Java InvalidToken类代码示例

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
@Test
public void testDelegationTokenSecretManager() throws Exception {
  Token<DelegationTokenIdentifier> token = generateDelegationToken(
      "SomeUser", "JobTracker");
  // Fake renewer should not be able to renew
  try {
	  dtSecretManager.renewToken(token, "FakeRenewer");
	  Assert.fail("should have failed");
  } catch (AccessControlException ace) {
    // PASS
  }
 dtSecretManager.renewToken(token, "JobTracker");
  DelegationTokenIdentifier identifier = new DelegationTokenIdentifier();
  byte[] tokenId = token.getIdentifier();
  identifier.readFields(new DataInputStream(
           new ByteArrayInputStream(tokenId)));
  Assert.assertTrue(null != dtSecretManager.retrievePassword(identifier));
  LOG.info("Sleep to expire the token");
 Thread.sleep(6000);
 //Token should be expired
 try {
   dtSecretManager.retrievePassword(identifier);
   //Should not come here
   Assert.fail("Token should have expired");
 } catch (InvalidToken e) {
   //Success
 }
 dtSecretManager.renewToken(token, "JobTracker");
 LOG.info("Sleep beyond the max lifetime");
 Thread.sleep(5000);
 try {
	  dtSecretManager.renewToken(token, "JobTracker");
	  Assert.fail("should have been expired");
 } catch (InvalidToken it) {
   // PASS
 }
}
 

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws InvalidToken, AccessControlException {
  if (authMethod == AuthMethod.TOKEN) {
    TokenIdentifier tokenId = SaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    UserGroupInformation ugi = tokenId.getUser();
    if (ugi == null) {
      throw new AccessControlException(
          "Can't retrieve username from tokenIdentifier.");
    }
    ugi.addTokenIdentifier(tokenId);
    return ugi;
  } else {
    return UserGroupInformation.createRemoteUser(authorizedId, authMethod);
  }
}
 

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
/**
 * Some exceptions ({@link RetriableException} and {@link StandbyException})
 * that are wrapped as a cause of parameter e are unwrapped so that they can
 * be sent as the true cause to the client side. In case of
 * {@link InvalidToken} we go one level deeper to get the true cause.
 * 
 * @param e the exception that may have a cause we want to unwrap.
 * @return the true cause for some exceptions.
 */
private Throwable getTrueCause(IOException e) {
  Throwable cause = e;
  while (cause != null) {
    if (cause instanceof RetriableException) {
      return cause;
    } else if (cause instanceof StandbyException) {
      return cause;
    } else if (cause instanceof InvalidToken) {
      // FIXME: hadoop method signatures are restricting the SASL
      // callbacks to only returning InvalidToken, but some services
      // need to throw other exceptions (ex. NN + StandyException),
      // so for now we'll tunnel the real exceptions via an
      // InvalidToken's cause which normally is not set 
      if (cause.getCause() != null) {
        cause = cause.getCause();
      }
      return cause;
    }
    cause = cause.getCause();
  }
  return e;
}
 

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
@Test
public void testErrorMessage() throws Exception {
  BadTokenSecretManager sm = new BadTokenSecretManager();
  final Server server = setupTestServer(conf, 5, sm);

  boolean succeeded = false;
  try {
    doDigestRpc(server, sm);
  } catch (ServiceException e) {
    assertTrue(e.getCause() instanceof RemoteException);
    RemoteException re = (RemoteException) e.getCause();
    LOG.info("LOGGING MESSAGE: " + re.getLocalizedMessage());
    assertEquals(ERROR_MESSAGE, re.getLocalizedMessage());
    assertTrue(re.unwrapRemoteException() instanceof InvalidToken);
    succeeded = true;
  }
  assertTrue(succeeded);
}
 

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
protected ContainerTokenIdentifier verifyAndGetContainerTokenIdentifier(
    org.apache.hadoop.yarn.api.records.Token token,
    ContainerTokenIdentifier containerTokenIdentifier) throws YarnException,
    InvalidToken {
  byte[] password =
      context.getContainerTokenSecretManager().retrievePassword(
        containerTokenIdentifier);
  byte[] tokenPass = token.getPassword().array();
  if (password == null || tokenPass == null
      || !Arrays.equals(password, tokenPass)) {
    throw new InvalidToken(
      "Invalid container token used for starting container on : "
          + context.getNodeId().toString());
  }
  return containerTokenIdentifier;
}
 

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
@Override
public long renew(Token<?> t, Configuration conf) throws IOException {
  if ( !(t instanceof MyToken)) {
    // renew in 3 seconds
    return System.currentTimeMillis() + 3000;
  }
  MyToken token = (MyToken)t;
  if(token.isCanceled()) {
    throw new InvalidToken("token has been canceled");
  }
  lastRenewed = token;
  counter ++;
  LOG.info("Called MYDFS.renewdelegationtoken " + token + 
      ";this dfs=" + this.hashCode() + ";c=" + counter);
  if(tokenToRenewIn2Sec == token) { 
    // this token first renewal in 2 seconds
    LOG.info("RENEW in 2 seconds");
    tokenToRenewIn2Sec=null;
    return 2*1000 + System.currentTimeMillis();
  } else {
    return 86400*1000 + System.currentTimeMillis();
  }
}
 

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
private void assertTokenCancelled(String encodedToken) throws Exception {
  Token<RMDelegationTokenIdentifier> realToken =
      new Token<RMDelegationTokenIdentifier>();
  realToken.decodeFromUrlString(encodedToken);
  RMDelegationTokenIdentifier ident = rm.getRMContext()
    .getRMDelegationTokenSecretManager().decodeTokenIdentifier(realToken);
  boolean exceptionCaught = false;
  try {
    rm.getRMContext().getRMDelegationTokenSecretManager()
      .verifyToken(ident, realToken.getPassword());
  } catch (InvalidToken it) {
    exceptionCaught = true;
  }
  assertTrue("InvalidToken exception not thrown", exceptionCaught);
  assertFalse(rm.getRMContext().getRMDelegationTokenSecretManager()
    .getAllTokens().containsKey(ident));
}
 

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
@Private
@VisibleForTesting
protected ContainerManagementProtocol newProxy(final YarnRPC rpc,
    String containerManagerBindAddr, ContainerId containerId, Token token)
    throws InvalidToken {

  if (token == null) {
    throw new InvalidToken("No NMToken sent for "
        + containerManagerBindAddr);
  }
  
  final InetSocketAddress cmAddr =
      NetUtils.createSocketAddr(containerManagerBindAddr);
  LOG.info("Opening proxy : " + containerManagerBindAddr);
  // the user in createRemoteUser in this context has to be ContainerID
  UserGroupInformation user =
      UserGroupInformation.createRemoteUser(containerId
          .getApplicationAttemptId().toString());

  org.apache.hadoop.security.token.Token<NMTokenIdentifier> nmToken =
      ConverterUtils.convertFromYarn(token, cmAddr);
  user.addToken(nmToken);

  return NMProxy.createNMProxy(conf, ContainerManagementProtocol.class,
    user, rpc, cmAddr);
}
 

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
/**
 * Should the block access token be refetched on an exception
 * 
 * @param ex Exception received
 * @param targetAddr Target datanode address from where exception was received
 * @return true if block access token has expired or invalid and it should be
 *         refetched
 */
private static boolean tokenRefetchNeeded(IOException ex,
    InetSocketAddress targetAddr) {
  /*
   * Get a new access token and retry. Retry is needed in 2 cases. 1)
   * When both NN and DN re-started while DFSClient holding a cached
   * access token. 2) In the case that NN fails to update its
   * access key at pre-set interval (by a wide margin) and
   * subsequently restarts. In this case, DN re-registers itself with
   * NN and receives a new access key, but DN will delete the old
   * access key from its memory since it's considered expired based on
   * the estimated expiration date.
   */
  if (ex instanceof InvalidBlockTokenException || ex instanceof InvalidToken) {
    DFSClient.LOG.info("Access token was invalid when connecting to "
        + targetAddr + " : " + ex);
    return true;
  }
  return false;
}
 

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
@Override
public void visit(int numOutstandingMmaps,
    Map<ExtendedBlockId, ShortCircuitReplica> replicas,
    Map<ExtendedBlockId, InvalidToken> failedLoads,
    Map<Long, ShortCircuitReplica> evictable,
    Map<Long, ShortCircuitReplica> evictableMmapped) {
  if (expectedNumOutstandingMmaps >= 0) {
    Assert.assertEquals(expectedNumOutstandingMmaps, numOutstandingMmaps);
  }
  if (expectedNumReplicas >= 0) {
    Assert.assertEquals(expectedNumReplicas, replicas.size());
  }
  if (expectedNumEvictable >= 0) {
    Assert.assertEquals(expectedNumEvictable, evictable.size());
  }
  if (expectedNumMmapedEvictable >= 0) {
    Assert.assertEquals(expectedNumMmapedEvictable, evictableMmapped.size());
  }
}
 

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
@Test 
public void testCancelDelegationToken() throws Exception {
  Token<DelegationTokenIdentifier> token = generateDelegationToken(
      "SomeUser", "JobTracker");
  //Fake renewer should not be able to renew
  try {
    dtSecretManager.cancelToken(token, "FakeCanceller");
    Assert.fail("should have failed");
  } catch (AccessControlException ace) {
    // PASS
  }
  dtSecretManager.cancelToken(token, "JobTracker");
  try {
    dtSecretManager.renewToken(token, "JobTracker");
    Assert.fail("should have failed");
  } catch (InvalidToken it) {
    // PASS
  }
}
 

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
private Throwable getCauseForInvalidToken(IOException e) {
  Throwable cause = e;
  while (cause != null) {
    if (cause instanceof RetriableException) {
      return cause;
    } else if (cause instanceof StandbyException) {
      return cause;
    } else if (cause instanceof InvalidToken) {
      // FIXME: hadoop method signatures are restricting the SASL
      // callbacks to only returning InvalidToken, but some services
      // need to throw other exceptions (ex. NN + StandyException),
      // so for now we'll tunnel the real exceptions via an
      // InvalidToken's cause which normally is not set 
      if (cause.getCause() != null) {
        cause = cause.getCause();
      }
      return cause;
    }
    cause = cause.getCause();
  }
  return e;
}
 

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
@Test
public void testErrorMessage() throws Exception {
  BadTokenSecretManager sm = new BadTokenSecretManager();
  final Server server = new RPC.Builder(conf)
      .setProtocol(TestSaslProtocol.class).setInstance(new TestSaslImpl())
      .setBindAddress(ADDRESS).setPort(0).setNumHandlers(5).setVerbose(true)
      .setSecretManager(sm).build();

  boolean succeeded = false;
  try {
    doDigestRpc(server, sm);
  } catch (RemoteException e) {
    LOG.info("LOGGING MESSAGE: " + e.getLocalizedMessage());
    assertEquals(ERROR_MESSAGE, e.getLocalizedMessage());
    assertTrue(e.unwrapRemoteException() instanceof InvalidToken);
    succeeded = true;
  }
  assertTrue(succeeded);
}
 

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
protected ContainerTokenIdentifier verifyAndGetContainerTokenIdentifier(
    org.apache.hadoop.yarn.api.records.Token token,
    ContainerTokenIdentifier containerTokenIdentifier) throws YarnException,
    InvalidToken {
  byte[] password =
      context.getContainerTokenSecretManager().retrievePassword(
          containerTokenIdentifier);
  byte[] tokenPass = token.getPassword().array();
  if (password == null || tokenPass == null
      || !Arrays.equals(password, tokenPass)) {
    throw new InvalidToken(
      "Invalid container token used for starting container on : "
          + context.getNodeId().toString());
  }
  return containerTokenIdentifier;
}
 

import org.apache.hadoop.security.token.SecretManager.InvalidToken; //导入依赖的package包/类
/**
 * Should the block access token be refetched on an exception
 *
 * @param ex Exception received
 * @param targetAddr Target datanode address from where exception was received
 * @return true if block access token has expired or invalid and it should be
 *         refetched
 */
protected static boolean tokenRefetchNeeded(IOException ex,
    InetSocketAddress targetAddr) {
  /*
   * Get a new access token and retry. Retry is needed in 2 cases. 1)
   * When both NN and DN re-started while DFSClient holding a cached
   * access token. 2) In the case that NN fails to update its
   * access key at pre-set interval (by a wide margin) and
   * subsequently restarts. In this case, DN re-registers itself with
   * NN and receives a new access key, but DN will delete the old
   * access key from its memory since it's considered expired based on
   * the estimated expiration date.
   */
  if (ex instanceof InvalidBlockTokenException || ex instanceof InvalidToken) {
    DFSClient.LOG.info("Access token was invalid when connecting to "
        + targetAddr + " : " + ex);
    return true;
  }
  return false;
}