Java Code Examples for org.apache.hadoop.security.UserGroupInformation#checkTGTAndReloginFromKeytab()

/**
 * This method uses the currentUser, and real user to create a proxy
 * @param effectiveUser The user who is being proxied by the real user
 * @param realUser The actual user who does the command
 * @return Proxy UserGroupInformation
 * @throws IOException If proxying fails
 */
UserGroupInformation getUserGroupInformation(
        String effectiveUser,
        UserGroupInformation realUser)
        throws IOException {
  Preconditions.checkNotNull(effectiveUser);
  Preconditions.checkNotNull(realUser);
  realUser.checkTGTAndReloginFromKeytab();

  UserGroupInformation ugi =
          UserGroupInformation.createProxyUser(effectiveUser, realUser);
  if (LOG.isDebugEnabled()){
    LOG.debug(String.format("Created ugi:" +
            " %s for username: %s", ugi, effectiveUser));
  }
  return ugi;
}
 

T run() throws IOException {
  UserGroupInformation connectUgi = ugi.getRealUser();
  if (connectUgi == null) {
    connectUgi = ugi;
  }
  if (op.getRequireAuth()) {
    connectUgi.checkTGTAndReloginFromKeytab();
  }
  try {
    // the entire lifecycle of the connection must be run inside the
    // doAs to ensure authentication is performed correctly
    return connectUgi.doAs(
        new PrivilegedExceptionAction<T>() {
          @Override
          public T run() throws IOException {
            return runWithRetry();
          }
        });
  } catch (InterruptedException e) {
    throw new IOException(e);
  }
}
 

/**
 * This method uses the currentUser, and real user to create a proxy
 * @param effectiveUser The user who is being proxied by the real user
 * @param realUser The actual user who does the command
 * @return Proxy UserGroupInformation
 * @throws IOException If proxying fails
 */
UserGroupInformation getUserGroupInformation(
        String effectiveUser,
        UserGroupInformation realUser)
        throws IOException {
  Preconditions.checkNotNull(effectiveUser);
  Preconditions.checkNotNull(realUser);
  realUser.checkTGTAndReloginFromKeytab();

  UserGroupInformation ugi =
          UserGroupInformation.createProxyUser(effectiveUser, realUser);
  if (LOG.isDebugEnabled()){
    LOG.debug(String.format("Created ugi:" +
            " %s for username: %s", ugi, effectiveUser));
  }
  return ugi;
}
 

T run() throws IOException {
  UserGroupInformation connectUgi = ugi.getRealUser();
  if (connectUgi == null) {
    connectUgi = ugi;
  }
  if (op.getRequireAuth()) {
    connectUgi.checkTGTAndReloginFromKeytab();
  }
  try {
    // the entire lifecycle of the connection must be run inside the
    // doAs to ensure authentication is performed correctly
    return connectUgi.doAs(
        new PrivilegedExceptionAction<T>() {
          @Override
          public T run() throws IOException {
            return runWithRetry();
          }
        });
  } catch (InterruptedException e) {
    throw new IOException(e);
  }
}
 

/**
 * Checks if security is enabled and if so, launches chore for refreshing kerberos ticket.
 * @return a ScheduledChore for renewals.
 */
@InterfaceAudience.Private
public static ScheduledChore getAuthRenewalChore(final UserGroupInformation user) {
  if (!user.hasKerberosCredentials()) {
    return null;
  }

  Stoppable stoppable = createDummyStoppable();
  // if you're in debug mode this is useful to avoid getting spammed by the getTGT()
  // you can increase this, keeping in mind that the default refresh window is 0.8
  // e.g. 5min tgt * 0.8 = 4min refresh so interval is better be way less than 1min
  final int CHECK_TGT_INTERVAL = 30 * 1000; // 30sec
  return new ScheduledChore("RefreshCredentials", stoppable, CHECK_TGT_INTERVAL) {
    @Override
    protected void chore() {
      try {
        user.checkTGTAndReloginFromKeytab();
      } catch (IOException e) {
        LOG.error("Got exception while trying to refresh credentials: " + e.getMessage(), e);
      }
    }
  };
}
 

private void reloginExpiringKeytabUser() throws MetaException {
  if(UserGroupInformation.isSecurityEnabled()) {
    // renew the TGT if required
    try {
      UserGroupInformation ugi = UserGroupInformation.getLoginUser();
      if (ugi.isFromKeytab()) {
        ugi.checkTGTAndReloginFromKeytab();
      }
    } catch (IOException e) {
      final String msg = "Error doing relogin using keytab " + e.getMessage();
      logger.error(msg, e);
      throw new MetaException(msg);
    }
  }
}
 

private void reloginExpiringKeytabUser() throws MetaException {
  if(UserGroupInformation.isSecurityEnabled()) {
    // renew the TGT if required
    try {
      UserGroupInformation ugi = UserGroupInformation.getLoginUser();
      if (ugi.isFromKeytab()) {
        ugi.checkTGTAndReloginFromKeytab();
      }
    } catch (IOException e) {
      final String msg = "Error doing relogin using keytab " + e.getMessage();
      logger.error(msg, e);
      throw new MetaException(msg);
    }
  }
}
 

public static UserGroupInformation getUGILoginUser() {
	UserGroupInformation ret = ugiLoginUser;

	if (ret == null) {
		try {
			// Do not cache ugiLoginUser if it is not explicitly set with
			// setUGILoginUser.
			// It appears that the user represented by
			// the returned object is periodically logged out and logged back
			// in when the token is scheduled to expire. So it is better
			// to get the user object every time from UserGroupInformation class and
			// not cache it
			ret = getLoginUser();
		} catch (IOException e) {
			logger.error("Error getting UGI.", e);
		}
	}

	if(ret != null) {
		try {
		ret.checkTGTAndReloginFromKeytab();
		} catch(IOException ioe) {
			logger.error("Error renewing TGT and relogin. Ignoring Exception, and continuing with the old TGT", ioe);
		}
	}

	return ret;
}