Java UserGroupInformation.getRealUser方法代码示例

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
/**
 * Called after a new FileSystem instance is constructed.
 *
 * @param name a uri whose authority section names the host, port, etc. for this FileSystem
 * @param conf the configuration
 */
@Override
public void initialize(URI name, Configuration conf) throws IOException {
  UserGroupInformation ugi = UserGroupInformation.getCurrentUser();

  //the real use is the one that has the Kerberos credentials needed for
  //SPNEGO to work
  realUser = ugi.getRealUser();
  if (realUser == null) {
    realUser = UserGroupInformation.getLoginUser();
  }
  super.initialize(name, conf);
  try {
    uri = new URI(name.getScheme() + "://" + name.getAuthority());
  } catch (URISyntaxException ex) {
    throw new IOException(ex);
  }

  Class<? extends DelegationTokenAuthenticator> klass =
      getConf().getClass("httpfs.authenticator.class",
          KerberosDelegationTokenAuthenticator.class,
          DelegationTokenAuthenticator.class);
  DelegationTokenAuthenticator authenticator =
      ReflectionUtils.newInstance(klass, getConf());
  authURL = new DelegationTokenAuthenticatedURL(authenticator);
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
Param<?,?>[] getAuthParameters(final HttpOpParam.Op op) throws IOException {
  List<Param<?,?>> authParams = Lists.newArrayList();    
  // Skip adding delegation token for token operations because these
  // operations require authentication.
  Token<?> token = null;
  if (!op.getRequireAuth()) {
    token = getDelegationToken();
  }
  if (token != null) {
    authParams.add(new DelegationParam(token.encodeToUrlString()));
  } else {
    UserGroupInformation userUgi = ugi;
    UserGroupInformation realUgi = userUgi.getRealUser();
    if (realUgi != null) { // proxy user
      authParams.add(new DoAsParam(userUgi.getShortUserName()));
      userUgi = realUgi;
    }
    authParams.add(new UserParam(userUgi.getShortUserName()));
  }
  return authParams.toArray(new Param<?,?>[0]);
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
@Override
public void authorize(UserGroupInformation user, 
    String remoteAddress) throws AuthorizationException {
  
  UserGroupInformation realUser = user.getRealUser();
  if (realUser == null) {
    return;
  }
  
  AccessControlList acl = proxyUserAcl.get(configPrefix +
      realUser.getShortUserName());
  if (acl == null || !acl.isUserAllowed(user)) {
    throw new AuthorizationException("User: " + realUser.getUserName()
        + " is not allowed to impersonate " + user.getUserName());
  }

  MachineList MachineList = proxyHosts.get(
      getProxySuperuserIpConfKey(realUser.getShortUserName()));

  if(MachineList == null || !MachineList.includes(remoteAddress)) {
    throw new AuthorizationException("Unauthorized connection for super-user: "
        + realUser.getUserName() + " from IP " + remoteAddress);
  }
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
private synchronized UserInformation getUserInfo(UserGroupInformation ugi) {
  if (ugi == null || authMethod == AuthMethod.DIGEST) {
    // Don't send user for token auth
    return null;
  }
  UserInformation.Builder userInfoPB = UserInformation.newBuilder();
  if (authMethod == AuthMethod.KERBEROS) {
    // Send effective user for Kerberos auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
  } else if (authMethod == AuthMethod.SIMPLE) {
    //Send both effective user and real user for simple auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
    if (ugi.getRealUser() != null) {
      userInfoPB.setRealUser(ugi.getRealUser().getUserName());
    }
  }
  return userInfoPB.build();
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
/**
 * Build the user information
 *
 * @param ugi        User Group Information
 * @param authMethod Authorization method
 * @return UserInformation protobuf
 */
private RPCProtos.UserInformation buildUserInfo(UserGroupInformation ugi, AuthMethod authMethod) {
  if (ugi == null || authMethod == AuthMethod.DIGEST) {
    // Don't send user for token auth
    return null;
  }
  RPCProtos.UserInformation.Builder userInfoPB = RPCProtos.UserInformation.newBuilder();
  if (authMethod == AuthMethod.KERBEROS) {
    // Send effective user for Kerberos auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
  } else if (authMethod == AuthMethod.SIMPLE) {
    //Send both effective user and real user for simple auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
    if (ugi.getRealUser() != null) {
      userInfoPB.setRealUser(ugi.getRealUser().getUserName());
    }
  }
  return userInfoPB.build();
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
@Override
public void authorize(UserGroupInformation user, 
    String remoteAddress) throws AuthorizationException {
  
  if (user == null) {
    throw new IllegalArgumentException("user is null.");
  }

  UserGroupInformation realUser = user.getRealUser();
  if (realUser == null) {
    return;
  }
  
  AccessControlList acl = proxyUserAcl.get(configPrefix +
      realUser.getShortUserName());
  if (acl == null || !acl.isUserAllowed(user)) {
    throw new AuthorizationException("User: " + realUser.getUserName()
        + " is not allowed to impersonate " + user.getUserName());
  }

  MachineList MachineList = proxyHosts.get(
      getProxySuperuserIpConfKey(realUser.getShortUserName()));

  if(MachineList == null || !MachineList.includes(remoteAddress)) {
    throw new AuthorizationException("Unauthorized connection for super-user: "
        + realUser.getUserName() + " from IP " + remoteAddress);
  }
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
/** 
 * This method creates the connection context  using exactly the same logic
 * as the old connection context as was done for writable where
 * the effective and real users are set based on the auth method.
 *
 */
public static IpcConnectionContextProto makeIpcConnectionContext(
    final String protocol,
    final UserGroupInformation ugi, final AuthMethod authMethod) {
  IpcConnectionContextProto.Builder result = IpcConnectionContextProto.newBuilder();
  if (protocol != null) {
    result.setProtocol(protocol);
  }
  UserInformationProto.Builder ugiProto =  UserInformationProto.newBuilder();
  if (ugi != null) {
    /*
     * In the connection context we send only additional user info that
     * is not derived from the authentication done during connection setup.
     */
    if (authMethod == AuthMethod.KERBEROS) {
      // Real user was established as part of the connection.
      // Send effective user only.
      ugiProto.setEffectiveUser(ugi.getUserName());
    } else if (authMethod == AuthMethod.TOKEN) {
      // With token, the connection itself establishes 
      // both real and effective user. Hence send none in header.
    } else {  // Simple authentication
      // No user info is established as part of the connection.
      // Send both effective user and real user
      ugiProto.setEffectiveUser(ugi.getUserName());
      if (ugi.getRealUser() != null) {
        ugiProto.setRealUser(ugi.getRealUser().getUserName());
      }
    }
  }   
  result.setUserInfo(ugiProto);
  return result.build();
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
private synchronized boolean shouldAuthenticateOverKrb() throws IOException {
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  UserGroupInformation currentUser = UserGroupInformation.getCurrentUser();
  UserGroupInformation realUser = currentUser.getRealUser();
  if (authMethod == AuthMethod.KERBEROS && loginUser != null &&
  // Make sure user logged in using Kerberos either keytab or TGT
      loginUser.hasKerberosCredentials() &&
      // relogin only in case it is the login user (e.g. JT)
      // or superuser (like oozie).
      (loginUser.equals(currentUser) || loginUser.equals(realUser))) {
    return true;
  }
  return false;
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
/**
 * Authorize a user (superuser) to impersonate another user (user1) if the 
 * superuser belongs to the group "sudo_user1" .
 */

public void authorize(UserGroupInformation user, 
    String remoteAddress) throws AuthorizationException{
  UserGroupInformation superUser = user.getRealUser();

  String sudoGroupName = "sudo_" + user.getShortUserName();
  if (!Arrays.asList(superUser.getGroupNames()).contains(sudoGroupName)){
    throw new AuthorizationException("User: " + superUser.getUserName()
        + " is not allowed to impersonate " + user.getUserName());
  }
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
/**
 * Log details about the current Hadoop user at INFO.
 * Robust against IOEs when trying to get the current user
 */
public void logCurrentHadoopUser() {
  try {
    UserGroupInformation currentUser = UserGroupInformation.getCurrentUser();
    LOG.info("Current user = {}",currentUser);
    UserGroupInformation realUser = currentUser.getRealUser();
    LOG.info("Real User = {}" , realUser);
  } catch (IOException e) {
    LOG.warn("Failed to get current user {}, {}", e);
  }
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
private void checkUgiFromAuth(UserGroupInformation ugi) {
  if (ugi.getRealUser() != null) {
    Assert.assertEquals(AuthenticationMethod.PROXY,
                        ugi.getAuthenticationMethod());
    Assert.assertEquals(AuthenticationMethod.KERBEROS_SSL,
                        ugi.getRealUser().getAuthenticationMethod());
  } else {
    Assert.assertEquals(AuthenticationMethod.KERBEROS_SSL,
                        ugi.getAuthenticationMethod()); 
  }
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
private void checkUgiFromToken(UserGroupInformation ugi) {
  if (ugi.getRealUser() != null) {
    Assert.assertEquals(AuthenticationMethod.PROXY,
                        ugi.getAuthenticationMethod());
    Assert.assertEquals(AuthenticationMethod.TOKEN,
                        ugi.getRealUser().getAuthenticationMethod());
  } else {
    Assert.assertEquals(AuthenticationMethod.TOKEN,
                        ugi.getAuthenticationMethod());
  }
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
public static UserInformation toProtoUserInfo(UserGroupInformation ugi) {
  UserInformation.Builder userInfoPB = UserInformation.newBuilder();
  userInfoPB.setEffectiveUser(ugi.getUserName());
  if (ugi.getRealUser() != null) {
    userInfoPB.setRealUser(ugi.getRealUser().getUserName());
  }
  return userInfoPB.build();
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
private synchronized boolean shouldAuthenticateOverKrb() throws IOException {
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  UserGroupInformation currentUser =
    UserGroupInformation.getCurrentUser();
  UserGroupInformation realUser = currentUser.getRealUser();
  return authMethod == AuthMethod.KERBEROS &&
      loginUser != null &&
      //Make sure user logged in using Kerberos either keytab or TGT
      loginUser.hasKerberosCredentials() &&
      // relogin only in case it is the login user (e.g. JT)
      // or superuser (like oozie).
      (loginUser.equals(currentUser) || loginUser.equals(realUser));
}
 

import org.apache.hadoop.security.UserGroupInformation; //导入方法依赖的package包/类
/**
 * Check if user should authenticate over Kerberos
 *
 * @return true if should be authenticated over Kerberos
 * @throws java.io.IOException on failure of check
 */
private synchronized boolean shouldAuthenticateOverKrb() throws IOException {
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  UserGroupInformation currentUser = UserGroupInformation.getCurrentUser();
  UserGroupInformation realUser = currentUser.getRealUser();
  return authMethod == AuthMethod.KERBEROS &&
      loginUser != null &&
      //Make sure user logged in using Kerberos either keytab or TGT
      loginUser.hasKerberosCredentials() &&
      // relogin only in case it is the login user (e.g. JT)
      // or superuser (like oozie).
      (loginUser.equals(currentUser) || loginUser.equals(realUser));
}