Java NMTokenIdentifier.getApplicationAttemptId方法代码示例

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入方法依赖的package包/类
/**
 * This method will be used to verify NMTokens generated by different master
 * keys.
 */
@Override
public synchronized byte[] retrievePassword(NMTokenIdentifier identifier)
    throws InvalidToken {
  int keyId = identifier.getKeyId();
  ApplicationAttemptId appAttemptId = identifier.getApplicationAttemptId();

  /*
   * MasterKey used for retrieving password will be as follows. 1) By default
   * older saved master key will be used. 2) If identifier's master key id
   * matches that of previous master key id then previous key will be used. 3)
   * If identifier's master key id matches that of current master key id then
   * current key will be used.
   */
  MasterKeyData oldMasterKey = oldMasterKeys.get(appAttemptId);
  MasterKeyData masterKeyToUse = oldMasterKey;
  if (previousMasterKey != null
      && keyId == previousMasterKey.getMasterKey().getKeyId()) {
    masterKeyToUse = previousMasterKey;
  } else if (keyId == currentMasterKey.getMasterKey().getKeyId()) {
    masterKeyToUse = currentMasterKey;
  }
  
  if (nodeId != null && !identifier.getNodeId().equals(nodeId)) {
    throw new InvalidToken("Given NMToken for application : "
        + appAttemptId.toString() + " is not valid for current node manager."
        + "expected : " + nodeId.toString() + " found : "
        + identifier.getNodeId().toString());
  }
  
  if (masterKeyToUse != null) {
    byte[] password = retrivePasswordInternal(identifier, masterKeyToUse);
    LOG.debug("NMToken password retrieved successfully!!");
    return password;
  }

  throw new InvalidToken("Given NMToken for application : "
      + appAttemptId.toString() + " seems to have been generated illegally.");
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入方法依赖的package包/类
/**
 * This will be called by startContainer. It will add the master key into
 * the cache used for starting this container. This should be called before
 * validating the startContainer request.
 */
public synchronized void appAttemptStartContainer(
    NMTokenIdentifier identifier)
    throws org.apache.hadoop.security.token.SecretManager.InvalidToken {
  ApplicationAttemptId appAttemptId = identifier.getApplicationAttemptId();
  if (!appToAppAttemptMap.containsKey(appAttemptId.getApplicationId())) {
    // First application attempt for the given application
    appToAppAttemptMap.put(appAttemptId.getApplicationId(),
      new ArrayList<ApplicationAttemptId>());
  }
  MasterKeyData oldKey = oldMasterKeys.get(appAttemptId);

  if (oldKey == null) {
    // This is a new application attempt.
    appToAppAttemptMap.get(appAttemptId.getApplicationId()).add(appAttemptId);
  }
  if (oldKey == null
      || oldKey.getMasterKey().getKeyId() != identifier.getKeyId()) {
    // Update key only if it is modified.
    LOG.debug("NMToken key updated for application attempt : "
        + identifier.getApplicationAttemptId().toString());
    if (identifier.getKeyId() == currentMasterKey.getMasterKey()
      .getKeyId()) {
      updateAppAttemptKey(appAttemptId, currentMasterKey);
    } else if (previousMasterKey != null
        && identifier.getKeyId() == previousMasterKey.getMasterKey()
          .getKeyId()) {
      updateAppAttemptKey(appAttemptId, previousMasterKey);
    } else {
      throw new InvalidToken(
        "Older NMToken should not be used while starting the container.");
    }
  }
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入方法依赖的package包/类
/**
 * This will be called by startContainer. It will add the master key into
 * the cache used for starting this container. This should be called before
 * validating the startContainer request.
 */
public synchronized void appAttemptStartContainer(
    NMTokenIdentifier identifier)
    throws org.apache.hadoop.security.token.SecretManager.InvalidToken {
  ApplicationAttemptId appAttemptId = identifier.getApplicationAttemptId();
  if (!appToAppAttemptMap.containsKey(appAttemptId.getApplicationId())) {
    // First application attempt for the given application
    appToAppAttemptMap.put(appAttemptId.getApplicationId(),
      new ArrayList<ApplicationAttemptId>());
  }
  MasterKeyData oldKey = oldMasterKeys.get(appAttemptId);

  if (oldKey == null) {
    // This is a new application attempt.
    appToAppAttemptMap.get(appAttemptId.getApplicationId()).add(appAttemptId);
  }
  if (oldKey == null
      || oldKey.getMasterKey().getKeyId() != identifier.getKeyId()) {
    // Update key only if it is modified.
    LOG.debug("NMToken key updated for application attempt : "
        + identifier.getApplicationAttemptId().toString());
    if (identifier.getKeyId() == currentMasterKey.getMasterKey()
      .getKeyId()) {
      oldMasterKeys.put(appAttemptId, currentMasterKey);
    } else if (previousMasterKey != null
        && identifier.getKeyId() == previousMasterKey.getMasterKey()
          .getKeyId()) {
      oldMasterKeys.put(appAttemptId, previousMasterKey);
    } else {
      throw new InvalidToken(
        "Older NMToken should not be used while starting the container.");
    }
  }
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入方法依赖的package包/类
@Private
@VisibleForTesting
protected void authorizeGetAndStopContainerRequest(ContainerId containerId,
    Container container, boolean stopRequest, NMTokenIdentifier identifier)
    throws YarnException {
  if (identifier == null) {
    throw RPCUtil.getRemoteException(INVALID_NMTOKEN_MSG);
  }
  /*
   * For get/stop container status; we need to verify that 1) User (NMToken)
   * application attempt only has started container. 2) Requested containerId
   * belongs to the same application attempt (NMToken) which was used. (Note:-
   * This will prevent user in knowing another application's containers).
   */
  ApplicationId nmTokenAppId =
      identifier.getApplicationAttemptId().getApplicationId();
  
  if ((!nmTokenAppId.equals(containerId.getApplicationAttemptId().getApplicationId()))
      || (container != null && !nmTokenAppId.equals(container
          .getContainerId().getApplicationAttemptId().getApplicationId()))) {
    String msg;
    if (stopRequest) {
      msg = identifier.getApplicationAttemptId()
          + " attempted to stop non-application container : "
          + containerId;
      NMAuditLogger.logFailure("UnknownUser", AuditConstants.STOP_CONTAINER,
          "ContainerManagerImpl", "Trying to stop unknown container!",
          nmTokenAppId, containerId);
    } else {
      msg = identifier.getApplicationAttemptId()
          + " attempted to get status for non-application container : "
          + containerId;
    }
    LOG.warn(msg);
    throw RPCUtil.getRemoteException(msg);
  }
}