From 5e26de982b1ab68fffeb897fef4c97458ad46708 Mon Sep 17 00:00:00 2001 From: Todd Lipcon Date: Thu, 9 Feb 2012 18:22:02 +0000 Subject: [PATCH] HDFS-2924. Standby checkpointing fails to authenticate in secure cluster. Contributed by Todd Lipcon. git-svn-id: https://svn.apache.org/repos/asf/hadoop/common/branches/HDFS-1623@1242439 13f79535-47bb-0310-9956-ffa450edef68 --- .../apache/hadoop/security/SecurityUtil.java | 24 ++++++++++++++++++- .../hadoop-hdfs/CHANGES.HDFS-1623.txt | 2 ++ .../server/namenode/SecondaryNameNode.java | 15 ++---------- .../server/namenode/ha/EditLogTailer.java | 13 ++++++++++ .../namenode/ha/StandbyCheckpointer.java | 17 +++---------- 5 files changed, 43 insertions(+), 28 deletions(-) diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java index 2685887464..43132d263a 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java @@ -23,6 +23,7 @@ import java.net.URL; import java.net.UnknownHostException; import java.security.AccessController; +import java.security.PrivilegedAction; import java.util.Arrays; import java.util.List; import java.util.ServiceLoader; @@ -448,6 +449,27 @@ public static Text buildTokenService(URI uri) { return buildTokenService(NetUtils.createSocketAddr(uri.getAuthority())); } + /** + * Perform the given action as the daemon's login user. If the login + * user cannot be determined, this will log a FATAL error and exit + * the whole JVM. + */ + public static T doAsLoginUserOrFatal(PrivilegedAction action) { + if (UserGroupInformation.isSecurityEnabled()) { + UserGroupInformation ugi = null; + try { + ugi = UserGroupInformation.getLoginUser(); + } catch (IOException e) { + LOG.fatal("Exception while getting login user", e); + e.printStackTrace(); + Runtime.getRuntime().exit(-1); + } + return ugi.doAs(action); + } else { + return action.run(); + } + } + /** * Resolves a host subject to the security requirements determined by * hadoop.security.token.service.use_ip. @@ -597,5 +619,5 @@ InetAddress getInetAddressByName(String host) throws UnknownHostException { void setSearchDomains(String ... domains) { searchDomains = Arrays.asList(domains); } - } + } } diff --git a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.HDFS-1623.txt b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.HDFS-1623.txt index c9688ae64c..f84ed7b63f 100644 --- a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.HDFS-1623.txt +++ b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.HDFS-1623.txt @@ -186,3 +186,5 @@ HDFS-2905. HA: Standby NN NPE when shared edits dir is deleted. (Bikas Saha via HDFS-2579. Starting delegation token manager during safemode fails. (todd) HDFS-2510. Add HA-related metrics. (atm) + +HDFS-2924. Standby checkpointing fails to authenticate in secure cluster. (todd) diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/SecondaryNameNode.java b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/SecondaryNameNode.java index 12127064e2..61b533d344 100644 --- a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/SecondaryNameNode.java +++ b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/SecondaryNameNode.java @@ -307,25 +307,14 @@ public void shutdown() { } public void run() { - if (UserGroupInformation.isSecurityEnabled()) { - UserGroupInformation ugi = null; - try { - ugi = UserGroupInformation.getLoginUser(); - } catch (IOException e) { - LOG.error("Exception while getting login user", e); - e.printStackTrace(); - Runtime.getRuntime().exit(-1); - } - ugi.doAs(new PrivilegedAction() { + SecurityUtil.doAsLoginUserOrFatal( + new PrivilegedAction() { @Override public Object run() { doWork(); return null; } }); - } else { - doWork(); - } } // // The main work loop diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/ha/EditLogTailer.java b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/ha/EditLogTailer.java index 219dd80f15..780bad72e9 100644 --- a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/ha/EditLogTailer.java +++ b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/ha/EditLogTailer.java @@ -20,6 +20,7 @@ import java.io.IOException; import java.net.InetSocketAddress; +import java.security.PrivilegedAction; import java.util.Collection; import org.apache.commons.logging.Log; @@ -40,6 +41,7 @@ import org.apache.hadoop.hdfs.server.namenode.NameNode; import org.apache.hadoop.hdfs.server.protocol.NamenodeProtocol; import org.apache.hadoop.ipc.RPC; +import org.apache.hadoop.security.SecurityUtil; import static org.apache.hadoop.hdfs.server.common.Util.now; @@ -284,6 +286,17 @@ private void setShouldRun(boolean shouldRun) { @Override public void run() { + SecurityUtil.doAsLoginUserOrFatal( + new PrivilegedAction() { + @Override + public Object run() { + doWork(); + return null; + } + }); + } + + private void doWork() { while (shouldRun) { try { // There's no point in triggering a log roll if the Standby hasn't diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/ha/StandbyCheckpointer.java b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/ha/StandbyCheckpointer.java index 9c5a3e5cd2..edfc53fb12 100644 --- a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/ha/StandbyCheckpointer.java +++ b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/ha/StandbyCheckpointer.java @@ -35,6 +35,7 @@ import org.apache.hadoop.hdfs.server.namenode.SaveNamespaceCancelledException; import org.apache.hadoop.hdfs.server.namenode.TransferFsImage; import org.apache.hadoop.net.NetUtils; +import org.apache.hadoop.security.SecurityUtil; import org.apache.hadoop.security.UserGroupInformation; import static org.apache.hadoop.hdfs.server.common.Util.now; @@ -212,26 +213,14 @@ private void setShouldRun(boolean shouldRun) { public void run() { // We have to make sure we're logged in as far as JAAS // is concerned, in order to use kerberized SSL properly. - // This code copied from SecondaryNameNode - TODO: refactor - // to a utility function. - if (UserGroupInformation.isSecurityEnabled()) { - UserGroupInformation ugi = null; - try { - ugi = UserGroupInformation.getLoginUser(); - } catch (IOException e) { - LOG.error("Exception while getting login user", e); - Runtime.getRuntime().exit(-1); - } - ugi.doAs(new PrivilegedAction() { + SecurityUtil.doAsLoginUserOrFatal( + new PrivilegedAction() { @Override public Object run() { doWork(); return null; } }); - } else { - doWork(); - } } /**