01:50:04 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: atm@apache.org To: common-commits@hadoop.apache.org Date: Thu, 06 Nov 2014 01:50:04 -0000 Message-Id: X-Mailer: ASF-Git Admin Mailer Subject: [1/2] git commit: HADOOP-11272. Allow ZKSignerSecretProvider and ZKDelegationTokenSecretManager to use the same curator client. Contributed by Arun Suresh. Repository: hadoop Updated Branches: refs/heads/branch-2 9082fe4e2 -> e96f0c6aa refs/heads/trunk 6ba52d88e -> 8a261e68e HADOOP-11272. Allow ZKSignerSecretProvider and ZKDelegationTokenSecretManager to use the same curator client. Contributed by Arun Suresh. Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/8a261e68 Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/8a261e68 Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/8a261e68 Branch: refs/heads/trunk Commit: 8a261e68e4177b47be01ceae7310ea56aeb7ca38 Parents: 6ba52d8 Author: Aaron T. Myers Authored: Wed Nov 5 17:47:22 2014 -0800 Committer: Aaron T. Myers Committed: Wed Nov 5 17:47:22 2014 -0800 ---------------------------------------------------------------------- .../server/AuthenticationFilter.java | 21 +++- .../server/TestAuthenticationFilter.java | 2 + hadoop-common-project/hadoop-common/CHANGES.txt | 3 + .../ZKDelegationTokenSecretManager.java | 6 +- .../DelegationTokenAuthenticationFilter.java | 22 ++-- .../hadoop/crypto/key/kms/server/TestKMS.java | 101 +++++++++++++++++++ 6 files changed, 142 insertions(+), 13 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/hadoop/blob/8a261e68/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java index a070345..58d97ca 100644 --- a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java +++ b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java @@ -219,6 +219,19 @@ public class AuthenticationFilter implements Filter { authHandlerClassName = authHandlerName; } + validity = Long.parseLong(config.getProperty(AUTH_TOKEN_VALIDITY, "36000")) + * 1000; //10 hours + initializeSecretProvider(filterConfig); + + initializeAuthHandler(authHandlerClassName, filterConfig); + + + cookieDomain = config.getProperty(COOKIE_DOMAIN, null); + cookiePath = config.getProperty(COOKIE_PATH, null); + } + + protected void initializeAuthHandler(String authHandlerClassName, FilterConfig filterConfig) + throws ServletException { try { Class klass = Thread.currentThread().getContextClassLoader().loadClass(authHandlerClassName); authHandler = (AuthenticationHandler) klass.newInstance(); @@ -230,9 +243,10 @@ public class AuthenticationFilter implements Filter { } catch (IllegalAccessException ex) { throw new ServletException(ex); } + } - validity = Long.parseLong(config.getProperty(AUTH_TOKEN_VALIDITY, "36000")) - * 1000; //10 hours + protected void initializeSecretProvider(FilterConfig filterConfig) + throws ServletException { secretProvider = (SignerSecretProvider) filterConfig.getServletContext(). getAttribute(SIGNER_SECRET_PROVIDER_ATTRIBUTE); if (secretProvider == null) { @@ -254,9 +268,6 @@ public class AuthenticationFilter implements Filter { customSecretProvider = true; } signer = new Signer(secretProvider); - - cookieDomain = config.getProperty(COOKIE_DOMAIN, null); - cookiePath = config.getProperty(COOKIE_PATH, null); } @SuppressWarnings("unchecked") http://git-wip-us.apache.org/repos/asf/hadoop/blob/8a261e68/hadoop-common-project/hadoop-auth/src/test/java/org/apache/hadoop/security/authentication/server/TestAuthenticationFilter.java ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-auth/src/test/java/org/apache/hadoop/security/authentication/server/TestAuthenticationFilter.java b/hadoop-common-project/hadoop-auth/src/test/java/org/apache/hadoop/security/authentication/server/TestAuthenticationFilter.java index 5d93fcf..3b6b958 100644 --- a/hadoop-common-project/hadoop-auth/src/test/java/org/apache/hadoop/security/authentication/server/TestAuthenticationFilter.java +++ b/hadoop-common-project/hadoop-auth/src/test/java/org/apache/hadoop/security/authentication/server/TestAuthenticationFilter.java @@ -283,6 +283,8 @@ public class TestAuthenticationFilter { filter = new AuthenticationFilter(); try { FilterConfig config = Mockito.mock(FilterConfig.class); + ServletContext sc = Mockito.mock(ServletContext.class); + Mockito.when(config.getServletContext()).thenReturn(sc); Mockito.when(config.getInitParameter(AuthenticationFilter.AUTH_TYPE)).thenReturn("kerberos"); Mockito.when(config.getInitParameterNames()).thenReturn( new Vector(Arrays.asList(AuthenticationFilter.AUTH_TYPE)).elements()); http://git-wip-us.apache.org/repos/asf/hadoop/blob/8a261e68/hadoop-common-project/hadoop-common/CHANGES.txt ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt index 8567e1e..55ef9d3 100644 --- a/hadoop-common-project/hadoop-common/CHANGES.txt +++ b/hadoop-common-project/hadoop-common/CHANGES.txt @@ -409,6 +409,9 @@ Release 2.7.0 - UNRELEASED HADOOP-10714. AmazonS3Client.deleteObjects() need to be limited to 1000 entries per call. (Juan Yu via atm) + HADOOP-11272. Allow ZKSignerSecretProvider and + ZKDelegationTokenSecretManager to use the same curator client. (Arun Suresh via atm) + Release 2.6.0 - UNRELEASED INCOMPATIBLE CHANGES http://git-wip-us.apache.org/repos/asf/hadoop/blob/8a261e68/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/ZKDelegationTokenSecretManager.java ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/ZKDelegationTokenSecretManager.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/ZKDelegationTokenSecretManager.java index 82dd2da..ebc45a5 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/ZKDelegationTokenSecretManager.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/ZKDelegationTokenSecretManager.java @@ -136,7 +136,11 @@ public abstract class ZKDelegationTokenSecretManager c = + new KMSCallable() { + @Override + public KeyProvider call() throws Exception { + final Configuration conf = new Configuration(); + conf.setInt(KeyProvider.DEFAULT_BITLENGTH_NAME, 128); + final URI uri = createKMSUri(getKMSUrl()); + + final KeyProvider kp = + doAs("SET_KEY_MATERIAL", + new PrivilegedExceptionAction() { + @Override + public KeyProvider run() throws Exception { + KMSClientProvider kp = new KMSClientProvider(uri, conf); + kp.createKey("k1", new byte[16], + new KeyProvider.Options(conf)); + kp.createKey("k2", new byte[16], + new KeyProvider.Options(conf)); + kp.createKey("k3", new byte[16], + new KeyProvider.Options(conf)); + return kp; + } + }); + return kp; + } + }; + + runServer(null, null, testDir, c); + } finally { + if (zkServer != null) { + zkServer.stop(); + zkServer.close(); + } + } + + } + + + @Test public void testProxyUserKerb() throws Exception { doProxyUserTest(true); }