diff --git a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
index e64aa999ee..9ee3bb8e71 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
+++ b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
@@ -60,6 +60,8 @@ Trunk (unreleased changes)
HDFS-3002. TestNameNodeMetrics need not wait for metrics update.
(suresh)
+ HDFS-3016. Security in unit tests. (Jaimin Jetly via jitendra)
+
OPTIMIZATIONS
HDFS-2477. Optimize computing the diff between a block report and the
diff --git a/hadoop-hdfs-project/hadoop-hdfs/pom.xml b/hadoop-hdfs-project/hadoop-hdfs/pom.xml
index 6fdfb64307..0b4da80e8a 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/pom.xml
+++ b/hadoop-hdfs-project/hadoop-hdfs/pom.xml
@@ -29,6 +29,7 @@
hdfs
+ ../../hadoop-common-project/hadoop-common/src/test/resources/kdc
true
@@ -113,6 +114,16 @@
+
+ org.apache.maven.plugins
+ maven-surefire-plugin
+
+
+ ${startKdc}
+ ${kdc.resource.dir}
+
+
+
org.codehaus.mojo.jspc
jspc-maven-plugin
@@ -513,5 +524,85 @@
+
+
+
+ startKdc
+
+
+ startKdc
+ true
+
+
+
+
+
+ org.apache.maven.plugins
+ maven-enforcer-plugin
+
+
+ enforce-os
+
+ enforce
+
+
+
+
+
+ mac
+ unix
+
+
+ true
+
+
+
+
+
+ org.apache.maven.plugins
+ maven-antrun-plugin
+
+
+ compile
+ compile
+
+ run
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ killKdc
+ test
+
+ run
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/TestSecureNameNode.java b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/TestSecureNameNode.java
new file mode 100644
index 0000000000..440574e14e
--- /dev/null
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/TestSecureNameNode.java
@@ -0,0 +1,97 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package org.apache.hadoop.hdfs.server.namenode;
+
+import java.io.IOException;
+import java.security.PrivilegedExceptionAction;
+
+import junit.framework.Assert;
+import org.apache.hadoop.conf.Configuration;
+import org.apache.hadoop.fs.CommonConfigurationKeys;
+import org.apache.hadoop.fs.FileSystem;
+import org.apache.hadoop.fs.Path;
+import org.apache.hadoop.fs.permission.FsPermission;
+import org.apache.hadoop.hdfs.DFSConfigKeys;
+import org.apache.hadoop.hdfs.HdfsConfiguration;
+import org.apache.hadoop.hdfs.MiniDFSCluster;
+import org.apache.hadoop.security.TestUGIWithSecurityOn;
+import org.apache.hadoop.security.UserGroupInformation;
+import org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod;
+import org.junit.Assume;
+import org.junit.Before;
+import org.junit.Test;
+
+public class TestSecureNameNode {
+ final static private int NUM_OF_DATANODES = 0;
+
+ @Before
+ public void testKdcRunning() {
+ // Tests are skipped if KDC is not running
+ Assume.assumeTrue(TestUGIWithSecurityOn.isKdcRunning());
+ }
+
+ @Test
+ public void testName() throws IOException, InterruptedException {
+ MiniDFSCluster cluster = null;
+ try {
+ String keyTabDir = System.getProperty("kdc.resource.dir") + "/keytabs";
+ String nn1KeytabPath = keyTabDir + "/nn1.keytab";
+ String user1KeyTabPath = keyTabDir + "/user1.keytab";
+ Configuration conf = new HdfsConfiguration();
+ conf.set(CommonConfigurationKeys.HADOOP_SECURITY_AUTHENTICATION,
+ "kerberos");
+ conf.set(DFSConfigKeys.DFS_NAMENODE_USER_NAME_KEY,
+ "nn1/localhost@EXAMPLE.COM");
+ conf.set(DFSConfigKeys.DFS_NAMENODE_KEYTAB_FILE_KEY, nn1KeytabPath);
+
+ cluster = new MiniDFSCluster.Builder(conf).numDataNodes(NUM_OF_DATANODES)
+ .build();
+ final MiniDFSCluster clusterRef = cluster;
+ cluster.waitActive();
+ FileSystem fsForCurrentUser = cluster.getFileSystem();
+ fsForCurrentUser.mkdirs(new Path("/tmp"));
+ fsForCurrentUser.setPermission(new Path("/tmp"), new FsPermission(
+ (short) 511));
+
+ UserGroupInformation ugi = UserGroupInformation
+ .loginUserFromKeytabAndReturnUGI("user1@EXAMPLE.COM", user1KeyTabPath);
+ FileSystem fs = ugi.doAs(new PrivilegedExceptionAction() {
+ @Override
+ public FileSystem run() throws Exception {
+ return clusterRef.getFileSystem();
+ }
+ });
+ try {
+ Path p = new Path("/users");
+ fs.mkdirs(p);
+ Assert.fail("user1 must not be allowed to write in /");
+ } catch (IOException expected) {
+ }
+
+ Path p = new Path("/tmp/alpha");
+ fs.mkdirs(p);
+ Assert.assertNotNull(fs.listStatus(p));
+ Assert.assertEquals(AuthenticationMethod.KERBEROS,
+ ugi.getAuthenticationMethod());
+ } finally {
+ if (cluster != null) {
+ cluster.shutdown();
+ }
+ }
+ }
+}
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/test/resources/krb5.conf b/hadoop-hdfs-project/hadoop-hdfs/src/test/resources/krb5.conf
index 121ac6d9b9..20205d1908 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/test/resources/krb5.conf
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/test/resources/krb5.conf
@@ -14,15 +14,24 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
-#
+#
+
[libdefaults]
- default_realm = APACHE.ORG
- udp_preference_limit = 1
- extra_addresses = 127.0.0.1
+ default_realm = EXAMPLE.COM
+ allow_weak_crypto = true
+ default_tkt_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
+ default_tgs_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
+
[realms]
- APACHE.ORG = {
- admin_server = localhost:88
- kdc = localhost:88
- }
+ EXAMPLE.COM = {
+ kdc = localhost:60088
+ }
+
[domain_realm]
- localhost = APACHE.ORG
+ .example.com = EXAMPLE.COM
+ example.com = EXAMPLE.COM
+
+[login]
+ krb4_convert = true
+ krb4_get_tickets = false
+