Return-Path: X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by cust-asf2.ponee.io (Postfix) with ESMTP id 02EAB200BBD for ; Tue, 25 Oct 2016 04:26:18 +0200 (CEST) Received: by cust-asf.ponee.io (Postfix) id 01C3F160B03; Tue, 25 Oct 2016 02:26:18 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id 2B61A160B00 for ; Tue, 25 Oct 2016 04:26:17 +0200 (CEST) Received: (qmail 42280 invoked by uid 500); 25 Oct 2016 02:26:12 -0000 Mailing-List: contact common-commits-help@hadoop.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Delivered-To: mailing list common-commits@hadoop.apache.org Received: (qmail 41843 invoked by uid 99); 25 Oct 2016 02:26:12 -0000 Received: from git1-us-west.apache.org (HELO git1-us-west.apache.org) (140.211.11.23) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 25 Oct 2016 02:26:12 +0000 Received: by git1-us-west.apache.org (ASF Mail Server at git1-us-west.apache.org, from userid 33) id 6949DF1593; Tue, 25 Oct 2016 02:26:12 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: subru@apache.org To: common-commits@hadoop.apache.org Date: Tue, 25 Oct 2016 02:26:25 -0000 Message-Id: <0ca529827744408294bc3bde4dd4af5e@git.apache.org> In-Reply-To: <8ce2c3e7b1464c57aa1949fba5d7f228@git.apache.org> References: <8ce2c3e7b1464c57aa1949fba5d7f228@git.apache.org> X-Mailer: ASF-Git Admin Mailer Subject: [15/50] [abbrv] hadoop git commit: HDFS-10757. KMSClientProvider combined with KeyProviderCache can result in wrong UGI being used. Contributed by Xiaoyu Yao. archived-at: Tue, 25 Oct 2016 02:26:18 -0000 HDFS-10757. KMSClientProvider combined with KeyProviderCache can result in wrong UGI being used. Contributed by Xiaoyu Yao. Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/be723722 Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/be723722 Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/be723722 Branch: refs/heads/YARN-2915 Commit: be7237224819e2491aef91cd4f055c7efcf7b90d Parents: 23d7d53 Author: Xiaoyu Yao Authored: Fri Oct 21 14:23:02 2016 -0700 Committer: Xiaoyu Yao Committed: Fri Oct 21 14:23:02 2016 -0700 ---------------------------------------------------------------------- .../crypto/key/kms/KMSClientProvider.java | 52 ++++++++++---------- .../hadoop/security/UserGroupInformation.java | 14 ++++++ 2 files changed, 40 insertions(+), 26 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/hadoop/blob/be723722/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java index 701e116..db0ee85 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java @@ -373,7 +373,6 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension, private ConnectionConfigurator configurator; private DelegationTokenAuthenticatedURL.Token authToken; private final int authRetry; - private final UserGroupInformation actualUgi; @Override public String toString() { @@ -455,15 +454,6 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension, KMS_CLIENT_ENC_KEY_CACHE_NUM_REFILL_THREADS_DEFAULT), new EncryptedQueueRefiller()); authToken = new DelegationTokenAuthenticatedURL.Token(); - UserGroupInformation.AuthenticationMethod authMethod = - UserGroupInformation.getCurrentUser().getAuthenticationMethod(); - if (authMethod == UserGroupInformation.AuthenticationMethod.PROXY) { - actualUgi = UserGroupInformation.getCurrentUser().getRealUser(); - } else if (authMethod == UserGroupInformation.AuthenticationMethod.TOKEN) { - actualUgi = UserGroupInformation.getLoginUser(); - } else { - actualUgi =UserGroupInformation.getCurrentUser(); - } } private static Path extractKMSPath(URI uri) throws MalformedURLException, IOException { @@ -530,19 +520,9 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension, throws IOException { HttpURLConnection conn; try { - // if current UGI is different from UGI at constructor time, behave as - // proxyuser - UserGroupInformation currentUgi = UserGroupInformation.getCurrentUser(); - final String doAsUser = (currentUgi.getAuthenticationMethod() == - UserGroupInformation.AuthenticationMethod.PROXY) - ? currentUgi.getShortUserName() : null; - - // If current UGI contains kms-dt && is not proxy, doAs it to use its dt. - // Otherwise, create the HTTP connection using the UGI at constructor time - UserGroupInformation ugiToUse = - (currentUgiContainsKmsDt() && doAsUser == null) ? - currentUgi : actualUgi; - conn = ugiToUse.doAs(new PrivilegedExceptionAction() { + final String doAsUser = getDoAsUser(); + conn = getActualUgi().doAs(new PrivilegedExceptionAction + () { @Override public HttpURLConnection run() throws Exception { DelegationTokenAuthenticatedURL authUrl = @@ -919,7 +899,7 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension, token, url, doAsUser); final DelegationTokenAuthenticatedURL authUrl = new DelegationTokenAuthenticatedURL(configurator); - return actualUgi.doAs( + return getActualUgi().doAs( new PrivilegedExceptionAction() { @Override public Long run() throws Exception { @@ -942,7 +922,7 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension, final String doAsUser = getDoAsUser(); final DelegationTokenAuthenticatedURL.Token token = generateDelegationToken(dToken); - return actualUgi.doAs( + return getActualUgi().doAs( new PrivilegedExceptionAction() { @Override public Void run() throws Exception { @@ -1014,7 +994,7 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension, new DelegationTokenAuthenticatedURL(configurator); try { final String doAsUser = getDoAsUser(); - token = actualUgi.doAs(new PrivilegedExceptionAction>() { + token = getActualUgi().doAs(new PrivilegedExceptionAction>() { @Override public Token run() throws Exception { // Not using the cached token here.. Creating a new token here @@ -1060,6 +1040,26 @@ public class KMSClientProvider extends KeyProvider implements CryptoExtension, return false; } + private UserGroupInformation getActualUgi() throws IOException { + final UserGroupInformation currentUgi = UserGroupInformation + .getCurrentUser(); + if (LOG.isDebugEnabled()) { + UserGroupInformation.logAllUserInfo(currentUgi); + } + // Use current user by default + UserGroupInformation actualUgi = currentUgi; + if (currentUgi.getRealUser() != null) { + // Use real user for proxy user + actualUgi = currentUgi.getRealUser(); + } else if (!currentUgiContainsKmsDt() && + !currentUgi.hasKerberosCredentials()) { + // Use login user for user that does not have either + // Kerberos credential or KMS delegation token for KMS operations + actualUgi = currentUgi.getLoginUser(); + } + return actualUgi; + } + /** * Shutdown valueQueue executor threads */ http://git-wip-us.apache.org/repos/asf/hadoop/blob/be723722/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java index e8711b0..bcaf303 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java @@ -1823,6 +1823,20 @@ public class UserGroupInformation { } } + public static void logAllUserInfo(UserGroupInformation ugi) throws + IOException { + if (LOG.isDebugEnabled()) { + LOG.debug("UGI: " + ugi); + if (ugi.getRealUser() != null) { + LOG.debug("+RealUGI: " + ugi.getRealUser()); + } + LOG.debug("+LoginUGI: " + ugi.getLoginUser()); + for (Token token : ugi.getTokens()) { + LOG.debug("+UGI token: " + token); + } + } + } + private void print() throws IOException { System.out.println("User: " + getUserName()); System.out.print("Group Ids: "); --------------------------------------------------------------------- To unsubscribe, e-mail: common-commits-unsubscribe@hadoop.apache.org For additional commands, e-mail: common-commits-help@hadoop.apache.org