Java Code Examples for org.apache.hadoop.hdfs.security.token.delegation.DelegationTokenSecretManager#startThreads()

The following examples show how to use org.apache.hadoop.hdfs.security.token.delegation.DelegationTokenSecretManager#startThreads() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.

Example 1

Source File: TestWebHdfsUrl.java From hadoop with Apache License 2.0

6 votes

private WebHdfsFileSystem getWebHdfsFileSystem(UserGroupInformation ugi,
    Configuration conf) throws IOException {
  if (UserGroupInformation.isSecurityEnabled()) {
    DelegationTokenIdentifier dtId = new DelegationTokenIdentifier(new Text(
        ugi.getUserName()), null, null);
    FSNamesystem namesystem = mock(FSNamesystem.class);
    DelegationTokenSecretManager dtSecretManager = new DelegationTokenSecretManager(
        86400000, 86400000, 86400000, 86400000, namesystem);
    dtSecretManager.startThreads();
    Token<DelegationTokenIdentifier> token = new Token<DelegationTokenIdentifier>(
        dtId, dtSecretManager);
    SecurityUtil.setTokenService(
        token, NetUtils.createSocketAddr(uri.getAuthority()));
    token.setKind(WebHdfsFileSystem.TOKEN_KIND);
    ugi.addToken(token);
  }
  return (WebHdfsFileSystem) FileSystem.get(uri, conf);
}

Example 2

Source File: TestWebHdfsUrl.java From big-c with Apache License 2.0

6 votes

private WebHdfsFileSystem getWebHdfsFileSystem(UserGroupInformation ugi,
    Configuration conf) throws IOException {
  if (UserGroupInformation.isSecurityEnabled()) {
    DelegationTokenIdentifier dtId = new DelegationTokenIdentifier(new Text(
        ugi.getUserName()), null, null);
    FSNamesystem namesystem = mock(FSNamesystem.class);
    DelegationTokenSecretManager dtSecretManager = new DelegationTokenSecretManager(
        86400000, 86400000, 86400000, 86400000, namesystem);
    dtSecretManager.startThreads();
    Token<DelegationTokenIdentifier> token = new Token<DelegationTokenIdentifier>(
        dtId, dtSecretManager);
    SecurityUtil.setTokenService(
        token, NetUtils.createSocketAddr(uri.getAuthority()));
    token.setKind(WebHdfsFileSystem.TOKEN_KIND);
    ugi.addToken(token);
  }
  return (WebHdfsFileSystem) FileSystem.get(uri, conf);
}

Example 3

Source File: TestClientProtocolWithDelegationToken.java From hadoop with Apache License 2.0

4 votes

@Test
public void testDelegationTokenRpc() throws Exception {
  ClientProtocol mockNN = mock(ClientProtocol.class);
  FSNamesystem mockNameSys = mock(FSNamesystem.class);

  DelegationTokenSecretManager sm = new DelegationTokenSecretManager(
      DFSConfigKeys.DFS_NAMENODE_DELEGATION_KEY_UPDATE_INTERVAL_DEFAULT,
      DFSConfigKeys.DFS_NAMENODE_DELEGATION_KEY_UPDATE_INTERVAL_DEFAULT,
      DFSConfigKeys.DFS_NAMENODE_DELEGATION_TOKEN_MAX_LIFETIME_DEFAULT,
      3600000, mockNameSys);
  sm.startThreads();
  final Server server = new RPC.Builder(conf)
      .setProtocol(ClientProtocol.class).setInstance(mockNN)
      .setBindAddress(ADDRESS).setPort(0).setNumHandlers(5).setVerbose(true)
      .setSecretManager(sm).build();
  
  server.start();

  final UserGroupInformation current = UserGroupInformation.getCurrentUser();
  final InetSocketAddress addr = NetUtils.getConnectAddress(server);
  String user = current.getUserName();
  Text owner = new Text(user);
  DelegationTokenIdentifier dtId = new DelegationTokenIdentifier(owner, owner, null);
  Token<DelegationTokenIdentifier> token = new Token<DelegationTokenIdentifier>(
      dtId, sm);
  SecurityUtil.setTokenService(token, addr);
  LOG.info("Service for token is " + token.getService());
  current.addToken(token);
  current.doAs(new PrivilegedExceptionAction<Object>() {
    @Override
    public Object run() throws Exception {
      ClientProtocol proxy = null;
      try {
        proxy = RPC.getProxy(ClientProtocol.class,
            ClientProtocol.versionID, addr, conf);
        proxy.getServerDefaults();
      } finally {
        server.stop();
        if (proxy != null) {
          RPC.stopProxy(proxy);
        }
      }
      return null;
    }
  });
}

Example 4

Source File: TestSecurityTokenEditLog.java From hadoop with Apache License 2.0

4 votes

@Test(timeout=10000)
public void testEditsForCancelOnTokenExpire() throws IOException,
InterruptedException {
  long renewInterval = 2000;
  Configuration conf = new Configuration();
  conf.setBoolean(
      DFSConfigKeys.DFS_NAMENODE_DELEGATION_TOKEN_ALWAYS_USE_KEY, true);
  conf.setLong(DFS_NAMENODE_DELEGATION_TOKEN_RENEW_INTERVAL_KEY, renewInterval);
  conf.setLong(DFS_NAMENODE_DELEGATION_TOKEN_MAX_LIFETIME_KEY, renewInterval*2);

  Text renewer = new Text(UserGroupInformation.getCurrentUser().getUserName());
  FSImage fsImage = mock(FSImage.class);
  FSEditLog log = mock(FSEditLog.class);
  doReturn(log).when(fsImage).getEditLog();   
  FSNamesystem fsn = new FSNamesystem(conf, fsImage);
  
  DelegationTokenSecretManager dtsm = fsn.getDelegationTokenSecretManager();
  try {
    dtsm.startThreads();
    
    // get two tokens
    Token<DelegationTokenIdentifier> token1 = fsn.getDelegationToken(renewer);
    Token<DelegationTokenIdentifier> token2 = fsn.getDelegationToken(renewer);
    DelegationTokenIdentifier ident1 =
        token1.decodeIdentifier();
    DelegationTokenIdentifier ident2 =
        token2.decodeIdentifier();
    
    // verify we got the tokens
    verify(log, times(1)).logGetDelegationToken(eq(ident1), anyLong());
    verify(log, times(1)).logGetDelegationToken(eq(ident2), anyLong());
    
    // this is a little tricky because DTSM doesn't let us set scan interval
    // so need to periodically sleep, then stop/start threads to force scan
    
    // renew first token 1/2 to expire
    Thread.sleep(renewInterval/2);
    fsn.renewDelegationToken(token2);
    verify(log, times(1)).logRenewDelegationToken(eq(ident2), anyLong());
    // force scan and give it a little time to complete
    dtsm.stopThreads(); dtsm.startThreads();
    Thread.sleep(250);
    // no token has expired yet 
    verify(log, times(0)).logCancelDelegationToken(eq(ident1));
    verify(log, times(0)).logCancelDelegationToken(eq(ident2));
    
    // sleep past expiration of 1st non-renewed token
    Thread.sleep(renewInterval/2);
    dtsm.stopThreads(); dtsm.startThreads();
    Thread.sleep(250);
    // non-renewed token should have implicitly been cancelled
    verify(log, times(1)).logCancelDelegationToken(eq(ident1));
    verify(log, times(0)).logCancelDelegationToken(eq(ident2));
    
    // sleep past expiration of 2nd renewed token
    Thread.sleep(renewInterval/2);
    dtsm.stopThreads(); dtsm.startThreads();
    Thread.sleep(250);
    // both tokens should have been implicitly cancelled by now
    verify(log, times(1)).logCancelDelegationToken(eq(ident1));
    verify(log, times(1)).logCancelDelegationToken(eq(ident2));
  } finally {
    dtsm.stopThreads();
  }
}

Example 5

Source File: TestClientProtocolWithDelegationToken.java From big-c with Apache License 2.0

4 votes

@Test
public void testDelegationTokenRpc() throws Exception {
  ClientProtocol mockNN = mock(ClientProtocol.class);
  FSNamesystem mockNameSys = mock(FSNamesystem.class);

  DelegationTokenSecretManager sm = new DelegationTokenSecretManager(
      DFSConfigKeys.DFS_NAMENODE_DELEGATION_KEY_UPDATE_INTERVAL_DEFAULT,
      DFSConfigKeys.DFS_NAMENODE_DELEGATION_KEY_UPDATE_INTERVAL_DEFAULT,
      DFSConfigKeys.DFS_NAMENODE_DELEGATION_TOKEN_MAX_LIFETIME_DEFAULT,
      3600000, mockNameSys);
  sm.startThreads();
  final Server server = new RPC.Builder(conf)
      .setProtocol(ClientProtocol.class).setInstance(mockNN)
      .setBindAddress(ADDRESS).setPort(0).setNumHandlers(5).setVerbose(true)
      .setSecretManager(sm).build();
  
  server.start();

  final UserGroupInformation current = UserGroupInformation.getCurrentUser();
  final InetSocketAddress addr = NetUtils.getConnectAddress(server);
  String user = current.getUserName();
  Text owner = new Text(user);
  DelegationTokenIdentifier dtId = new DelegationTokenIdentifier(owner, owner, null);
  Token<DelegationTokenIdentifier> token = new Token<DelegationTokenIdentifier>(
      dtId, sm);
  SecurityUtil.setTokenService(token, addr);
  LOG.info("Service for token is " + token.getService());
  current.addToken(token);
  current.doAs(new PrivilegedExceptionAction<Object>() {
    @Override
    public Object run() throws Exception {
      ClientProtocol proxy = null;
      try {
        proxy = RPC.getProxy(ClientProtocol.class,
            ClientProtocol.versionID, addr, conf);
        proxy.getServerDefaults();
      } finally {
        server.stop();
        if (proxy != null) {
          RPC.stopProxy(proxy);
        }
      }
      return null;
    }
  });
}

Example 6

Source File: TestSecurityTokenEditLog.java From big-c with Apache License 2.0

4 votes

@Test(timeout=10000)
public void testEditsForCancelOnTokenExpire() throws IOException,
InterruptedException {
  long renewInterval = 2000;
  Configuration conf = new Configuration();
  conf.setBoolean(
      DFSConfigKeys.DFS_NAMENODE_DELEGATION_TOKEN_ALWAYS_USE_KEY, true);
  conf.setLong(DFS_NAMENODE_DELEGATION_TOKEN_RENEW_INTERVAL_KEY, renewInterval);
  conf.setLong(DFS_NAMENODE_DELEGATION_TOKEN_MAX_LIFETIME_KEY, renewInterval*2);

  Text renewer = new Text(UserGroupInformation.getCurrentUser().getUserName());
  FSImage fsImage = mock(FSImage.class);
  FSEditLog log = mock(FSEditLog.class);
  doReturn(log).when(fsImage).getEditLog();   
  FSNamesystem fsn = new FSNamesystem(conf, fsImage);
  
  DelegationTokenSecretManager dtsm = fsn.getDelegationTokenSecretManager();
  try {
    dtsm.startThreads();
    
    // get two tokens
    Token<DelegationTokenIdentifier> token1 = fsn.getDelegationToken(renewer);
    Token<DelegationTokenIdentifier> token2 = fsn.getDelegationToken(renewer);
    DelegationTokenIdentifier ident1 =
        token1.decodeIdentifier();
    DelegationTokenIdentifier ident2 =
        token2.decodeIdentifier();
    
    // verify we got the tokens
    verify(log, times(1)).logGetDelegationToken(eq(ident1), anyLong());
    verify(log, times(1)).logGetDelegationToken(eq(ident2), anyLong());
    
    // this is a little tricky because DTSM doesn't let us set scan interval
    // so need to periodically sleep, then stop/start threads to force scan
    
    // renew first token 1/2 to expire
    Thread.sleep(renewInterval/2);
    fsn.renewDelegationToken(token2);
    verify(log, times(1)).logRenewDelegationToken(eq(ident2), anyLong());
    // force scan and give it a little time to complete
    dtsm.stopThreads(); dtsm.startThreads();
    Thread.sleep(250);
    // no token has expired yet 
    verify(log, times(0)).logCancelDelegationToken(eq(ident1));
    verify(log, times(0)).logCancelDelegationToken(eq(ident2));
    
    // sleep past expiration of 1st non-renewed token
    Thread.sleep(renewInterval/2);
    dtsm.stopThreads(); dtsm.startThreads();
    Thread.sleep(250);
    // non-renewed token should have implicitly been cancelled
    verify(log, times(1)).logCancelDelegationToken(eq(ident1));
    verify(log, times(0)).logCancelDelegationToken(eq(ident2));
    
    // sleep past expiration of 2nd renewed token
    Thread.sleep(renewInterval/2);
    dtsm.stopThreads(); dtsm.startThreads();
    Thread.sleep(250);
    // both tokens should have been implicitly cancelled by now
    verify(log, times(1)).logCancelDelegationToken(eq(ident1));
    verify(log, times(1)).logCancelDelegationToken(eq(ident2));
  } finally {
    dtsm.stopThreads();
  }
}