|
| 1 | +/* |
| 2 | + * Licensed to the Apache Software Foundation (ASF) under one |
| 3 | + * or more contributor license agreements. See the NOTICE file |
| 4 | + * distributed with this work for additional information |
| 5 | + * regarding copyright ownership. The ASF licenses this file |
| 6 | + * to you under the Apache License, Version 2.0 (the |
| 7 | + * "License"); you may not use this file except in compliance |
| 8 | + * with the License. You may obtain a copy of the License at |
| 9 | + * |
| 10 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 11 | + * |
| 12 | + * Unless required by applicable law or agreed to in writing, software |
| 13 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 14 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 15 | + * See the License for the specific language governing permissions and |
| 16 | + * limitations under the License. |
| 17 | + */ |
| 18 | + |
| 19 | +package org.apache.hadoop.hbase.security.token; |
| 20 | + |
| 21 | +import com.google.protobuf.ByteString; |
| 22 | +import com.google.protobuf.ServiceException; |
| 23 | +import java.io.IOException; |
| 24 | +import java.lang.reflect.UndeclaredThrowableException; |
| 25 | +import java.security.PrivilegedExceptionAction; |
| 26 | +import org.apache.hadoop.hbase.HConstants; |
| 27 | +import org.apache.hadoop.hbase.TableName; |
| 28 | +import org.apache.hadoop.hbase.client.Connection; |
| 29 | +import org.apache.hadoop.hbase.client.Table; |
| 30 | +import org.apache.hadoop.hbase.ipc.CoprocessorRpcChannel; |
| 31 | +import org.apache.hadoop.hbase.protobuf.generated.AuthenticationProtos; |
| 32 | +import org.apache.hadoop.hbase.security.User; |
| 33 | +import org.apache.hadoop.io.Text; |
| 34 | +import org.apache.hadoop.security.token.Token; |
| 35 | +import org.apache.yetus.audience.InterfaceAudience; |
| 36 | +import org.slf4j.Logger; |
| 37 | +import org.slf4j.LoggerFactory; |
| 38 | +import org.apache.hadoop.hbase.shaded.protobuf.ProtobufUtil; |
| 39 | + |
| 40 | +/** |
| 41 | + * Utility methods for obtaining authentication tokens, that do not require hbase-server. |
| 42 | + */ |
| 43 | +@InterfaceAudience.Public |
| 44 | +public final class ClientTokenUtil { |
| 45 | + private static final Logger LOG = LoggerFactory.getLogger(ClientTokenUtil.class); |
| 46 | + |
| 47 | + // Set in TestClientTokenUtil via reflection |
| 48 | + private static ServiceException injectedException; |
| 49 | + |
| 50 | + private ClientTokenUtil() {} |
| 51 | + |
| 52 | + private static void injectFault() throws ServiceException { |
| 53 | + if (injectedException != null) { |
| 54 | + throw injectedException; |
| 55 | + } |
| 56 | + } |
| 57 | + |
| 58 | + /** |
| 59 | + * Obtain and return an authentication token for the current user. |
| 60 | + * @param conn The HBase cluster connection |
| 61 | + * @throws IOException if a remote error or serialization problem occurs. |
| 62 | + * @return the authentication token instance |
| 63 | + */ |
| 64 | + @InterfaceAudience.Private |
| 65 | + public static Token<AuthenticationTokenIdentifier> obtainToken( |
| 66 | + Connection conn) throws IOException { |
| 67 | + Table meta = null; |
| 68 | + try { |
| 69 | + injectFault(); |
| 70 | + |
| 71 | + meta = conn.getTable(TableName.META_TABLE_NAME); |
| 72 | + CoprocessorRpcChannel rpcChannel = meta.coprocessorService( |
| 73 | + HConstants.EMPTY_START_ROW); |
| 74 | + AuthenticationProtos.AuthenticationService.BlockingInterface service = |
| 75 | + AuthenticationProtos.AuthenticationService.newBlockingStub(rpcChannel); |
| 76 | + AuthenticationProtos.GetAuthenticationTokenResponse response = |
| 77 | + service.getAuthenticationToken(null, |
| 78 | + AuthenticationProtos.GetAuthenticationTokenRequest.getDefaultInstance()); |
| 79 | + |
| 80 | + return toToken(response.getToken()); |
| 81 | + } catch (ServiceException se) { |
| 82 | + throw ProtobufUtil.handleRemoteException(se); |
| 83 | + } finally { |
| 84 | + if (meta != null) { |
| 85 | + meta.close(); |
| 86 | + } |
| 87 | + } |
| 88 | + } |
| 89 | + |
| 90 | + /** |
| 91 | + * Converts a Token instance (with embedded identifier) to the protobuf representation. |
| 92 | + * |
| 93 | + * @param token the Token instance to copy |
| 94 | + * @return the protobuf Token message |
| 95 | + */ |
| 96 | + @InterfaceAudience.Private |
| 97 | + static AuthenticationProtos.Token toToken(Token<AuthenticationTokenIdentifier> token) { |
| 98 | + AuthenticationProtos.Token.Builder builder = AuthenticationProtos.Token.newBuilder(); |
| 99 | + builder.setIdentifier(ByteString.copyFrom(token.getIdentifier())); |
| 100 | + builder.setPassword(ByteString.copyFrom(token.getPassword())); |
| 101 | + if (token.getService() != null) { |
| 102 | + builder.setService(ByteString.copyFromUtf8(token.getService().toString())); |
| 103 | + } |
| 104 | + return builder.build(); |
| 105 | + } |
| 106 | + |
| 107 | + /** |
| 108 | + * Converts a protobuf Token message back into a Token instance. |
| 109 | + * |
| 110 | + * @param proto the protobuf Token message |
| 111 | + * @return the Token instance |
| 112 | + */ |
| 113 | + @InterfaceAudience.Private |
| 114 | + static Token<AuthenticationTokenIdentifier> toToken(AuthenticationProtos.Token proto) { |
| 115 | + return new Token<>( |
| 116 | + proto.hasIdentifier() ? proto.getIdentifier().toByteArray() : null, |
| 117 | + proto.hasPassword() ? proto.getPassword().toByteArray() : null, |
| 118 | + AuthenticationTokenIdentifier.AUTH_TOKEN_TYPE, |
| 119 | + proto.hasService() ? new Text(proto.getService().toStringUtf8()) : null); |
| 120 | + } |
| 121 | + |
| 122 | + /** |
| 123 | + * Obtain and return an authentication token for the given user. |
| 124 | + * @param conn The HBase cluster connection |
| 125 | + * @param user The user to obtain a token for |
| 126 | + * @return the authentication token instance |
| 127 | + */ |
| 128 | + @InterfaceAudience.Private |
| 129 | + static Token<AuthenticationTokenIdentifier> obtainToken( |
| 130 | + final Connection conn, User user) throws IOException, InterruptedException { |
| 131 | + return user.runAs(new PrivilegedExceptionAction<Token<AuthenticationTokenIdentifier>>() { |
| 132 | + @Override |
| 133 | + public Token<AuthenticationTokenIdentifier> run() throws Exception { |
| 134 | + return obtainToken(conn); |
| 135 | + } |
| 136 | + }); |
| 137 | + } |
| 138 | + |
| 139 | + /** |
| 140 | + * Obtain an authentication token for the given user and add it to the |
| 141 | + * user's credentials. |
| 142 | + * @param conn The HBase cluster connection |
| 143 | + * @param user The user for whom to obtain the token |
| 144 | + * @throws IOException If making a remote call to the authentication service fails |
| 145 | + * @throws InterruptedException If executing as the given user is interrupted |
| 146 | + */ |
| 147 | + public static void obtainAndCacheToken(final Connection conn, |
| 148 | + User user) |
| 149 | + throws IOException, InterruptedException { |
| 150 | + try { |
| 151 | + Token<AuthenticationTokenIdentifier> token = obtainToken(conn, user); |
| 152 | + |
| 153 | + if (token == null) { |
| 154 | + throw new IOException("No token returned for user " + user.getName()); |
| 155 | + } |
| 156 | + if (LOG.isDebugEnabled()) { |
| 157 | + LOG.debug("Obtained token " + token.getKind().toString() + " for user " + |
| 158 | + user.getName()); |
| 159 | + } |
| 160 | + user.addToken(token); |
| 161 | + } catch (IOException | InterruptedException | RuntimeException e) { |
| 162 | + throw e; |
| 163 | + } catch (Exception e) { |
| 164 | + throw new UndeclaredThrowableException(e, |
| 165 | + "Unexpected exception obtaining token for user " + user.getName()); |
| 166 | + } |
| 167 | + } |
| 168 | +} |
0 commit comments