Java Code Examples for org.apache.hadoop.security.authentication.util.KerberosUtil#getKrb5LoginModuleName()

The following examples show how to use org.apache.hadoop.security.authentication.util.KerberosUtil#getKrb5LoginModuleName() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.

Example 1

Source File: KerberosConfiguration.java From hadoop with Apache License 2.0

6 votes

@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("keyTab", keytab);
  options.put("principal", principal);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", Boolean.toString(isInitiator));
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
      new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
          AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
          options)
  };
}

Example 2

Source File: KerberosTestUtils.java From hadoop with Apache License 2.0

6 votes

@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("keyTab", KerberosTestUtils.getKeytabFile());
  options.put("principal", principal);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
    new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
                              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
                              options),};
}

Example 3

Source File: TestWebDelegationToken.java From hadoop with Apache License 2.0

6 votes

@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("principal", principal);
  options.put("keyTab", keytab);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
      new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
          AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
          options),};
}

Example 4

Source File: KerberosTestUtils.java From hadoop with Apache License 2.0

6 votes

@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("keyTab", KerberosTestUtils.getKeytabFile());
  options.put("principal", principal);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
    new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
                              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
                              options),};
}

Example 5

Source File: KerberosConfiguration.java From big-c with Apache License 2.0

6 votes

@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("keyTab", keytab);
  options.put("principal", principal);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", Boolean.toString(isInitiator));
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
      new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
          AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
          options)
  };
}

Example 6

Source File: KerberosTestUtils.java From big-c with Apache License 2.0

6 votes

@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("keyTab", KerberosTestUtils.getKeytabFile());
  options.put("principal", principal);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
    new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
                              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
                              options),};
}

Example 7

Source File: TestWebDelegationToken.java From big-c with Apache License 2.0

6 votes

@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("principal", principal);
  options.put("keyTab", keytab);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
      new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
          AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
          options),};
}

Example 8

Source File: KerberosTestUtils.java From big-c with Apache License 2.0

6 votes

@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  options.put("keyTab", KerberosTestUtils.getKeytabFile());
  options.put("principal", principal);
  options.put("useKeyTab", "true");
  options.put("storeKey", "true");
  options.put("doNotPrompt", "true");
  options.put("useTicketCache", "true");
  options.put("renewTGT", "true");
  options.put("refreshKrb5Config", "true");
  options.put("isInitiator", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    options.put("ticketCache", ticketCache);
  }
  options.put("debug", "true");

  return new AppConfigurationEntry[]{
    new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
                              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
                              options),};
}

Example 9

Source File: KerberosAuthenticationHandler.java From hadoop with Apache License 2.0

5 votes

@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  if (IBM_JAVA) {
    options.put("useKeytab",
        keytab.startsWith("file://") ? keytab : "file://" + keytab);
    options.put("principal", principal);
    options.put("credsType", "acceptor");
  } else {
    options.put("keyTab", keytab);
    options.put("principal", principal);
    options.put("useKeyTab", "true");
    options.put("storeKey", "true");
    options.put("doNotPrompt", "true");
    options.put("useTicketCache", "true");
    options.put("renewTGT", "true");
    options.put("isInitiator", "false");
  }
  options.put("refreshKrb5Config", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    if (IBM_JAVA) {
      options.put("useDefaultCcache", "true");
      // The first value searched when "useDefaultCcache" is used.
      System.setProperty("KRB5CCNAME", ticketCache);
      options.put("renewTGT", "true");
      options.put("credsType", "both");
    } else {
      options.put("ticketCache", ticketCache);
    }
  }
  if (LOG.isDebugEnabled()) {
    options.put("debug", "true");
  }

  return new AppConfigurationEntry[]{
      new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
                              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
                              options),};
}

Example 10

Source File: KerberosAuthenticationHandler.java From big-c with Apache License 2.0

5 votes

@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
  Map<String, String> options = new HashMap<String, String>();
  if (IBM_JAVA) {
    options.put("useKeytab",
        keytab.startsWith("file://") ? keytab : "file://" + keytab);
    options.put("principal", principal);
    options.put("credsType", "acceptor");
  } else {
    options.put("keyTab", keytab);
    options.put("principal", principal);
    options.put("useKeyTab", "true");
    options.put("storeKey", "true");
    options.put("doNotPrompt", "true");
    options.put("useTicketCache", "true");
    options.put("renewTGT", "true");
    options.put("isInitiator", "false");
  }
  options.put("refreshKrb5Config", "true");
  String ticketCache = System.getenv("KRB5CCNAME");
  if (ticketCache != null) {
    if (IBM_JAVA) {
      options.put("useDefaultCcache", "true");
      // The first value searched when "useDefaultCcache" is used.
      System.setProperty("KRB5CCNAME", ticketCache);
      options.put("renewTGT", "true");
      options.put("credsType", "both");
    } else {
      options.put("ticketCache", ticketCache);
    }
  }
  if (LOG.isDebugEnabled()) {
    options.put("debug", "true");
  }

  return new AppConfigurationEntry[]{
      new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(),
                              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
                              options),};
}

Example 11

Source File: SecureClientLogin.java From ranger with Apache License 2.0

5 votes

@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String appName) {
	AppConfigurationEntry KEYTAB_KERBEROS_LOGIN = new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(), LoginModuleControlFlag.REQUIRED, kerberosOptions);
	if (usePassword) {
		AppConfigurationEntry KERBEROS_PWD_SAVER = new AppConfigurationEntry(KrbPasswordSaverLoginModule.class.getName(), LoginModuleControlFlag.REQUIRED, kerberosOptions);
		return new AppConfigurationEntry[] { KERBEROS_PWD_SAVER, KEYTAB_KERBEROS_LOGIN };
	}
	else {
		return new AppConfigurationEntry[] { KEYTAB_KERBEROS_LOGIN };
	}
}

Example 12

Source File: MiscUtil.java From ranger with Apache License 2.0

5 votes

@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
	Map<String, String> options = new HashMap<String, String>();
	if (IBM_JAVA) {
		options.put("useKeytab", keytab.startsWith("file://") ? keytab
				: "file://" + keytab);
		options.put("principal", principal);
		options.put("credsType", "acceptor");
	} else {
		options.put("keyTab", keytab);
		options.put("principal", principal);
		options.put("useKeyTab", "true");
		options.put("storeKey", "true");
		options.put("doNotPrompt", "true");
		options.put("useTicketCache", "true");
		options.put("renewTGT", "true");
		options.put("isInitiator", "false");
	}
	options.put("refreshKrb5Config", "true");
	String ticketCache = System.getenv("KRB5CCNAME");
	if (ticketCache != null) {
		if (IBM_JAVA) {
			options.put("useDefaultCcache", "true");
			// The first value searched when "useDefaultCcache" is used.
			System.setProperty("KRB5CCNAME", ticketCache);
			options.put("renewTGT", "true");
			options.put("credsType", "both");
		} else {
			options.put("ticketCache", ticketCache);
		}
	}
	if (logger.isDebugEnabled()) {
		options.put("debug", "true");
	}

	return new AppConfigurationEntry[] { new AppConfigurationEntry(
			KerberosUtil.getKrb5LoginModuleName(),
			AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
			options), };
}

Example 13

Source File: PxfUserGroupInformation.java From pxf with Apache License 2.0

4 votes

private HadoopConfiguration(String keytabPrincipal, String keytabFile) {
    this.keytabFile = keytabFile;
    this.keytabPrincipal = keytabPrincipal;

    String ticketCache = System.getenv("HADOOP_JAAS_DEBUG");
    if ("true".equalsIgnoreCase(ticketCache)) {
        BASIC_JAAS_OPTIONS.put("debug", "true");
    }

    OS_SPECIFIC_LOGIN = new AppConfigurationEntry(OS_LOGIN_MODULE_NAME, AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, BASIC_JAAS_OPTIONS);
    HADOOP_LOGIN = new AppConfigurationEntry(UserGroupInformation.HadoopLoginModule.class.getName(), AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, BASIC_JAAS_OPTIONS);
    USER_KERBEROS_OPTIONS = new HashMap<>();
    if (PlatformName.IBM_JAVA) {
        USER_KERBEROS_OPTIONS.put("useDefaultCcache", "true");
    } else {
        USER_KERBEROS_OPTIONS.put("doNotPrompt", "true");
        USER_KERBEROS_OPTIONS.put("useTicketCache", "true");
    }

    ticketCache = System.getenv("KRB5CCNAME");
    if (ticketCache != null) {
        if (PlatformName.IBM_JAVA) {
            System.setProperty("KRB5CCNAME", ticketCache);
        } else {
            USER_KERBEROS_OPTIONS.put("ticketCache", ticketCache);
        }
    }

    USER_KERBEROS_OPTIONS.put("renewTGT", "true");
    USER_KERBEROS_OPTIONS.putAll(BASIC_JAAS_OPTIONS);
    USER_KERBEROS_LOGIN = new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(), AppConfigurationEntry.LoginModuleControlFlag.OPTIONAL, USER_KERBEROS_OPTIONS);
    KEYTAB_KERBEROS_OPTIONS = new HashMap<>();
    if (PlatformName.IBM_JAVA) {
        KEYTAB_KERBEROS_OPTIONS.put("credsType", "both");
    } else {
        KEYTAB_KERBEROS_OPTIONS.put("doNotPrompt", "true");
        KEYTAB_KERBEROS_OPTIONS.put("useKeyTab", "true");
        KEYTAB_KERBEROS_OPTIONS.put("storeKey", "true");
    }

    KEYTAB_KERBEROS_OPTIONS.put("refreshKrb5Config", "true");
    KEYTAB_KERBEROS_OPTIONS.putAll(BASIC_JAAS_OPTIONS);
    KEYTAB_KERBEROS_LOGIN = new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(), AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, KEYTAB_KERBEROS_OPTIONS);
    SIMPLE_CONF = new AppConfigurationEntry[]{OS_SPECIFIC_LOGIN, HADOOP_LOGIN};
    USER_KERBEROS_CONF = new AppConfigurationEntry[]{OS_SPECIFIC_LOGIN, USER_KERBEROS_LOGIN, HADOOP_LOGIN};
    KEYTAB_KERBEROS_CONF = new AppConfigurationEntry[]{KEYTAB_KERBEROS_LOGIN, HADOOP_LOGIN};
}

Example 14

Source File: UserGroupInformation.java From hadoop with Apache License 2.0

4 votes

/**
 * Create a UserGroupInformation from a Kerberos ticket cache.
 * 
 * @param user                The principal name to load from the ticket
 *                            cache
 * @param ticketCachePath     the path to the ticket cache file
 *
 * @throws IOException        if the kerberos login fails
 */
@InterfaceAudience.Public
@InterfaceStability.Evolving
public static UserGroupInformation getUGIFromTicketCache(
          String ticketCache, String user) throws IOException {
  if (!isAuthenticationMethodEnabled(AuthenticationMethod.KERBEROS)) {
    return getBestUGI(null, user);
  }
  try {
    Map<String,String> krbOptions = new HashMap<String,String>();
    if (IBM_JAVA) {
      krbOptions.put("useDefaultCcache", "true");
      // The first value searched when "useDefaultCcache" is used.
      System.setProperty("KRB5CCNAME", ticketCache);
    } else {
      krbOptions.put("doNotPrompt", "true");
      krbOptions.put("useTicketCache", "true");
      krbOptions.put("useKeyTab", "false");
      krbOptions.put("ticketCache", ticketCache);
    }
    krbOptions.put("renewTGT", "false");
    krbOptions.putAll(HadoopConfiguration.BASIC_JAAS_OPTIONS);
    AppConfigurationEntry ace = new AppConfigurationEntry(
        KerberosUtil.getKrb5LoginModuleName(),
        LoginModuleControlFlag.REQUIRED,
        krbOptions);
    DynamicConfiguration dynConf =
        new DynamicConfiguration(new AppConfigurationEntry[]{ ace });
    LoginContext login = newLoginContext(
        HadoopConfiguration.USER_KERBEROS_CONFIG_NAME, null, dynConf);
    login.login();

    Subject loginSubject = login.getSubject();
    Set<Principal> loginPrincipals = loginSubject.getPrincipals();
    if (loginPrincipals.isEmpty()) {
      throw new RuntimeException("No login principals found!");
    }
    if (loginPrincipals.size() != 1) {
      LOG.warn("found more than one principal in the ticket cache file " +
        ticketCache);
    }
    User ugiUser = new User(loginPrincipals.iterator().next().getName(),
        AuthenticationMethod.KERBEROS, login);
    loginSubject.getPrincipals().add(ugiUser);
    UserGroupInformation ugi = new UserGroupInformation(loginSubject);
    ugi.setLogin(login);
    ugi.setAuthenticationMethod(AuthenticationMethod.KERBEROS);
    return ugi;
  } catch (LoginException le) {
    throw new IOException("failure to login using ticket cache file " +
        ticketCache, le);
  }
}

Example 15

Source File: UserGroupInformation.java From big-c with Apache License 2.0

4 votes

/**
 * Create a UserGroupInformation from a Kerberos ticket cache.
 * 
 * @param user                The principal name to load from the ticket
 *                            cache
 * @param ticketCachePath     the path to the ticket cache file
 *
 * @throws IOException        if the kerberos login fails
 */
@InterfaceAudience.Public
@InterfaceStability.Evolving
public static UserGroupInformation getUGIFromTicketCache(
          String ticketCache, String user) throws IOException {
  if (!isAuthenticationMethodEnabled(AuthenticationMethod.KERBEROS)) {
    return getBestUGI(null, user);
  }
  try {
    Map<String,String> krbOptions = new HashMap<String,String>();
    if (IBM_JAVA) {
      krbOptions.put("useDefaultCcache", "true");
      // The first value searched when "useDefaultCcache" is used.
      System.setProperty("KRB5CCNAME", ticketCache);
    } else {
      krbOptions.put("doNotPrompt", "true");
      krbOptions.put("useTicketCache", "true");
      krbOptions.put("useKeyTab", "false");
      krbOptions.put("ticketCache", ticketCache);
    }
    krbOptions.put("renewTGT", "false");
    krbOptions.putAll(HadoopConfiguration.BASIC_JAAS_OPTIONS);
    AppConfigurationEntry ace = new AppConfigurationEntry(
        KerberosUtil.getKrb5LoginModuleName(),
        LoginModuleControlFlag.REQUIRED,
        krbOptions);
    DynamicConfiguration dynConf =
        new DynamicConfiguration(new AppConfigurationEntry[]{ ace });
    LoginContext login = newLoginContext(
        HadoopConfiguration.USER_KERBEROS_CONFIG_NAME, null, dynConf);
    login.login();

    Subject loginSubject = login.getSubject();
    Set<Principal> loginPrincipals = loginSubject.getPrincipals();
    if (loginPrincipals.isEmpty()) {
      throw new RuntimeException("No login principals found!");
    }
    if (loginPrincipals.size() != 1) {
      LOG.warn("found more than one principal in the ticket cache file " +
        ticketCache);
    }
    User ugiUser = new User(loginPrincipals.iterator().next().getName(),
        AuthenticationMethod.KERBEROS, login);
    loginSubject.getPrincipals().add(ugiUser);
    UserGroupInformation ugi = new UserGroupInformation(loginSubject);
    ugi.setLogin(login);
    ugi.setAuthenticationMethod(AuthenticationMethod.KERBEROS);
    return ugi;
  } catch (LoginException le) {
    throw new IOException("failure to login using ticket cache file " +
        ticketCache, le);
  }
}