Java ClientToAMTokenIdentifier类代码示例

import org.apache.hadoop.yarn.security.client.ClientToAMTokenIdentifier; //导入依赖的package包/类
@Override
public Token<ClientToAMTokenIdentifier> createClientToken(String client) {
  this.readLock.lock();

  try {
    Token<ClientToAMTokenIdentifier> token = null;
    ClientToAMTokenSecretManagerInRM secretMgr =
        this.rmContext.getClientToAMTokenSecretManager();
    if (client != null &&
        secretMgr.getMasterKey(this.applicationAttemptId) != null) {
      token = new Token<ClientToAMTokenIdentifier>(
          new ClientToAMTokenIdentifier(this.applicationAttemptId, client),
          secretMgr);
    }
    return token;
  } finally {
    this.readLock.unlock();
  }
}
 

import org.apache.hadoop.yarn.security.client.ClientToAMTokenIdentifier; //导入依赖的package包/类
private void verifyNewVersionToken(final Configuration conf, final CustomAM am,
    Token<ClientToAMTokenIdentifier> token, MockRM rm) throws IOException,
    InterruptedException {
  UserGroupInformation ugi;
  ugi = UserGroupInformation.createRemoteUser("me");
  
  Token<ClientToAMTokenIdentifier> newToken = 
      new Token<ClientToAMTokenIdentifier>(
          new ClientToAMTokenIdentifierForTest(token.decodeIdentifier(), "message"),
          am.getClientToAMTokenSecretManager());
  newToken.setService(token.getService());
  
  ugi.addToken(newToken);

  ugi.doAs(new PrivilegedExceptionAction<Void>() {
    @Override
    public Void run() throws Exception {
      CustomProtocol client =
          (CustomProtocol) RPC.getProxy(CustomProtocol.class, 1L, am.address,
            conf);
      client.ping();
      Assert.assertTrue(am.pinged);
      return null;
    }
  });
}
 

import org.apache.hadoop.yarn.security.client.ClientToAMTokenIdentifier; //导入依赖的package包/类
private void verifyValidToken(final Configuration conf, final CustomAM am,
    Token<ClientToAMTokenIdentifier> token) throws IOException,
    InterruptedException {
  UserGroupInformation ugi;
  ugi = UserGroupInformation.createRemoteUser("me");
  ugi.addToken(token);

  ugi.doAs(new PrivilegedExceptionAction<Void>() {
    @Override
    public Void run() throws Exception {
      CustomProtocol client =
          (CustomProtocol) RPC.getProxy(CustomProtocol.class, 1L, am.address,
            conf);
      client.ping();
      Assert.assertTrue(am.pinged);
      return null;
    }
  });
}
 

import org.apache.hadoop.yarn.security.client.ClientToAMTokenIdentifier; //导入依赖的package包/类
ContainerId storeAttempt(RMStateStore store, ApplicationAttemptId attemptId,
    String containerIdStr, Token<AMRMTokenIdentifier> appToken,
    Token<ClientToAMTokenIdentifier> clientToAMToken, TestDispatcher dispatcher)
    throws Exception {

  Container container = new ContainerPBImpl();
  container.setId(ConverterUtils.toContainerId(containerIdStr));
  RMAppAttempt mockAttempt = mock(RMAppAttempt.class);
  when(mockAttempt.getAppAttemptId()).thenReturn(attemptId);
  when(mockAttempt.getMasterContainer()).thenReturn(container);
  when(mockAttempt.getAMRMToken()).thenReturn(appToken);
  when(mockAttempt.getClientToAMToken()).thenReturn(clientToAMToken);
  dispatcher.attemptId = attemptId;
  dispatcher.storedException = null;
  store.storeApplicationAttempt(mockAttempt);
  waitNotify(dispatcher);
  return container.getId();
}
 

import org.apache.hadoop.yarn.security.client.ClientToAMTokenIdentifier; //导入依赖的package包/类
private List<Token<?>> generateTokens(ApplicationAttemptId attemptId,
    AMRMTokenSecretManager appTokenMgr,
    ClientToAMTokenSecretManagerInRM clientToAMTokenMgr, Configuration conf) {
  AMRMTokenIdentifier appTokenId =
      new AMRMTokenIdentifier(attemptId);
  Token<AMRMTokenIdentifier> appToken =
      new Token<AMRMTokenIdentifier>(appTokenId, appTokenMgr);
  appToken.setService(new Text("appToken service"));

  ClientToAMTokenIdentifier clientToAMTokenId =
      new ClientToAMTokenIdentifier(attemptId);
  clientToAMTokenMgr.registerApplication(attemptId);
  Token<ClientToAMTokenIdentifier> clientToAMToken =
      new Token<ClientToAMTokenIdentifier>(clientToAMTokenId, clientToAMTokenMgr);
  clientToAMToken.setService(new Text("clientToAMToken service"));
  List<Token<?>> tokenPair = new ArrayList<Token<?>>();
  tokenPair.add(0, appToken);
  tokenPair.add(1, clientToAMToken);
  return tokenPair;
}
 

import org.apache.hadoop.yarn.security.client.ClientToAMTokenIdentifier; //导入依赖的package包/类
@Test
public void testClientToAMTokenIdentifier() throws IOException {
  ApplicationAttemptId appAttemptId = ApplicationAttemptId.newInstance(
      ApplicationId.newInstance(1, 1), 1);
  
  String clientName = "user";

  ClientToAMTokenIdentifier token = new ClientToAMTokenIdentifier(
      appAttemptId, clientName);
  
  ClientToAMTokenIdentifier anotherToken = new ClientToAMTokenIdentifier();
  
  byte[] tokenContent = token.getBytes();
  DataInputBuffer dib = new DataInputBuffer();
  dib.reset(tokenContent, tokenContent.length);
  anotherToken.readFields(dib);
      
  // verify the whole record equals with original record
  Assert.assertEquals("Token is not the same after serialization " +
      "and deserialization.", token, anotherToken);
      
  Assert.assertEquals("ApplicationAttemptId from proto is not the same with original token",
      anotherToken.getApplicationAttemptID(), appAttemptId);
  
  Assert.assertEquals("clientName from proto is not the same with original token",
      anotherToken.getClientName(), clientName);
}
 

import org.apache.hadoop.yarn.security.client.ClientToAMTokenIdentifier; //导入依赖的package包/类
private void verifyTokenWithTamperedID(final Configuration conf,
    final CustomAM am, Token<ClientToAMTokenIdentifier> token)
    throws IOException {
  // Malicious user, messes with appId
  UserGroupInformation ugi = UserGroupInformation.createRemoteUser("me");
  ClientToAMTokenIdentifier maliciousID =
      new ClientToAMTokenIdentifier(BuilderUtils.newApplicationAttemptId(
        BuilderUtils.newApplicationId(am.appAttemptId.getApplicationId()
          .getClusterTimestamp(), 42), 43), UserGroupInformation
        .getCurrentUser().getShortUserName());

  verifyTamperedToken(conf, am, token, ugi, maliciousID);
}
 

import org.apache.hadoop.yarn.security.client.ClientToAMTokenIdentifier; //导入依赖的package包/类
private void verifyTokenWithTamperedUserName(final Configuration conf,
    final CustomAM am, Token<ClientToAMTokenIdentifier> token)
    throws IOException {
  // Malicious user, messes with appId
  UserGroupInformation ugi = UserGroupInformation.createRemoteUser("me");
  ClientToAMTokenIdentifier maliciousID =
      new ClientToAMTokenIdentifier(am.appAttemptId, "evilOrc");

  verifyTamperedToken(conf, am, token, ugi, maliciousID);
}
 

import org.apache.hadoop.yarn.security.client.ClientToAMTokenIdentifier; //导入依赖的package包/类
public ClientToAMTokenIdentifierForTest(
    ClientToAMTokenIdentifier tokenIdentifier, String message) {
  ClientToAMTokenIdentifierForTestProto.Builder builder = 
      ClientToAMTokenIdentifierForTestProto.newBuilder();
  builder.setAppAttemptId(tokenIdentifier.getProto().getAppAttemptId());
  builder.setClientName(tokenIdentifier.getProto().getClientName());
  builder.setMessage(message);
  proto = builder.build();
}
 

import org.apache.hadoop.yarn.security.client.ClientToAMTokenIdentifier; //导入依赖的package包/类
@Test
public void testGetClientToken() throws Exception {
  assumeTrue(isSecurityEnabled);
  Container amContainer = allocateApplicationAttempt();

  // before attempt is launched, can not get ClientToken
  Token<ClientToAMTokenIdentifier> token =
      applicationAttempt.createClientToken(null);
  Assert.assertNull(token);
  token = applicationAttempt.createClientToken("clientuser");
  Assert.assertNull(token);

  launchApplicationAttempt(amContainer);
  // after attempt is launched , can get ClientToken
  token = applicationAttempt.createClientToken(null);
  Assert.assertNull(token);
  token = applicationAttempt.createClientToken("clientuser");
  Assert.assertNotNull(token);

  applicationAttempt.handle(new RMAppAttemptEvent(applicationAttempt
    .getAppAttemptId(), RMAppAttemptEventType.KILL));
  assertEquals(YarnApplicationAttemptState.LAUNCHED,
      applicationAttempt.createApplicationAttemptState());
  sendAttemptUpdateSavedEvent(applicationAttempt);
  // after attempt is killed, can not get Client Token
  token = applicationAttempt.createClientToken(null);
  Assert.assertNull(token);
  token = applicationAttempt.createClientToken("clientuser");
  Assert.assertNull(token);
}