big-data/hadoop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

YARN-7942. Add check for JAAS configuration for Yarn Service.

Browse Source 
Contributed by Billie Rinaldi
This commit is contained in:
Eric Yang 2018-02-22 16:12:40 -05:00
parent 190969006d
commit 95904f6b3c
1 changed files with 33 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java
View File

@ -736,8 +736,10 @@ public static AppConfigurationEntry[] validateContext(String context) {
* Apply the security environment to this curator instance. This * Apply the security environment to this curator instance. This
* may include setting up the ZK system properties for SASL * may include setting up the ZK system properties for SASL
* @param builder curator builder * @param builder curator builder
* @throws IOException if jaas configuration can't be generated or found
*/ */
public void applySecurityEnvironment(CuratorFrameworkFactory.Builder builder) { public void applySecurityEnvironment(CuratorFrameworkFactory.Builder
builder) throws IOException {
if (isSecureRegistry()) { if (isSecureRegistry()) {
switch (access) { switch (access) {
@ -752,6 +754,19 @@ public void applySecurityEnvironment(CuratorFrameworkFactory.Builder builder) {
break; break;
case sasl: case sasl:
String existingJaasConf = System.getProperty(
"java.security.auth.login.config");
if (existingJaasConf == null || existingJaasConf.isEmpty()) {
if (principal == null || keytab == null) {
throw new IOException("SASL is configured for registry, " +
"but neither keytab/principal nor java.security.auth.login" +
".config system property are specified");
}
// in this case, keytab and principal are specified and no jaas
// config is specified, so we will create one
LOG.info(
"Enabling ZK sasl client: jaasClientEntry = " + jaasClientEntry
+ ", principal = " + principal + ", keytab = " + keytab);
JaasConfiguration jconf = JaasConfiguration jconf =
new JaasConfiguration(jaasClientEntry, principal, keytab); new JaasConfiguration(jaasClientEntry, principal, keytab);
javax.security.auth.login.Configuration.setConfiguration(jconf); javax.security.auth.login.Configuration.setConfiguration(jconf);
@ -759,9 +774,16 @@ public void applySecurityEnvironment(CuratorFrameworkFactory.Builder builder) {
"true"); "true");
setSystemPropertyIfUnset(ZooKeeperSaslClient.LOGIN_CONTEXT_NAME_KEY, setSystemPropertyIfUnset(ZooKeeperSaslClient.LOGIN_CONTEXT_NAME_KEY,
jaasClientEntry); jaasClientEntry);
LOG.info( } else {
"Enabling ZK sasl client: jaasClientEntry = " + jaasClientEntry // in this case, jaas config is specified so we will not change it
+ ", principal = " + principal + ", keytab = " + keytab); LOG.info("Using existing ZK sasl configuration: " +
"jaasClientEntry = " + System.getProperty(
ZooKeeperSaslClient.LOGIN_CONTEXT_NAME_KEY, "Client") +
", sasl client = " + System.getProperty(
ZooKeeperSaslClient.ENABLE_CLIENT_SASL_KEY,
ZooKeeperSaslClient.ENABLE_CLIENT_SASL_DEFAULT) +
", jaas = " + existingJaasConf);
}
break; break;
default: default: