big-data/hadoop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HDFS-4560. Webhdfs cannot use tokens obtained by another user (daryn)

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/hadoop/common/trunk@1453955 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Daryn Sharp 2013-03-07 16:56:19 +00:00
parent 80c2cf57fd
commit 97c4668312
3 changed files with 8 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
View File

@ -2369,6 +2369,8 @@ Release 0.23.7 - UNRELEASED
HDFS-4542. Webhdfs doesn't support secure proxy users (Daryn Sharp via HDFS-4542. Webhdfs doesn't support secure proxy users (Daryn Sharp via
kihwal) kihwal)
HDFS-4560. Webhdfs cannot use tokens obtained by another user (daryn)
Release 0.23.6 - UNRELEASED Release 0.23.6 - UNRELEASED
INCOMPATIBLE CHANGES INCOMPATIBLE CHANGES

4
hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java
View File

@ -350,15 +350,15 @@ Param<?,?>[] getAuthParameters(final HttpOpParam.Op op) throws IOException {
} // else we are talking to an insecure cluster } // else we are talking to an insecure cluster
} }
} }
UserGroupInformation userUgi = ugi;
if (!hasToken) { if (!hasToken) {
UserGroupInformation userUgi = ugi;
UserGroupInformation realUgi = userUgi.getRealUser(); UserGroupInformation realUgi = userUgi.getRealUser();
if (realUgi != null) { // proxy user if (realUgi != null) { // proxy user
authParams.add(new DoAsParam(userUgi.getShortUserName())); authParams.add(new DoAsParam(userUgi.getShortUserName()));
userUgi = realUgi; userUgi = realUgi;
} }
authParams.add(new UserParam(userUgi.getShortUserName()));
} }
authParams.add(new UserParam(userUgi.getShortUserName()));
return authParams.toArray(new Param<?,?>[0]); return authParams.toArray(new Param<?,?>[0]);
} }

12
hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/web/TestWebHdfsUrl.java
View File

@ -134,24 +134,22 @@ public void testSecureAuthParamsInUrl() throws IOException {
}, },
renewTokenUrl); renewTokenUrl);
// send user+token // send token
URL cancelTokenUrl = webhdfs.toUrl(PutOpParam.Op.CANCELDELEGATIONTOKEN, URL cancelTokenUrl = webhdfs.toUrl(PutOpParam.Op.CANCELDELEGATIONTOKEN,
fsPath, new TokenArgumentParam(tokenString)); fsPath, new TokenArgumentParam(tokenString));
checkQueryParams( checkQueryParams(
new String[]{ new String[]{
PutOpParam.Op.CANCELDELEGATIONTOKEN.toQueryString(), PutOpParam.Op.CANCELDELEGATIONTOKEN.toQueryString(),
new UserParam(ugi.getShortUserName()).toString(),
new TokenArgumentParam(tokenString).toString(), new TokenArgumentParam(tokenString).toString(),
new DelegationParam(tokenString).toString() new DelegationParam(tokenString).toString()
}, },
cancelTokenUrl); cancelTokenUrl);
// send user+token // send token
URL fileStatusUrl = webhdfs.toUrl(GetOpParam.Op.GETFILESTATUS, fsPath); URL fileStatusUrl = webhdfs.toUrl(GetOpParam.Op.GETFILESTATUS, fsPath);
checkQueryParams( checkQueryParams(
new String[]{ new String[]{
GetOpParam.Op.GETFILESTATUS.toQueryString(), GetOpParam.Op.GETFILESTATUS.toQueryString(),
new UserParam(ugi.getShortUserName()).toString(),
new DelegationParam(tokenString).toString() new DelegationParam(tokenString).toString()
}, },
fileStatusUrl); fileStatusUrl);
@ -219,24 +217,22 @@ public void testSecureProxyAuthParamsInUrl() throws IOException {
}, },
renewTokenUrl); renewTokenUrl);
// send effective+token // send token
URL cancelTokenUrl = webhdfs.toUrl(PutOpParam.Op.CANCELDELEGATIONTOKEN, URL cancelTokenUrl = webhdfs.toUrl(PutOpParam.Op.CANCELDELEGATIONTOKEN,
fsPath, new TokenArgumentParam(tokenString)); fsPath, new TokenArgumentParam(tokenString));
checkQueryParams( checkQueryParams(
new String[]{ new String[]{
PutOpParam.Op.CANCELDELEGATIONTOKEN.toQueryString(), PutOpParam.Op.CANCELDELEGATIONTOKEN.toQueryString(),
new UserParam(ugi.getShortUserName()).toString(),
new TokenArgumentParam(tokenString).toString(), new TokenArgumentParam(tokenString).toString(),
new DelegationParam(tokenString).toString() new DelegationParam(tokenString).toString()
}, },
cancelTokenUrl); cancelTokenUrl);
// send effective+token // send token
URL fileStatusUrl = webhdfs.toUrl(GetOpParam.Op.GETFILESTATUS, fsPath); URL fileStatusUrl = webhdfs.toUrl(GetOpParam.Op.GETFILESTATUS, fsPath);
checkQueryParams( checkQueryParams(
new String[]{ new String[]{
GetOpParam.Op.GETFILESTATUS.toQueryString(), GetOpParam.Op.GETFILESTATUS.toQueryString(),
new UserParam(ugi.getShortUserName()).toString(),
new DelegationParam(tokenString).toString() new DelegationParam(tokenString).toString()
}, },
fileStatusUrl); fileStatusUrl);