Java Credentials.addToken方法代码示例

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
/**
 * Recursively obtain the tokens for this FileSystem and all descended
 * FileSystems as determined by getChildFileSystems().
 * @param renewer the user allowed to renew the delegation tokens
 * @param credentials cache in which to add the new delegation tokens
 * @param tokens list in which to add acquired tokens
 * @throws IOException
 */
private void collectDelegationTokens(final String renewer,
                                     final Credentials credentials,
                                     final List<Token<?>> tokens)
                                         throws IOException {
  final String serviceName = getCanonicalServiceName();
  // Collect token of the this filesystem and then of its embedded children
  if (serviceName != null) { // fs has token, grab it
    final Text service = new Text(serviceName);
    Token<?> token = credentials.getToken(service);
    if (token == null) {
      token = getDelegationToken(renewer);
      if (token != null) {
        tokens.add(token);
        credentials.addToken(service, token);
      }
    }
  }
  // Now collect the tokens from the children
  final FileSystem[] children = getChildFileSystems();
  if (children != null) {
    for (final FileSystem fs : children) {
      fs.collectDelegationTokens(renewer, credentials, tokens);
    }
  }
}
 

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
@VisibleForTesting
void addHistoryToken(Credentials ts) throws IOException, InterruptedException {
  /* check if we have a hsproxy, if not, no need */
  MRClientProtocol hsProxy = clientCache.getInitializedHSProxy();
  if (UserGroupInformation.isSecurityEnabled() && (hsProxy != null)) {
    /*
     * note that get delegation token was called. Again this is hack for oozie
     * to make sure we add history server delegation tokens to the credentials
     */
    RMDelegationTokenSelector tokenSelector = new RMDelegationTokenSelector();
    Text service = resMgrDelegate.getRMDelegationTokenService();
    if (tokenSelector.selectToken(service, ts.getAllTokens()) != null) {
      Text hsService = SecurityUtil.buildTokenService(hsProxy
          .getConnectAddress());
      if (ts.getToken(hsService) == null) {
        ts.addToken(hsService, getDelegationTokenFromHS(hsProxy));
      }
    }
  }
}
 

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
@Test
public void testFsWithDuplicateChildrenTokenExists() throws Exception {
  Credentials credentials = new Credentials();
  Text service = new Text("singleTokenFs1");
  Token<?> token = mock(Token.class);
  credentials.addToken(service, token);

  MockFileSystem fs = createFileSystemForServiceName(service);
  MockFileSystem multiFs =
      createFileSystemForServiceName(null, fs, new FilterFileSystem(fs));
  
  multiFs.addDelegationTokens(renewer, credentials);
  verifyTokenFetch(multiFs, false);
  verifyTokenFetch(fs, false);
  
  assertEquals(1, credentials.numberOfTokens());
  assertSame(token, credentials.getToken(service));
}
 

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
@Test
public void testFsWithMyOwnAndChildTokens() throws Exception {
  Credentials credentials = new Credentials();
  Text service1 = new Text("singleTokenFs1");
  Text service2 = new Text("singleTokenFs2");
  Text myService = new Text("multiTokenFs");
  Token<?> token = mock(Token.class);
  credentials.addToken(service2, token);

  MockFileSystem fs1 = createFileSystemForServiceName(service1);
  MockFileSystem fs2 = createFileSystemForServiceName(service2);
  MockFileSystem multiFs = createFileSystemForServiceName(myService, fs1, fs2);
  
  multiFs.addDelegationTokens(renewer, credentials);
  verifyTokenFetch(multiFs, true); // its own token and also of its children
  verifyTokenFetch(fs1, true);
  verifyTokenFetch(fs2, false);  // we had added its token to credentials 
  
  assertEquals(3, credentials.numberOfTokens());
  assertNotNull(credentials.getToken(myService));
  assertNotNull(credentials.getToken(service1));
  assertNotNull(credentials.getToken(service2));
}
 

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
@Test
public void testFsWithMyOwnExistsAndChildTokens() throws Exception {
  Credentials credentials = new Credentials();
  Text service1 = new Text("singleTokenFs1");
  Text service2 = new Text("singleTokenFs2");
  Text myService = new Text("multiTokenFs");
  Token<?> token = mock(Token.class);
  credentials.addToken(myService, token);

  MockFileSystem fs1 = createFileSystemForServiceName(service1);
  MockFileSystem fs2 = createFileSystemForServiceName(service2);
  MockFileSystem multiFs = createFileSystemForServiceName(myService, fs1, fs2);
  
  multiFs.addDelegationTokens(renewer, credentials);
  verifyTokenFetch(multiFs, false);  // we had added its token to credentials
  verifyTokenFetch(fs1, true);
  verifyTokenFetch(fs2, true);
  
  assertEquals(3, credentials.numberOfTokens());
  assertSame(token, credentials.getToken(myService));
  assertNotNull(credentials.getToken(service1));
  assertNotNull(credentials.getToken(service2));
}
 

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
@VisibleForTesting
void addHistoryToken(Credentials ts) throws IOException, InterruptedException {
	/* check if we have a hsproxy, if not, no need */
	MRClientProtocol hsProxy = clientCache.getInitializedHSProxy();
	if (UserGroupInformation.isSecurityEnabled() && (hsProxy != null)) {
		/*
		 * note that get delegation token was called. Again this is hack for
		 * oozie to make sure we add history server delegation tokens to the
		 * credentials
		 */
		RMDelegationTokenSelector tokenSelector = new RMDelegationTokenSelector();
		Text service = resMgrDelegate.getRMDelegationTokenService();
		if (tokenSelector.selectToken(service, ts.getAllTokens()) != null) {
			Text hsService = SecurityUtil.buildTokenService(hsProxy.getConnectAddress());
			if (ts.getToken(hsService) == null) {
				ts.addToken(hsService, getDelegationTokenFromHS(hsProxy));
			}
		}
	}
}
 

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
@Test
public void testFsWithChildTokensOneExists() throws Exception {
  Credentials credentials = new Credentials();
  Text service1 = new Text("singleTokenFs1");
  Text service2 = new Text("singleTokenFs2");
  Token<?> token = mock(Token.class);
  credentials.addToken(service2, token);

  MockFileSystem fs1 = createFileSystemForServiceName(service1);
  MockFileSystem fs2 = createFileSystemForServiceName(service2);
  MockFileSystem fs3 = createFileSystemForServiceName(null);
  MockFileSystem multiFs = createFileSystemForServiceName(null, fs1, fs2, fs3);
  
  multiFs.addDelegationTokens(renewer, credentials);
  verifyTokenFetch(multiFs, false);
  verifyTokenFetch(fs1, true);
  verifyTokenFetch(fs2, false); // we had added its token to credentials
  verifyTokenFetch(fs3, false);
  
  assertEquals(2, credentials.numberOfTokens());
  assertNotNull(credentials.getToken(service1));
  assertSame(token, credentials.getToken(service2));
}
 

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
@SuppressWarnings({ "rawtypes", "unchecked" })
static DataInputBuffer createFakeCredentials(Random r, int nTok)
      throws IOException {
    Credentials creds = new Credentials();
    byte[] password = new byte[20];
    Text kind = new Text();
    Text service = new Text();
    Text alias = new Text();
    for (int i = 0; i < nTok; ++i) {
      byte[] identifier = ("idef" + i).getBytes();
      r.nextBytes(password);
      kind.set("kind" + i);
      service.set("service" + i);
      alias.set("token" + i);
      Token token = new Token(identifier, password, kind, service);
      creds.addToken(alias, token);
    }
    DataOutputBuffer buf = new DataOutputBuffer();
    creds.writeTokenStorageToStream(buf);
    DataInputBuffer ret = new DataInputBuffer();
    ret.reset(buf.getData(), 0, buf.getLength());
    return ret;
  }
 

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
@Test
public void addAll() {
  Credentials creds = new Credentials();
  creds.addToken(service[0], token[0]);
  creds.addToken(service[1], token[1]);
  creds.addSecretKey(secret[0], secret[0].getBytes());
  creds.addSecretKey(secret[1], secret[1].getBytes());

  Credentials credsToAdd = new Credentials();
  // one duplicate with different value, one new
  credsToAdd.addToken(service[0], token[3]);
  credsToAdd.addToken(service[2], token[2]);
  credsToAdd.addSecretKey(secret[0], secret[3].getBytes());
  credsToAdd.addSecretKey(secret[2], secret[2].getBytes());
  
  creds.addAll(credsToAdd);
  assertEquals(3, creds.numberOfTokens());
  assertEquals(3, creds.numberOfSecretKeys());
  // existing token & secret should be overwritten
  assertEquals(token[3], creds.getToken(service[0]));
  assertEquals(secret[3], new Text(creds.getSecretKey(secret[0])));
  // non-duplicate token & secret should be present
  assertEquals(token[1], creds.getToken(service[1]));
  assertEquals(secret[1], new Text(creds.getSecretKey(secret[1])));
  // new token & secret should be added
  assertEquals(token[2], creds.getToken(service[2]));
  assertEquals(secret[2], new Text(creds.getSecretKey(secret[2])));
}
 

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
@Test
public void mergeAll() {
  Credentials creds = new Credentials();
  creds.addToken(service[0], token[0]);
  creds.addToken(service[1], token[1]);
  creds.addSecretKey(secret[0], secret[0].getBytes());
  creds.addSecretKey(secret[1], secret[1].getBytes());
  
  Credentials credsToAdd = new Credentials();
  // one duplicate with different value, one new
  credsToAdd.addToken(service[0], token[3]);
  credsToAdd.addToken(service[2], token[2]);
  credsToAdd.addSecretKey(secret[0], secret[3].getBytes());
  credsToAdd.addSecretKey(secret[2], secret[2].getBytes());
  
  creds.mergeAll(credsToAdd);
  assertEquals(3, creds.numberOfTokens());
  assertEquals(3, creds.numberOfSecretKeys());
  // existing token & secret should not be overwritten
  assertEquals(token[0], creds.getToken(service[0]));
  assertEquals(secret[0], new Text(creds.getSecretKey(secret[0])));
  // non-duplicate token & secret should be present
  assertEquals(token[1], creds.getToken(service[1]));
  assertEquals(secret[1], new Text(creds.getSecretKey(secret[1])));
  // new token & secret should be added
  assertEquals(token[2], creds.getToken(service[2]));
  assertEquals(secret[2], new Text(creds.getSecretKey(secret[2])));
}
 

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
@Test
public void testFsWithTokenExists() throws Exception {
  Credentials credentials = new Credentials();
  Text service = new Text("singleTokenFs");
  MockFileSystem fs = createFileSystemForServiceName(service);
  Token<?> token = mock(Token.class);
  credentials.addToken(service, token);
  
  fs.addDelegationTokens(renewer, credentials);
  verifyTokenFetch(fs, false);
  
  assertEquals(1, credentials.numberOfTokens());
  assertSame(token, credentials.getToken(service));
}
 

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
@Test(timeout=20000)
public void testDTRonAppSubmission()
    throws IOException, InterruptedException, BrokenBarrierException {
  final Credentials credsx = new Credentials();
  final Token<DelegationTokenIdentifier> tokenx = mock(Token.class);
  when(tokenx.getKind()).thenReturn(new Text("HDFS_DELEGATION_TOKEN"));
  DelegationTokenIdentifier dtId1 = 
      new DelegationTokenIdentifier(new Text("user1"), new Text("renewer"),
        new Text("user1"));
  when(tokenx.decodeIdentifier()).thenReturn(dtId1);
  credsx.addToken(new Text("token"), tokenx);
  doReturn(true).when(tokenx).isManaged();
  doThrow(new IOException("boom"))
      .when(tokenx).renew(any(Configuration.class));
    // fire up the renewer
  final DelegationTokenRenewer dtr =
       createNewDelegationTokenRenewer(conf, counter);
  RMContext mockContext = mock(RMContext.class);
  when(mockContext.getSystemCredentialsForApps()).thenReturn(
    new ConcurrentHashMap<ApplicationId, ByteBuffer>());
  ClientRMService mockClientRMService = mock(ClientRMService.class);
  when(mockContext.getClientRMService()).thenReturn(mockClientRMService);
  InetSocketAddress sockAddr =
      InetSocketAddress.createUnresolved("localhost", 1234);
  when(mockClientRMService.getBindAddress()).thenReturn(sockAddr);
  dtr.setRMContext(mockContext);
  when(mockContext.getDelegationTokenRenewer()).thenReturn(dtr);
  dtr.init(conf);
  dtr.start();

  try {
    dtr.addApplicationSync(mock(ApplicationId.class), credsx, false, "user");
    fail("Catch IOException on app submission");
  } catch (IOException e){
    Assert.assertTrue(e.getMessage().contains(tokenx.toString()));
    Assert.assertTrue(e.getCause().toString().contains("boom"));
  }

}
 

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
@Test (timeout = 60000)
public void testAppSubmissionWithOldDelegationTokenAfterRMRestart()
    throws Exception {
  conf.setInt(YarnConfiguration.RM_AM_MAX_ATTEMPTS, 2);
  conf.set(CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION,
      "kerberos");
  conf.set(YarnConfiguration.RM_ADDRESS, "localhost:8032");
  UserGroupInformation.setConfiguration(conf);
  MemoryRMStateStore memStore = new MemoryRMStateStore();
  memStore.init(conf);

  MockRM rm1 = new TestSecurityMockRM(conf, memStore);
  rm1.start();

  GetDelegationTokenRequest request1 =
      GetDelegationTokenRequest.newInstance("renewer1");
  UserGroupInformation.getCurrentUser().setAuthenticationMethod(
      AuthMethod.KERBEROS);
  GetDelegationTokenResponse response1 =
      rm1.getClientRMService().getDelegationToken(request1);
  Token<RMDelegationTokenIdentifier> token1 =
      ConverterUtils.convertFromYarn(response1.getRMDelegationToken(), rmAddr);

  // start new RM
  MockRM rm2 = new TestSecurityMockRM(conf, memStore);
  rm2.start();

  // submit an app with the old delegation token got from previous RM.
  Credentials ts = new Credentials();
  ts.addToken(token1.getService(), token1);
  RMApp app = rm2.submitApp(200, "name", "user",
      new HashMap<ApplicationAccessType, String>(), false, "default", 1, ts);
  rm2.waitForState(app.getApplicationId(), RMAppState.ACCEPTED);
}
 

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
private void setupTokens(
    ContainerLaunchContext container, ContainerId containerID)
    throws IOException {
  Map<String, String> environment = container.getEnvironment();
  environment.put(ApplicationConstants.APPLICATION_WEB_PROXY_BASE_ENV,
      application.getWebProxyBase());
  // Set AppSubmitTime and MaxAppAttempts to be consumable by the AM.
  ApplicationId applicationId =
      application.getAppAttemptId().getApplicationId();
  environment.put(
      ApplicationConstants.APP_SUBMIT_TIME_ENV,
      String.valueOf(rmContext.getRMApps()
          .get(applicationId)
          .getSubmitTime()));
  environment.put(ApplicationConstants.MAX_APP_ATTEMPTS_ENV,
      String.valueOf(rmContext.getRMApps().get(
          applicationId).getMaxAppAttempts()));

  Credentials credentials = new Credentials();
  DataInputByteBuffer dibb = new DataInputByteBuffer();
  if (container.getTokens() != null) {
    // TODO: Don't do this kind of checks everywhere.
    dibb.reset(container.getTokens());
    credentials.readTokenStorageStream(dibb);
  }

  // Add AMRMToken
  Token<AMRMTokenIdentifier> amrmToken = createAndSetAMRMToken();
  if (amrmToken != null) {
    credentials.addToken(amrmToken.getService(), amrmToken);
  }
  DataOutputBuffer dob = new DataOutputBuffer();
  credentials.writeTokenStorageToStream(dob);
  container.setTokens(ByteBuffer.wrap(dob.getData(), 0, dob.getLength()));
}
 

import org.apache.hadoop.security.Credentials; //导入方法依赖的package包/类
/**
 * Basic idea of the test:
 * 1. register a token for 2 seconds with no cancel at the end
 * 2. cancel it immediately
 * 3. Sleep and check that the 2 seconds renew didn't happen 
 * (totally 5 renewals)
 * 4. check cancellation
 * @throws IOException
 * @throws URISyntaxException
 */
@Test(timeout=60000)
public void testDTRenewalWithNoCancel () throws Exception {
  MyFS dfs = (MyFS)FileSystem.get(conf);
  LOG.info("dfs="+(Object)dfs.hashCode() + ";conf="+conf.hashCode());

  Credentials ts = new Credentials();
  MyToken token1 = dfs.getDelegationToken("user1");

  //to cause this one to be set for renew in 2 secs
  Renewer.tokenToRenewIn2Sec = token1; 
  LOG.info("token="+token1+" should be renewed for 2 secs");
  
  String nn1 = DelegationTokenRenewer.SCHEME + "://host1:0";
  ts.addToken(new Text(nn1), token1);
  

  ApplicationId applicationId_1 = BuilderUtils.newApplicationId(0, 1);
  delegationTokenRenewer.addApplicationAsync(applicationId_1, ts, false, "user");
  waitForEventsToGetProcessed(delegationTokenRenewer);
  delegationTokenRenewer.applicationFinished(applicationId_1);
  waitForEventsToGetProcessed(delegationTokenRenewer);
  int numberOfExpectedRenewals = Renewer.counter; // number of renewals so far
  try {
    Thread.sleep(6*1000); // sleep 6 seconds, so it has time to renew
  } catch (InterruptedException e) {}
  LOG.info("Counter = " + Renewer.counter + ";t="+ Renewer.lastRenewed);
  
  // counter and the token should still be the old ones
  assertEquals("renew wasn't called as many times as expected",
      numberOfExpectedRenewals, Renewer.counter);
  
  // also renewing of the canceled token should not fail, because it has not
  // been canceled
  token1.renew(conf);
}