Java KMSClientProvider类代码示例

import org.apache.hadoop.crypto.key.kms.KMSClientProvider; //导入依赖的package包/类
@Test
public void testDeleteKey() throws Exception {
  KeyProvider.KeyVersion mockKey = Mockito.mock(KeyProvider.KeyVersion.class);
  KeyProvider mockProv = Mockito.mock(KeyProvider.class);
  Mockito.when(mockProv.getCurrentKey(Mockito.eq("k1"))).thenReturn(mockKey);
  Mockito.when(mockProv.getKeyVersion(Mockito.eq("[email protected]")))
      .thenReturn(mockKey);
  Mockito.when(mockProv.getMetadata(Mockito.eq("k1"))).thenReturn(
      new KMSClientProvider.KMSMetadata("c", 0, "l", null, new Date(), 1));
  Mockito.when(mockProv.getConf()).thenReturn(new Configuration());
  KeyProvider cache = new CachingKeyProvider(mockProv, 100, 100);
  Assert.assertEquals(mockKey, cache.getCurrentKey("k1"));
  Mockito.verify(mockProv, Mockito.times(1)).getCurrentKey(Mockito.eq("k1"));
  Assert.assertEquals(mockKey, cache.getKeyVersion("[email protected]"));
  Mockito.verify(mockProv, Mockito.times(1))
      .getKeyVersion(Mockito.eq("[email protected]"));
  cache.deleteKey("k1");

  // asserting the cache is purged
  Assert.assertEquals(mockKey, cache.getCurrentKey("k1"));
  Mockito.verify(mockProv, Mockito.times(2)).getCurrentKey(Mockito.eq("k1"));
  Assert.assertEquals(mockKey, cache.getKeyVersion("[email protected]"));
  Mockito.verify(mockProv, Mockito.times(2))
      .getKeyVersion(Mockito.eq("[email protected]"));
}
 

import org.apache.hadoop.crypto.key.kms.KMSClientProvider; //导入依赖的package包/类
@DELETE
@Path(KMSRESTConstants.KEY_RESOURCE + "/{name:.*}")
public Response deleteKey(@PathParam("name") final String name)
    throws Exception {
  KMSWebApp.getAdminCallsMeter().mark();
  UserGroupInformation user = HttpUserGroupInformation.get();
  assertAccess(KMSACLs.Type.DELETE, user, KMSOp.DELETE_KEY, name);
  KMSClientProvider.checkNotEmpty(name, "name");

  user.doAs(new PrivilegedExceptionAction<Void>() {
    @Override
    public Void run() throws Exception {
      provider.deleteKey(name);
      provider.flush();
      return null;
    }
  });

  kmsAudit.ok(user, KMSOp.DELETE_KEY, name, "");

  return Response.ok().build();
}
 

import org.apache.hadoop.crypto.key.kms.KMSClientProvider; //导入依赖的package包/类
@GET
@Path(KMSRESTConstants.KEY_RESOURCE + "/{name:.*}/" +
    KMSRESTConstants.METADATA_SUB_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response getMetadata(@PathParam("name") final String name)
    throws Exception {
  UserGroupInformation user = HttpUserGroupInformation.get();
  KMSClientProvider.checkNotEmpty(name, "name");
  KMSWebApp.getAdminCallsMeter().mark();
  assertAccess(KMSACLs.Type.GET_METADATA, user, KMSOp.GET_METADATA, name);

  KeyProvider.Metadata metadata = user.doAs(
      new PrivilegedExceptionAction<KeyProvider.Metadata>() {
        @Override
        public KeyProvider.Metadata run() throws Exception {
          return provider.getMetadata(name);
        }
      }
  );

  Object json = KMSServerJSONUtils.toJSON(name, metadata);
  kmsAudit.ok(user, KMSOp.GET_METADATA, name, "");
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(json).build();
}
 

import org.apache.hadoop.crypto.key.kms.KMSClientProvider; //导入依赖的package包/类
@GET
@Path(KMSRESTConstants.KEY_PAIR_RESOURCE + "/{name:.*}/" +
    KMSRESTConstants.CURRENT_VERSION_SUB_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response getCurrentVersionPair(@PathParam("name") final String name)
    throws Exception {
  UserGroupInformation user = HttpUserGroupInformation.get();
  KMSClientProvider.checkNotEmpty(name, "name");
  KMSWebApp.getKeyCallsMeter().mark();
  assertAccess(KMSACLs.Type.GET, user, KMSOp.GET_CURRENT_KEY, name);

  KeyPairVersion keyVersion = user.doAs(
      new PrivilegedExceptionAction<KeyPairVersion>() {
        @Override
        public KeyPairVersion run() throws Exception {
          return provider.getCurrentKeyPair(name);
        }
      }
  );

  Object json = KMSServerJSONUtils.toJSON(keyVersion);
  kmsAudit.ok(user, KMSOp.GET_CURRENT_KEY, name, "");
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(json).build();
}
 

import org.apache.hadoop.crypto.key.kms.KMSClientProvider; //导入依赖的package包/类
@GET
@Path(KMSRESTConstants.KEY_RESOURCE + "/{name:.*}/" +
    KMSRESTConstants.CURRENT_VERSION_SUB_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response getCurrentVersion(@PathParam("name") final String name)
    throws Exception {
  UserGroupInformation user = HttpUserGroupInformation.get();
  KMSClientProvider.checkNotEmpty(name, "name");
  KMSWebApp.getKeyCallsMeter().mark();
  assertAccess(KMSACLs.Type.GET, user, KMSOp.GET_CURRENT_KEY, name);

  KeyVersion keyVersion = user.doAs(
      new PrivilegedExceptionAction<KeyVersion>() {
        @Override
        public KeyVersion run() throws Exception {
          return provider.getCurrentKey(name);
        }
      }
  );

  Object json = KMSServerJSONUtils.toJSON(keyVersion);
  kmsAudit.ok(user, KMSOp.GET_CURRENT_KEY, name, "");
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(json).build();
}
 

import org.apache.hadoop.crypto.key.kms.KMSClientProvider; //导入依赖的package包/类
@GET
@Path(KMSRESTConstants.KEY_PAIR_VERSION_RESOURCE + "/{versionName:.*}")
@Produces(MediaType.APPLICATION_JSON)
public Response getKeyVersionPair(
    @PathParam("versionName") final String versionName) throws Exception {
  UserGroupInformation user = HttpUserGroupInformation.get();
  KMSClientProvider.checkNotEmpty(versionName, "versionName");
  KMSWebApp.getKeyCallsMeter().mark();
  assertAccess(KMSACLs.Type.GET, user, KMSOp.GET_KEY_VERSION);

  KeyPairVersion keyVersion = user.doAs(
      new PrivilegedExceptionAction<KeyPairVersion>() {
        @Override
        public KeyPairVersion run() throws Exception {
          return provider.getKeyPairVersion(versionName);
        }
      }
  );

  if (keyVersion != null) {
    kmsAudit.ok(user, KMSOp.GET_KEY_VERSION, keyVersion.getName(), "");
  }
  Object json = KMSServerJSONUtils.toJSON(keyVersion);
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(json).build();
}
 

import org.apache.hadoop.crypto.key.kms.KMSClientProvider; //导入依赖的package包/类
@GET
@Path(KMSRESTConstants.KEY_VERSION_RESOURCE + "/{versionName:.*}")
@Produces(MediaType.APPLICATION_JSON)
public Response getKeyVersion(
    @PathParam("versionName") final String versionName) throws Exception {
  UserGroupInformation user = HttpUserGroupInformation.get();
  KMSClientProvider.checkNotEmpty(versionName, "versionName");
  KMSWebApp.getKeyCallsMeter().mark();
  assertAccess(KMSACLs.Type.GET, user, KMSOp.GET_KEY_VERSION);

  KeyVersion keyVersion = user.doAs(
      new PrivilegedExceptionAction<KeyVersion>() {
        @Override
        public KeyVersion run() throws Exception {
          return provider.getKeyVersion(versionName);
        }
      }
  );

  if (keyVersion != null) {
    kmsAudit.ok(user, KMSOp.GET_KEY_VERSION, keyVersion.getName(), "");
  }
  Object json = KMSServerJSONUtils.toJSON(keyVersion);
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(json).build();
}
 

import org.apache.hadoop.crypto.key.kms.KMSClientProvider; //导入依赖的package包/类
@GET
@Path(KMSRESTConstants.KEY_PAIR_RESOURCE + "/{name:.*}/" +
    KMSRESTConstants.VERSIONS_SUB_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response getKeyPairVersions(@PathParam("name") final String name)
    throws Exception {
  UserGroupInformation user = HttpUserGroupInformation.get();
  KMSClientProvider.checkNotEmpty(name, "name");
  KMSWebApp.getKeyCallsMeter().mark();
  assertAccess(KMSACLs.Type.GET, user, KMSOp.GET_KEY_VERSIONS, name);

  List<KeyPairVersion> ret = user.doAs(
      new PrivilegedExceptionAction<List<KeyPairVersion>>() {
        @Override
        public List<KeyPairVersion> run() throws Exception {
          return provider.getKeyPairVersions(name);
        }
      }
  );

  Object json = KMSServerJSONUtils.toJSONPair(ret);
  kmsAudit.ok(user, KMSOp.GET_KEY_VERSIONS, name, "");
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(json).build();
}
 

import org.apache.hadoop.crypto.key.kms.KMSClientProvider; //导入依赖的package包/类
@GET
@Path(KMSRESTConstants.KEY_RESOURCE + "/{name:.*}/" +
    KMSRESTConstants.VERSIONS_SUB_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response getKeyVersions(@PathParam("name") final String name)
    throws Exception {
  UserGroupInformation user = HttpUserGroupInformation.get();
  KMSClientProvider.checkNotEmpty(name, "name");
  KMSWebApp.getKeyCallsMeter().mark();
  assertAccess(KMSACLs.Type.GET, user, KMSOp.GET_KEY_VERSIONS, name);

  List<KeyVersion> ret = user.doAs(
      new PrivilegedExceptionAction<List<KeyVersion>>() {
        @Override
        public List<KeyVersion> run() throws Exception {
          return provider.getKeyVersions(name);
        }
      }
  );

  Object json = KMSServerJSONUtils.toJSON(ret);
  kmsAudit.ok(user, KMSOp.GET_KEY_VERSIONS, name, "");
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(json).build();
}
 

import org.apache.hadoop.crypto.key.kms.KMSClientProvider; //导入依赖的package包/类
@Override
protected Properties getConfiguration(String configPrefix,
    FilterConfig filterConfig) {
  Properties props = new Properties();
  Configuration conf = KMSWebApp.getConfiguration();
  for (Map.Entry<String, String> entry : conf) {
    String name = entry.getKey();
    if (name.startsWith(CONFIG_PREFIX)) {
      String value = conf.get(name);
      name = name.substring(CONFIG_PREFIX.length());
      props.setProperty(name, value);
    }
  }
  String authType = props.getProperty(AUTH_TYPE);
  if (authType.equals(PseudoAuthenticationHandler.TYPE)) {
    props.setProperty(AUTH_TYPE,
        PseudoDelegationTokenAuthenticationHandler.class.getName());
  } else if (authType.equals(KerberosAuthenticationHandler.TYPE)) {
    props.setProperty(AUTH_TYPE,
        KerberosDelegationTokenAuthenticationHandler.class.getName());
  }
  props.setProperty(DelegationTokenAuthenticationHandler.TOKEN_KIND,
      KMSClientProvider.TOKEN_KIND);
  return props;
}
 

import org.apache.hadoop.crypto.key.kms.KMSClientProvider; //导入依赖的package包/类
@SuppressWarnings("rawtypes")
@POST
@Path(RENRESTConstants.KEY_VERSION_RESOURCE + "/{dstVersionName:.*}/" +
    RENRESTConstants.REK_SUB_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response decryptEncryptedKey(
    @PathParam("dstVersionName") final String dstVersionName,
    @QueryParam(RENRESTConstants.REN_OP) String renOp,
    Map jsonPayload)
    throws Exception {
  UserGroupInformation user = HttpUserGroupInformation.get();
  KMSClientProvider.checkNotEmpty(dstVersionName, "dstVersionName");
  KMSClientProvider.checkNotNull(renOp, "renOp");

  final String keyName = (String) jsonPayload.get(
      KMSRESTConstants.NAME_FIELD);
  final String keyVersionName = (String) jsonPayload.get(
      KMSRESTConstants.VERSION_NAME_FIELD);
  String ivStr = (String) jsonPayload.get(KMSRESTConstants.IV_FIELD);
  String encMaterialStr =
      (String) jsonPayload.get(KMSRESTConstants.MATERIAL_FIELD);
  Object retJSON;
  if (renOp.equals(RENRESTConstants.REN_TRANSFORM)) {
    assertAccess(KMSACLs.Type.TRANSFORM_EEK, user, RENOp.TRANSFORM_EEK, keyName);
    KMSClientProvider.checkNotNull(ivStr, KMSRESTConstants.IV_FIELD);
    final byte[] iv = Base64.decodeBase64(ivStr);
    KMSClientProvider.checkNotNull(encMaterialStr,
        KMSRESTConstants.MATERIAL_FIELD);
    final byte[] encMaterial = Base64.decodeBase64(encMaterialStr);

    EncryptedKeyVersion retKeyVersion = user.doAs(
        new PrivilegedExceptionAction<EncryptedKeyVersion>() {
          @Override
          public EncryptedKeyVersion run() throws Exception {
            return provider.transformEncryptedKey(
                new KMSClientProvider.KMSEncryptedKeyVersion(keyName,
                    keyVersionName, iv, KeyProviderCryptoExtension.EEK,
                    encMaterial),
                dstVersionName
            );
          }
        }
    );

    final List<EncryptedKeyVersion> retEdeks =
      Collections.singletonList(retKeyVersion);

    renAudit.ok(user, RENOp.TRANSFORM_EEK,
        keyVersionName + "->" + dstVersionName, "");
    retJSON = new ArrayList();
    for (EncryptedKeyVersion edek : retEdeks) {
      ((ArrayList)retJSON).add(KMSServerJSONUtils.toJSON(edek));
    }
  } else {
    throw new IllegalArgumentException("Wrong " + RENRESTConstants.REN_OP +
        " value, it must be " + RENRESTConstants.REN_TRANSFORM);
  }
  KMSWebApp.getTransformEEKCallsMeter().mark();
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(retJSON)
      .build();
}