big-data/hadoop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HADOOP-19227. ipc.Server accelerate token negotiation only for the default mechanism. (#6949)

Browse Source
This commit is contained in:
Tsz-Wo Nicholas Sze 2024-07-20 15:18:22 +08:00 committed by GitHub
parent 7638b4727e
commit 9dad697dbc
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java
View File

@ -106,6 +106,7 @@
import org.apache.hadoop.ipc.protobuf.RpcHeaderProtos.RPCTraceInfoProto; import org.apache.hadoop.ipc.protobuf.RpcHeaderProtos.RPCTraceInfoProto;
import org.apache.hadoop.net.NetUtils; import org.apache.hadoop.net.NetUtils;
import org.apache.hadoop.security.AccessControlException; import org.apache.hadoop.security.AccessControlException;
import org.apache.hadoop.security.SaslConstants;
import org.apache.hadoop.security.SaslPropertiesResolver; import org.apache.hadoop.security.SaslPropertiesResolver;
import org.apache.hadoop.security.SaslRpcServer; import org.apache.hadoop.security.SaslRpcServer;
import org.apache.hadoop.security.SaslRpcServer.AuthMethod; import org.apache.hadoop.security.SaslRpcServer.AuthMethod;
@ -2604,7 +2605,8 @@ private RpcSaslProto buildSaslNegotiateResponse()
RpcSaslProto negotiateMessage = negotiateResponse; RpcSaslProto negotiateMessage = negotiateResponse;
// accelerate token negotiation by sending initial challenge // accelerate token negotiation by sending initial challenge
// in the negotiation response // in the negotiation response
if (enabledAuthMethods.contains(AuthMethod.TOKEN)) { if (enabledAuthMethods.contains(AuthMethod.TOKEN)
&& SaslConstants.SASL_MECHANISM_DEFAULT.equals(AuthMethod.TOKEN.getMechanismName())) {
saslServer = createSaslServer(AuthMethod.TOKEN); saslServer = createSaslServer(AuthMethod.TOKEN);
byte[] challenge = saslServer.evaluateResponse(new byte[0]); byte[] challenge = saslServer.evaluateResponse(new byte[0]);
RpcSaslProto.Builder negotiateBuilder = RpcSaslProto.Builder negotiateBuilder =

2
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslConstants.java
View File

@ -32,7 +32,7 @@ public class SaslConstants {
private static final String SASL_MECHANISM_ENV = "HADOOP_SASL_MECHANISM"; private static final String SASL_MECHANISM_ENV = "HADOOP_SASL_MECHANISM";
public static final String SASL_MECHANISM; public static final String SASL_MECHANISM;
private static final String SASL_MECHANISM_DEFAULT = "DIGEST-MD5"; public static final String SASL_MECHANISM_DEFAULT = "DIGEST-MD5";
static { static {
final String mechanism = System.getenv(SASL_MECHANISM_ENV); final String mechanism = System.getenv(SASL_MECHANISM_ENV);

11
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java
View File

@ -39,6 +39,7 @@
import javax.security.auth.callback.PasswordCallback; import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.UnsupportedCallbackException; import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.kerberos.KerberosPrincipal; import javax.security.auth.kerberos.KerberosPrincipal;
import javax.security.sasl.AuthorizeCallback;
import javax.security.sasl.RealmCallback; import javax.security.sasl.RealmCallback;
import javax.security.sasl.RealmChoiceCallback; import javax.security.sasl.RealmChoiceCallback;
import javax.security.sasl.Sasl; import javax.security.sasl.Sasl;
@ -681,9 +682,17 @@ public void handle(Callback[] callbacks)
pc = (PasswordCallback) callback; pc = (PasswordCallback) callback;
} else if (callback instanceof RealmCallback) { } else if (callback instanceof RealmCallback) {
rc = (RealmCallback) callback; rc = (RealmCallback) callback;
} else if (callback instanceof AuthorizeCallback) {
final AuthorizeCallback ac = (AuthorizeCallback) callback;
final String authId = ac.getAuthenticationID();
final String authzId = ac.getAuthorizationID();
ac.setAuthorized(authId.equals(authzId));
if (ac.isAuthorized()) {
ac.setAuthorizedID(authzId);
}
} else { } else {
throw new UnsupportedCallbackException(callback, throw new UnsupportedCallbackException(callback,
"Unrecognized SASL client callback"); "Unrecognized SASL client callback " + callback.getClass());
} }
} }
if (nc != null) { if (nc != null) {