From 01665e456de8d79000ce273dded5ea53aa62965a Mon Sep 17 00:00:00 2001 From: Steve Loughran Date: Thu, 24 Nov 2016 17:51:49 +0000 Subject: [PATCH] HADOOP-10776 Open up already widely-used APIs for delegation-token fetching & renewal to ecosystem projects. Contributed by Vinod Kumar Vavilapalli Cherry picked from 24715cefe80fba531dd16a44ec1cead67c389eb1 --- .../src/main/java/org/apache/hadoop/fs/FileSystem.java | 6 ++++-- .../apache/hadoop/security/AccessControlException.java | 2 +- .../java/org/apache/hadoop/security/Credentials.java | 2 +- .../java/org/apache/hadoop/security/SecurityUtil.java | 10 ++++++++-- .../apache/hadoop/security/UserGroupInformation.java | 6 +++--- .../security/authorize/AuthorizationException.java | 2 +- .../java/org/apache/hadoop/security/token/Token.java | 2 +- .../delegation/AbstractDelegationTokenIdentifier.java | 2 +- .../AbstractDelegationTokenSecretManager.java | 2 +- 9 files changed, 21 insertions(+), 13 deletions(-) diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileSystem.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileSystem.java index f581f61393..55cd97e643 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileSystem.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileSystem.java @@ -383,7 +383,8 @@ protected static FileSystem getFSofPath(final Path absOrFqPath, * if the filesystem does not implement tokens * @see SecurityUtil#buildDTServiceName(URI, int) */ - @InterfaceAudience.LimitedPrivate({ "HDFS", "MapReduce" }) + @InterfaceAudience.Public + @InterfaceStability.Evolving public String getCanonicalServiceName() { return (getChildFileSystems() == null) ? SecurityUtil.buildDTServiceName(getUri(), getDefaultPort()) @@ -617,7 +618,8 @@ public Token getDelegationToken(String renewer) throws IOException { * @return list of new delegation tokens * @throws IOException problems obtaining a token */ - @InterfaceAudience.LimitedPrivate({ "HDFS", "MapReduce" }) + @InterfaceAudience.Public + @InterfaceStability.Evolving public Token[] addDelegationTokens( final String renewer, Credentials credentials) throws IOException { if (credentials == null) { diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/AccessControlException.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/AccessControlException.java index b1ab829b40..d0a3620d6d 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/AccessControlException.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/AccessControlException.java @@ -24,7 +24,7 @@ /** * An exception class for access control related issues. */ -@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce"}) +@InterfaceAudience.Public @InterfaceStability.Evolving public class AccessControlException extends IOException { diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/Credentials.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/Credentials.java index 8e12ef1c53..1283d8ffa3 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/Credentials.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/Credentials.java @@ -57,7 +57,7 @@ * A class that provides the facilities of reading and writing * secret keys and Tokens. */ -@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce"}) +@InterfaceAudience.Public @InterfaceStability.Evolving public class Credentials implements Writable { private static final Log LOG = LogFactory.getLog(Credentials.class); diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java index 42abe0ed3b..b7d1ec0482 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java @@ -58,14 +58,20 @@ import com.google.common.annotations.VisibleForTesting; -@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce"}) +/** + * Security Utils. + */ +@InterfaceAudience.Public @InterfaceStability.Evolving -public class SecurityUtil { +public final class SecurityUtil { public static final Log LOG = LogFactory.getLog(SecurityUtil.class); public static final String HOSTNAME_PATTERN = "_HOST"; public static final String FAILED_TO_GET_UGI_MSG_HEADER = "Failed to obtain user group information:"; + private SecurityUtil() { + } + // controls whether buildTokenService will use an ip or host/ip as given // by the user @VisibleForTesting diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java index 82603a40d9..cf240ff02b 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java @@ -87,7 +87,7 @@ * user's username and groups. It supports both the Windows, Unix and Kerberos * login modules. */ -@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce", "HBase", "Hive", "Oozie"}) +@InterfaceAudience.Public @InterfaceStability.Evolving public class UserGroupInformation { @VisibleForTesting @@ -840,7 +840,7 @@ public static String trimLoginMethod(String userName) { /** * Log in a user using the given subject - * @parma subject the subject to use when logging in a user, or null to + * @param subject the subject to use when logging in a user, or null to * create a new subject. * @throws IOException if login fails */ @@ -1694,7 +1694,7 @@ private synchronized Credentials getCredentialsInternal() { } /** - * Get the group names for this user. {@ #getGroups(String)} is less + * Get the group names for this user. {@link #getGroups()} is less * expensive alternative when checking for a contained element. * @return the list of users with the primary group first. If the command * fails, it returns an empty list. diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AuthorizationException.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AuthorizationException.java index 07f0321191..03f4d9971b 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AuthorizationException.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AuthorizationException.java @@ -29,7 +29,7 @@ * * This class does not provide the stack trace for security purposes. */ -@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce", "YARN"}) +@InterfaceAudience.Public @InterfaceStability.Evolving public class AuthorizationException extends AccessControlException { private static final long serialVersionUID = 1L; diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/Token.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/Token.java index 713fb20a3c..99cc8c7422 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/Token.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/Token.java @@ -504,7 +504,7 @@ public void cancel(Configuration conf * A trivial renewer for token kinds that aren't managed. Sub-classes need * to implement getKind for their token kind. */ - @InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce"}) + @InterfaceAudience.Public @InterfaceStability.Evolving public static class TrivialRenewer extends TokenRenewer { diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenIdentifier.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenIdentifier.java index 0884cfd3b2..6dfe52a83b 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenIdentifier.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenIdentifier.java @@ -34,7 +34,7 @@ import com.google.common.annotations.VisibleForTesting; -@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce"}) +@InterfaceAudience.Public @InterfaceStability.Evolving public abstract class AbstractDelegationTokenIdentifier extends TokenIdentifier { diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java index 0e311ddeb2..21d3dd6e9d 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java @@ -44,7 +44,7 @@ import com.google.common.base.Preconditions; -@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce", "Hive"}) +@InterfaceAudience.Public @InterfaceStability.Evolving public abstract class AbstractDelegationTokenSecretManager