Java Code Examples for org.apache.hadoop.security.token.SecretManager#InvalidToken

The following examples show how to use org.apache.hadoop.security.token.SecretManager#InvalidToken . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.

Example 1

Source File: Hadoop3OmTransport.java From hadoop-ozone with Apache License 2.0

6 votes

/**
 * Unwrap exception to check if it is some kind of access control problem
 * ({@link AccessControlException} or {@link SecretManager.InvalidToken}).
 */
private boolean isAccessControlException(Exception ex) {
  if (ex instanceof ServiceException) {
    Throwable t = ex.getCause();
    if (t instanceof RemoteException) {
      t = ((RemoteException) t).unwrapRemoteException();
    }
    while (t != null) {
      if (t instanceof AccessControlException ||
          t instanceof SecretManager.InvalidToken) {
        return true;
      }
      t = t.getCause();
    }
  }
  return false;
}

Example 2

Source File: TestZKDelegationTokenSecretManager.java From hadoop with Apache License 2.0

6 votes

@SuppressWarnings("unchecked")
@Test
public void testCancelTokenSingleManager() throws Exception {
  for (int i = 0; i < TEST_RETRIES; i++) {
    DelegationTokenManager tm1 = null;
    String connectString = zkServer.getConnectString();
    Configuration conf = getSecretConf(connectString);
    tm1 = new DelegationTokenManager(conf, new Text("foo"));
    tm1.init();

    Token<DelegationTokenIdentifier> token =
        (Token<DelegationTokenIdentifier>)
        tm1.createToken(UserGroupInformation.getCurrentUser(), "foo");
    Assert.assertNotNull(token);
    tm1.cancelToken(token, "foo");
    try {
      verifyTokenFail(tm1, token);
      fail("Expected InvalidToken");
    } catch (SecretManager.InvalidToken it) {
      it.printStackTrace();
    }
    verifyDestroy(tm1, conf);
  }
}

Example 3

Source File: TestZKDelegationTokenSecretManager.java From big-c with Apache License 2.0

6 votes

@SuppressWarnings("unchecked")
@Test
public void testCancelTokenSingleManager() throws Exception {
  for (int i = 0; i < TEST_RETRIES; i++) {
    DelegationTokenManager tm1 = null;
    String connectString = zkServer.getConnectString();
    Configuration conf = getSecretConf(connectString);
    tm1 = new DelegationTokenManager(conf, new Text("foo"));
    tm1.init();

    Token<DelegationTokenIdentifier> token =
        (Token<DelegationTokenIdentifier>)
        tm1.createToken(UserGroupInformation.getCurrentUser(), "foo");
    Assert.assertNotNull(token);
    tm1.cancelToken(token, "foo");
    try {
      verifyTokenFail(tm1, token);
      fail("Expected InvalidToken");
    } catch (SecretManager.InvalidToken it) {
      it.printStackTrace();
    }
    verifyDestroy(tm1, conf);
  }
}

Example 4

Source File: BaseClientToAMTokenSecretManager.java From hadoop with Apache License 2.0

5 votes

@Private
@Override
public byte[] retrievePassword(ClientToAMTokenIdentifier identifier)
    throws SecretManager.InvalidToken {
  SecretKey masterKey = getMasterKey(identifier.getApplicationAttemptID());
  if (masterKey == null) {
    throw new SecretManager.InvalidToken("Illegal client-token!");
  }
  return createPassword(identifier.getBytes(), masterKey);
}

Example 5

Source File: BaseContainerTokenSecretManager.java From hadoop with Apache License 2.0

5 votes

@Override
public byte[] retrievePassword(ContainerTokenIdentifier identifier)
    throws SecretManager.InvalidToken {
  this.readLock.lock();
  try {
    return retrievePasswordInternal(identifier, this.currentMasterKey);
  } finally {
    this.readLock.unlock();
  }
}

Example 6

Source File: NMContainerTokenSecretManager.java From hadoop with Apache License 2.0

5 votes

/**
 * Override of this is to validate ContainerTokens generated by using
 * different {@link MasterKey}s.
 */
@Override
public synchronized byte[] retrievePassword(
    ContainerTokenIdentifier identifier) throws SecretManager.InvalidToken {
  int keyId = identifier.getMasterKeyId();

  MasterKeyData masterKeyToUse = null;
  if (this.previousMasterKey != null
      && keyId == this.previousMasterKey.getMasterKey().getKeyId()) {
    // A container-launch has come in with a token generated off the last
    // master-key
    masterKeyToUse = this.previousMasterKey;
  } else if (keyId == super.currentMasterKey.getMasterKey().getKeyId()) {
    // A container-launch has come in with a token generated off the current
    // master-key
    masterKeyToUse = super.currentMasterKey;
  }

  if (nodeHostAddr != null
      && !identifier.getNmHostAddress().equals(nodeHostAddr)) {
    // Valid container token used for incorrect node.
    throw new SecretManager.InvalidToken("Given Container "
        + identifier.getContainerID().toString()
        + " identifier is not valid for current Node manager. Expected : "
        + nodeHostAddr + " Found : " + identifier.getNmHostAddress());
  }
  
  if (masterKeyToUse != null) {
    return retrievePasswordInternal(identifier, masterKeyToUse);
  }

  // Invalid request. Like startContainer() with token generated off
  // old-master-keys.
  throw new SecretManager.InvalidToken("Given Container "
      + identifier.getContainerID().toString()
      + " seems to have an illegally generated token.");
}

Example 7

Source File: TestZKDelegationTokenSecretManager.java From hadoop with Apache License 2.0

5 votes

private void verifyTokenFailWithRetry(DelegationTokenManager tm,
    Token<DelegationTokenIdentifier> token, int retryCount)
    throws IOException, InterruptedException {
  try {
    tm.verifyToken(token);
  } catch (SecretManager.InvalidToken er) {
    throw er;
  }
  if (retryCount > 0) {
    Thread.sleep(RETRY_WAIT);
    verifyTokenFailWithRetry(tm, token, retryCount - 1);
  }
}

Example 8

Source File: BaseClientToAMTokenSecretManager.java From big-c with Apache License 2.0

5 votes

@Private
@Override
public byte[] retrievePassword(ClientToAMTokenIdentifier identifier)
    throws SecretManager.InvalidToken {
  SecretKey masterKey = getMasterKey(identifier.getApplicationAttemptID());
  if (masterKey == null) {
    throw new SecretManager.InvalidToken("Illegal client-token!");
  }
  return createPassword(identifier.getBytes(), masterKey);
}

Example 9

Source File: BaseContainerTokenSecretManager.java From big-c with Apache License 2.0

5 votes

@Override
public byte[] retrievePassword(ContainerTokenIdentifier identifier)
    throws SecretManager.InvalidToken {
  this.readLock.lock();
  try {
    return retrievePasswordInternal(identifier, this.currentMasterKey);
  } finally {
    this.readLock.unlock();
  }
}

Example 10

Source File: NMContainerTokenSecretManager.java From big-c with Apache License 2.0

5 votes

/**
 * Override of this is to validate ContainerTokens generated by using
 * different {@link MasterKey}s.
 */
@Override
public synchronized byte[] retrievePassword(
    ContainerTokenIdentifier identifier) throws SecretManager.InvalidToken {
  int keyId = identifier.getMasterKeyId();

  MasterKeyData masterKeyToUse = null;
  if (this.previousMasterKey != null
      && keyId == this.previousMasterKey.getMasterKey().getKeyId()) {
    // A container-launch has come in with a token generated off the last
    // master-key
    masterKeyToUse = this.previousMasterKey;
  } else if (keyId == super.currentMasterKey.getMasterKey().getKeyId()) {
    // A container-launch has come in with a token generated off the current
    // master-key
    masterKeyToUse = super.currentMasterKey;
  }

  if (nodeHostAddr != null
      && !identifier.getNmHostAddress().equals(nodeHostAddr)) {
    // Valid container token used for incorrect node.
    throw new SecretManager.InvalidToken("Given Container "
        + identifier.getContainerID().toString()
        + " identifier is not valid for current Node manager. Expected : "
        + nodeHostAddr + " Found : " + identifier.getNmHostAddress());
  }
  
  if (masterKeyToUse != null) {
    return retrievePasswordInternal(identifier, masterKeyToUse);
  }

  // Invalid request. Like startContainer() with token generated off
  // old-master-keys.
  throw new SecretManager.InvalidToken("Given Container "
      + identifier.getContainerID().toString()
      + " seems to have an illegally generated token.");
}

Example 11

Source File: TestZKDelegationTokenSecretManager.java From big-c with Apache License 2.0

5 votes

private void verifyTokenFailWithRetry(DelegationTokenManager tm,
    Token<DelegationTokenIdentifier> token, int retryCount)
    throws IOException, InterruptedException {
  try {
    tm.verifyToken(token);
  } catch (SecretManager.InvalidToken er) {
    throw er;
  }
  if (retryCount > 0) {
    Thread.sleep(RETRY_WAIT);
    verifyTokenFailWithRetry(tm, token, retryCount - 1);
  }
}