From d50e06d9e0232dccf5681ae7dda5996046e7eb1c Mon Sep 17 00:00:00 2001 From: Harsh J Date: Tue, 25 Sep 2012 10:17:11 +0000 Subject: [PATCH] HADOOP-7930. Kerberos relogin interval in UserGroupInformation should be configurable. Contributed by Robert Kanter. (harsh) git-svn-id: https://svn.apache.org/repos/asf/hadoop/common/trunk@1389783 13f79535-47bb-0310-9956-ffa450edef68 --- .../hadoop-common/CHANGES.txt | 3 ++ .../fs/CommonConfigurationKeysPublic.java | 6 +++ .../hadoop/security/UserGroupInformation.java | 25 ++++++++---- .../src/main/resources/core-default.xml | 8 ++++ .../security/TestUserGroupInformation.java | 39 ++++++++++++++++++- 5 files changed, 73 insertions(+), 8 deletions(-) diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt index 834b9fa85a..b36d1636b9 100644 --- a/hadoop-common-project/hadoop-common/CHANGES.txt +++ b/hadoop-common-project/hadoop-common/CHANGES.txt @@ -108,6 +108,9 @@ Trunk (Unreleased) NullPointerException if the serializations list is empty. (Sho Shimauchi via harsh) + HADOOP-7930. Kerberos relogin interval in UserGroupInformation + should be configurable (Robert Kanter via harsh) + BUG FIXES HADOOP-8177. MBeans shouldn't try to register when it fails to create MBeanName. diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/CommonConfigurationKeysPublic.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/CommonConfigurationKeysPublic.java index 81d1aa721a..5dc5e1a1c8 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/CommonConfigurationKeysPublic.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/CommonConfigurationKeysPublic.java @@ -242,5 +242,11 @@ public class CommonConfigurationKeysPublic { public static final String HADOOP_SSL_ENABLED_KEY = "hadoop.ssl.enabled"; public static final boolean HADOOP_SSL_ENABLED_DEFAULT = false; + /** See core-default.xml */ + public static final String HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN = + "hadoop.kerberos.min.seconds.before.relogin"; + /** Default value for HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN */ + public static final int HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN_DEFAULT = + 60; } diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java index 4097453c76..7c3f6677b4 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java @@ -18,6 +18,8 @@ package org.apache.hadoop.security; import static org.apache.hadoop.fs.CommonConfigurationKeys.HADOOP_SECURITY_AUTHENTICATION; +import static org.apache.hadoop.fs.CommonConfigurationKeys.HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN; +import static org.apache.hadoop.fs.CommonConfigurationKeys.HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN_DEFAULT; import java.io.IOException; import java.lang.reflect.UndeclaredThrowableException; @@ -192,13 +194,12 @@ public boolean logout() throws LoginException { private static boolean useKerberos; /** Server-side groups fetching service */ private static Groups groups; + /** Min time (in seconds) before relogin for Kerberos */ + private static long kerberosMinSecondsBeforeRelogin; /** The configuration to use */ private static Configuration conf; - /** Leave 10 minutes between relogin attempts. */ - private static final long MIN_TIME_BEFORE_RELOGIN = 10 * 60 * 1000L; - /**Environment variable pointing to the token cache file*/ public static final String HADOOP_TOKEN_FILE_LOCATION = "HADOOP_TOKEN_FILE_LOCATION"; @@ -245,6 +246,16 @@ private static synchronized void initUGI(Configuration conf) { HADOOP_SECURITY_AUTHENTICATION + " of " + value); } + try { + kerberosMinSecondsBeforeRelogin = 1000L * conf.getLong( + HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN, + HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN_DEFAULT); + } + catch(NumberFormatException nfe) { + throw new IllegalArgumentException("Invalid attribute value for " + + HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN + " of " + + conf.get(HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN)); + } // If we haven't set up testing groups, use the configuration to find it if (!(groups instanceof TestingGroups)) { groups = Groups.getUserToGroupsMappingService(conf); @@ -729,7 +740,7 @@ public void run() { return; } nextRefresh = Math.max(getRefreshTime(tgt), - now + MIN_TIME_BEFORE_RELOGIN); + now + kerberosMinSecondsBeforeRelogin); } catch (InterruptedException ie) { LOG.warn("Terminating renewal thread"); return; @@ -964,10 +975,10 @@ static UserGroupInformation loginUserFromKeytabAndReturnUGI(String user, } private boolean hasSufficientTimeElapsed(long now) { - if (now - user.getLastLogin() < MIN_TIME_BEFORE_RELOGIN ) { + if (now - user.getLastLogin() < kerberosMinSecondsBeforeRelogin ) { LOG.warn("Not attempting to re-login since the last re-login was " + - "attempted less than " + (MIN_TIME_BEFORE_RELOGIN/1000) + " seconds"+ - " before."); + "attempted less than " + (kerberosMinSecondsBeforeRelogin/1000) + + " seconds before."); return false; } return true; diff --git a/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml b/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml index b360e1f875..552ef99efe 100644 --- a/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml +++ b/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml @@ -250,6 +250,14 @@ + + hadoop.kerberos.min.seconds.before.relogin + 60 + The minimum time between relogin attempts for Kerberos, in + seconds. + + + hadoop.security.auth_to_local diff --git a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestUserGroupInformation.java b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestUserGroupInformation.java index a1bbd984d1..9aebd4ea65 100644 --- a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestUserGroupInformation.java +++ b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestUserGroupInformation.java @@ -24,6 +24,7 @@ import java.io.BufferedReader; import java.io.IOException; import java.io.InputStreamReader; +import java.lang.reflect.Method; import java.security.PrivilegedExceptionAction; import java.util.Collection; import java.util.LinkedHashSet; @@ -49,6 +50,7 @@ public class TestUserGroupInformation { final private static String GROUP3_NAME = "group3"; final private static String[] GROUP_NAMES = new String[]{GROUP1_NAME, GROUP2_NAME, GROUP3_NAME}; + private static Configuration conf; /** * UGI should not use the default security conf, else it will collide @@ -68,7 +70,7 @@ public AppConfigurationEntry[] getAppConfigurationEntry(String name) { /** configure ugi */ @BeforeClass public static void setup() { - Configuration conf = new Configuration(); + conf = new Configuration(); conf.set(CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTH_TO_LOCAL, "RULE:[2:$1@$0](.*@HADOOP.APACHE.ORG)s/@.*//" + "RULE:[1:$1@$0](.*@HADOOP.APACHE.ORG)s/@.*//" @@ -537,4 +539,39 @@ public Void run() throws IOException { } }); } + + /** Test hasSufficientTimeElapsed method */ + @Test + public void testHasSufficientTimeElapsed() throws Exception { + // Make hasSufficientTimeElapsed public + Method method = UserGroupInformation.class + .getDeclaredMethod("hasSufficientTimeElapsed", long.class); + method.setAccessible(true); + + UserGroupInformation ugi = UserGroupInformation.getCurrentUser(); + User user = ugi.getSubject().getPrincipals(User.class).iterator().next(); + long now = System.currentTimeMillis(); + + // Using default relogin time (1 minute) + user.setLastLogin(now - 2 * 60 * 1000); // 2 minutes before "now" + assertTrue((Boolean)method.invoke(ugi, now)); + user.setLastLogin(now - 30 * 1000); // 30 seconds before "now" + assertFalse((Boolean)method.invoke(ugi, now)); + + // Using relogin time of 10 minutes + Configuration conf2 = new Configuration(conf); + conf2.setLong( + CommonConfigurationKeysPublic.HADOOP_KERBEROS_MIN_SECONDS_BEFORE_RELOGIN, + 10 * 60); + UserGroupInformation.setConfiguration(conf2); + user.setLastLogin(now - 15 * 60 * 1000); // 15 minutes before "now" + assertTrue((Boolean)method.invoke(ugi, now)); + user.setLastLogin(now - 6 * 60 * 1000); // 6 minutes before "now" + assertFalse((Boolean)method.invoke(ugi, now)); + // Restore original conf to UGI + UserGroupInformation.setConfiguration(conf); + + // Restore hasSufficientTimElapsed back to private + method.setAccessible(false); + } }