Java UserGroupInformation.createRemoteUser方法代码示例

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
private MRClientProtocol getMRClientProtocol(Token token,
    final InetSocketAddress hsAddress, String user, final Configuration conf) {
  UserGroupInformation ugi = UserGroupInformation.createRemoteUser(user);
  ugi.addToken(ConverterUtils.convertFromYarn(token, hsAddress));

  final YarnRPC rpc = YarnRPC.create(conf);
  MRClientProtocol hsWithDT = ugi
      .doAs(new PrivilegedAction<MRClientProtocol>() {

        @Override
        public MRClientProtocol run() {
          return (MRClientProtocol) rpc.getProxy(HSClientProtocol.class,
              hsAddress, conf);
        }
      });
  return hsWithDT;
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws InvalidToken, AccessControlException {
  if (authMethod == AuthMethod.TOKEN) {
    TokenIdentifier tokenId = SaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    UserGroupInformation ugi = tokenId.getUser();
    if (ugi == null) {
      throw new AccessControlException(
          "Can't retrieve username from tokenIdentifier.");
    }
    ugi.addTokenIdentifier(tokenId);
    return ugi;
  } else {
    return UserGroupInformation.createRemoteUser(authorizedId, authMethod);
  }
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
@Test
public void testCacheGetGroupsRoot() throws Exception {
  // Windows users don't have a root user.
  // However pretty much every other *NIX os will have root.
  if (!SystemUtils.IS_OS_WINDOWS) {
    Configuration conf = HBaseConfiguration.create();
    UserProvider up = UserProvider.instantiate(conf);


    String rootUserName = "root";

    // Create two UGI's for this username
    UserGroupInformation ugiOne = UserGroupInformation.createRemoteUser(rootUserName);
    UserGroupInformation ugiTwo = UserGroupInformation.createRemoteUser(rootUserName);

    // Now try and get the user twice.
    User uOne = up.create(ugiOne);
    User uTwo = up.create(ugiTwo);

    // Make sure that we didn't break groups and everything worked well.
    assertArrayEquals(uOne.getGroupNames(),uTwo.getGroupNames());
    String[] groupNames = ugiOne.getGroupNames();
    assertTrue(groupNames.length > 0);
  }
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
private StartContainersResponse startContainer(Context context,
    final ContainerManagerImpl cm, ContainerId cid,
    ContainerLaunchContext clc, LogAggregationContext logAggregationContext)
        throws Exception {
  UserGroupInformation user = UserGroupInformation.createRemoteUser(
      cid.getApplicationAttemptId().toString());
  StartContainerRequest scReq = StartContainerRequest.newInstance(
      clc, TestContainerManager.createContainerToken(cid, 0,
          context.getNodeId(), user.getShortUserName(),
          context.getContainerTokenSecretManager(), logAggregationContext));
  final List<StartContainerRequest> scReqList =
      new ArrayList<StartContainerRequest>();
  scReqList.add(scReq);
  NMTokenIdentifier nmToken = new NMTokenIdentifier(
      cid.getApplicationAttemptId(), context.getNodeId(),
      user.getShortUserName(),
      context.getNMTokenSecretManager().getCurrentKey().getKeyId());
  user.addTokenIdentifier(nmToken);
  return user.doAs(new PrivilegedExceptionAction<StartContainersResponse>() {
    @Override
    public StartContainersResponse run() throws Exception {
      return cm.startContainers(
          StartContainersRequest.newInstance(scReqList));
    }
  });
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
@Test(expected = IllegalArgumentException.class)
public void testNullIpAddress() throws Exception {
  Configuration conf = new Configuration();
  conf.set(
      DefaultImpersonationProvider.getTestProvider().
          getProxySuperuserGroupConfKey(REAL_USER_NAME),
      "*");
  conf.set(
      DefaultImpersonationProvider.getTestProvider().
          getProxySuperuserIpConfKey(REAL_USER_NAME),
      PROXY_IP_RANGE);
  ProxyUsers.refreshSuperUserGroupsConfiguration(conf);

  // First try proxying a group that's allowed
  UserGroupInformation realUserUgi = UserGroupInformation
      .createRemoteUser(REAL_USER_NAME);
  UserGroupInformation proxyUserUgi = UserGroupInformation.createProxyUserForTesting(
      PROXY_USER_NAME, realUserUgi, GROUP_NAMES);

  // remote address is null
  ProxyUsers.authorize(proxyUserUgi, null);
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
@Override
public UserGroupInformation getUser() {
  String appAttemptId = null;
  if (proto.hasAppAttemptId()) {
    appAttemptId = 
        new ApplicationAttemptIdPBImpl(proto.getAppAttemptId()).toString();
  }
  return UserGroupInformation.createRemoteUser(appAttemptId);
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
private ApplicationClientProtocol getRMClientForUser(String user)
    throws IOException, InterruptedException {
  UserGroupInformation userUGI = UserGroupInformation
      .createRemoteUser(user);
  ApplicationClientProtocol userClient = userUGI
      .doAs(new PrivilegedExceptionAction<ApplicationClientProtocol>() {
        @Override
        public ApplicationClientProtocol run() throws Exception {
          return (ApplicationClientProtocol) rpc.getProxy(ApplicationClientProtocol.class,
              rmAddress, conf);
        }
      });
  return userClient;
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
/** {@inheritDoc} */
@Override
public UserGroupInformation getUser() {
  if (jobid == null || "".equals(jobid.toString())) {
    return null;
  }
  return UserGroupInformation.createRemoteUser(jobid.toString());
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
@Test
public void testFallbackToPseudoDelegationTokenAuthenticator()
    throws Exception {
  final Server jetty = createJettyServer();
  Context context = new Context();
  context.setContextPath("/foo");
  jetty.setHandler(context);
  context.addFilter(new FilterHolder(PseudoDTAFilter.class), "/*", 0);
  context.addServlet(new ServletHolder(UserServlet.class), "/bar");

  try {
    jetty.start();
    final URL url = new URL(getJettyURL() + "/foo/bar");

    UserGroupInformation ugi = UserGroupInformation.createRemoteUser(FOO_USER);
    ugi.doAs(new PrivilegedExceptionAction<Void>() {
      @Override
      public Void run() throws Exception {
        DelegationTokenAuthenticatedURL.Token token =
            new DelegationTokenAuthenticatedURL.Token();
        DelegationTokenAuthenticatedURL aUrl =
            new DelegationTokenAuthenticatedURL();
        HttpURLConnection conn = aUrl.openConnection(url, token);
        Assert.assertEquals(HttpURLConnection.HTTP_OK,
            conn.getResponseCode());
        List<String> ret = IOUtils.readLines(conn.getInputStream());
        Assert.assertEquals(1, ret.size());
        Assert.assertEquals(FOO_USER, ret.get(0));

        aUrl.getDelegationToken(url, token, FOO_USER);
        Assert.assertNotNull(token.getDelegationToken());
        Assert.assertEquals(new Text("token-kind"),
            token.getDelegationToken().getKind());
        return null;
      }
    });
  } finally {
    jetty.stop();
  }
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
@Override
public UserGroupInformation getUser() {
  if (realUser.toString().isEmpty()) {
    return UserGroupInformation.createRemoteUser(tokenid.toString());
  } else {
    UserGroupInformation realUgi = UserGroupInformation
        .createRemoteUser(realUser.toString());
    return UserGroupInformation
        .createProxyUser(tokenid.toString(), realUgi);
  }
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
public static void loadTest(String ipString, int testRange) {
  Configuration conf = new Configuration();
  conf.set(
      DefaultImpersonationProvider.getTestProvider().
          getProxySuperuserGroupConfKey(REAL_USER_NAME),
      StringUtils.join(",", Arrays.asList(GROUP_NAMES)));

  conf.set(
      DefaultImpersonationProvider.getTestProvider().
          getProxySuperuserIpConfKey(REAL_USER_NAME),
      ipString
      );
  ProxyUsers.refreshSuperUserGroupsConfiguration(conf);


  // First try proxying a group that's allowed
  UserGroupInformation realUserUgi = UserGroupInformation
      .createRemoteUser(REAL_USER_NAME);
  UserGroupInformation proxyUserUgi = UserGroupInformation.createProxyUserForTesting(
      PROXY_USER_NAME, realUserUgi, GROUP_NAMES);

  long startTime = System.nanoTime();
  SecureRandom sr = new SecureRandom();
  for (int i=1; i < 1000000; i++){
    try {
      ProxyUsers.authorize(proxyUserUgi,  "1.2.3."+ sr.nextInt(testRange));
     } catch (AuthorizationException e) {
    }
  }
  long stopTime = System.nanoTime();
  long elapsedTime = stopTime - startTime;
  System.out.println(elapsedTime/1000000 + " ms");
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
/**
 * send out request for AM container
 */
protected void requestAMContainer()
        throws YarnException, IOException, InterruptedException {
  List<ResourceRequest> ask = new ArrayList<ResourceRequest>();
  ResourceRequest amRequest = createResourceRequest(
          BuilderUtils.newResource(MR_AM_CONTAINER_RESOURCE_MEMORY_MB,
                  MR_AM_CONTAINER_RESOURCE_VCORES),
          ResourceRequest.ANY, 1, 1);
  ask.add(amRequest);
  LOG.debug(MessageFormat.format("Application {0} sends out allocate " +
          "request for its AM", appId));
  final AllocateRequest request = this.createAllocateRequest(ask);

  UserGroupInformation ugi =
          UserGroupInformation.createRemoteUser(appAttemptId.toString());
  Token<AMRMTokenIdentifier> token = rm.getRMContext().getRMApps()
          .get(appAttemptId.getApplicationId())
          .getRMAppAttempt(appAttemptId).getAMRMToken();
  ugi.addTokenIdentifier(token.decodeIdentifier());
  AllocateResponse response = ugi.doAs(
          new PrivilegedExceptionAction<AllocateResponse>() {
    @Override
    public AllocateResponse run() throws Exception {
      return rm.getApplicationMasterService().allocate(request);
    }
  });
  if (response != null) {
    responseQueue.put(response);
  }
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
public void testFsCache() throws Exception {
  {
    long now = System.currentTimeMillis();
    String[] users = new String[]{"foo","bar"};
    final Configuration conf = new Configuration();
    FileSystem[] fs = new FileSystem[users.length];

    for(int i = 0; i < users.length; i++) {
      UserGroupInformation ugi = UserGroupInformation.createRemoteUser(users[i]);
      fs[i] = ugi.doAs(new PrivilegedExceptionAction<FileSystem>() {
        public FileSystem run() throws IOException {
          return FileSystem.get(conf);
      }});
      for(int j = 0; j < i; j++) {
        assertFalse(fs[j] == fs[i]);
      }
    }
    FileSystem.closeAll();
  }
  
  {
    try {
      runTestCache(NameNode.DEFAULT_PORT);
    } catch(java.net.BindException be) {
      LOG.warn("Cannot test NameNode.DEFAULT_PORT (="
          + NameNode.DEFAULT_PORT + ")", be);
    }

    runTestCache(0);
  }
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
@Test
public void testNoHostsForUsers() throws Exception {
  Configuration conf = new Configuration(false);
  conf.set("y." + REAL_USER_NAME + ".users",
    StringUtils.join(",", Arrays.asList(AUTHORIZED_PROXY_USER_NAME)));
  ProxyUsers.refreshSuperUserGroupsConfiguration(conf, "y");

  UserGroupInformation realUserUgi = UserGroupInformation
    .createRemoteUser(REAL_USER_NAME);
  UserGroupInformation proxyUserUgi = UserGroupInformation.createProxyUserForTesting(
    AUTHORIZED_PROXY_USER_NAME, realUserUgi, GROUP_NAMES);

  // IP doesn't matter
  assertNotAuthorized(proxyUserUgi, "1.2.3.4");
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
@Override
protected void sendContainerRequest()
        throws YarnException, IOException, InterruptedException {
  if (isFinished) {
    return;
  }

  // send out request
  List<ResourceRequest> ask = null;
  if (isAMContainerRunning) {
    if (mapFinished != mapTotal) {
      // map phase
      if (! pendingMaps.isEmpty()) {
        ask = packageRequests(pendingMaps, PRIORITY_MAP);
        LOG.debug(MessageFormat.format("Application {0} sends out " +
                "request for {1} mappers.", appId, pendingMaps.size()));
        scheduledMaps.addAll(pendingMaps);
        pendingMaps.clear();
      } else if (! pendingFailedMaps.isEmpty() && scheduledMaps.isEmpty()) {
        ask = packageRequests(pendingFailedMaps, PRIORITY_MAP);
        LOG.debug(MessageFormat.format("Application {0} sends out " +
                "requests for {1} failed mappers.", appId,
                pendingFailedMaps.size()));
        scheduledMaps.addAll(pendingFailedMaps);
        pendingFailedMaps.clear();
      }
    } else if (reduceFinished != reduceTotal) {
      // reduce phase
      if (! pendingReduces.isEmpty()) {
        ask = packageRequests(pendingReduces, PRIORITY_REDUCE);
        LOG.debug(MessageFormat.format("Application {0} sends out " +
                "requests for {1} reducers.", appId, pendingReduces.size()));
        scheduledReduces.addAll(pendingReduces);
        pendingReduces.clear();
      } else if (! pendingFailedReduces.isEmpty()
              && scheduledReduces.isEmpty()) {
        ask = packageRequests(pendingFailedReduces, PRIORITY_REDUCE);
        LOG.debug(MessageFormat.format("Application {0} sends out " +
                "request for {1} failed reducers.", appId,
                pendingFailedReduces.size()));
        scheduledReduces.addAll(pendingFailedReduces);
        pendingFailedReduces.clear();
      }
    }
  }
  if (ask == null) {
    ask = new ArrayList<ResourceRequest>();
  }
  
  final AllocateRequest request = createAllocateRequest(ask);
  if (totalContainers == 0) {
    request.setProgress(1.0f);
  } else {
    request.setProgress((float) finishedContainers / totalContainers);
  }

  UserGroupInformation ugi =
          UserGroupInformation.createRemoteUser(appAttemptId.toString());
  Token<AMRMTokenIdentifier> token = rm.getRMContext().getRMApps()
          .get(appAttemptId.getApplicationId())
          .getRMAppAttempt(appAttemptId).getAMRMToken();
  ugi.addTokenIdentifier(token.decodeIdentifier());
  AllocateResponse response = ugi.doAs(
          new PrivilegedExceptionAction<AllocateResponse>() {
    @Override
    public AllocateResponse run() throws Exception {
      return rm.getApplicationMasterService().allocate(request);
    }
  });
  if (response != null) {
    responseQueue.put(response);
  }
}