From 09964a16294adafbb02fc6785e686d51a9fa3ffc Mon Sep 17 00:00:00 2001 From: Xiao Chen Date: Mon, 26 Sep 2016 13:00:57 -0700 Subject: [PATCH] HADOOP-13638. KMS should set UGI's Configuration object properly. Contributed by Wei-Chiu Chuang. (cherry picked from commit fa397e74fe988bcbb05c816de73eb738794ace4b) Conflicts: hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java (cherry picked from commit 06187e4f98c70b12fbf61c21580ccded27c87185) Conflicts: hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java --- .../crypto/key/kms/server/KMSWebApp.java | 2 + .../hadoop/crypto/key/kms/server/TestKMS.java | 70 ++++++++++--------- 2 files changed, 40 insertions(+), 32 deletions(-) diff --git a/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java b/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java index 14744632033..7cb6c37a84f 100644 --- a/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java +++ b/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java @@ -28,6 +28,7 @@ import org.apache.hadoop.crypto.key.KeyProviderCryptoExtension; import org.apache.hadoop.crypto.key.KeyProviderFactory; import org.apache.hadoop.http.HttpServer2; +import org.apache.hadoop.security.UserGroupInformation; import org.apache.hadoop.security.authorize.AccessControlList; import org.apache.hadoop.util.VersionInfo; import org.apache.log4j.PropertyConfigurator; @@ -121,6 +122,7 @@ public void contextInitialized(ServletContextEvent sce) { } kmsConf = KMSConfiguration.getKMSConf(); initLogging(confDir); + UserGroupInformation.setConfiguration(kmsConf); LOG.info("-------------------------------------------------------------"); LOG.info(" Java runtime version : {}", System.getProperty( "java.runtime.version")); diff --git a/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java b/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java index b275fd11bff..3344a6a7b83 100644 --- a/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java +++ b/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java @@ -139,11 +139,31 @@ protected T runServer(int port, String keystore, String password, File confD } protected Configuration createBaseKMSConf(File keyStoreDir) throws Exception { - Configuration conf = new Configuration(false); - conf.set(KMSConfiguration.KEY_PROVIDER_URI, + return createBaseKMSConf(keyStoreDir, null); + } + + /** + * The Configuration object is shared by both KMS client and server in unit + * tests because UGI gets/sets it to a static variable. + * As a workaround, make sure the client configurations are copied to server + * so that client can read them. + * @param keyStoreDir where keystore is located. + * @param conf KMS client configuration + * @return KMS server configuration based on client. + * @throws Exception + */ + protected Configuration createBaseKMSConf(File keyStoreDir, + Configuration conf) throws Exception { + Configuration newConf; + if (conf == null) { + newConf = new Configuration(false); + } else { + newConf = new Configuration(conf); + } + newConf.set(KMSConfiguration.KEY_PROVIDER_URI, "jceks://file@" + new Path(keyStoreDir.getAbsolutePath(), "kms.keystore").toUri()); - conf.set("hadoop.kms.authentication.type", "simple"); - return conf; + newConf.set("hadoop.kms.authentication.type", "simple"); + return newConf; } public static void writeConf(File confDir, Configuration conf) @@ -272,9 +292,8 @@ public void testStartStop(final boolean ssl, final boolean kerberos) if (kerberos) { conf.set("hadoop.security.authentication", "kerberos"); } - UserGroupInformation.setConfiguration(conf); File testDir = getTestDir(); - conf = createBaseKMSConf(testDir); + conf = createBaseKMSConf(testDir, conf); final String keystore; final String password; @@ -396,9 +415,8 @@ public void testSpecialKeyNames() throws Exception { final String specialKey = "key %^[\n{]}|\"<>\\"; Configuration conf = new Configuration(); conf.set("hadoop.security.authentication", "kerberos"); - UserGroupInformation.setConfiguration(conf); File confDir = getTestDir(); - conf = createBaseKMSConf(confDir); + conf = createBaseKMSConf(confDir, conf); conf.set(KeyAuthorizationKeyProvider.KEY_ACL + specialKey + ".ALL", "*"); writeConf(confDir, conf); @@ -431,9 +449,8 @@ public Void call() throws Exception { public void testKMSProvider() throws Exception { Configuration conf = new Configuration(); conf.set("hadoop.security.authentication", "kerberos"); - UserGroupInformation.setConfiguration(conf); File confDir = getTestDir(); - conf = createBaseKMSConf(confDir); + conf = createBaseKMSConf(confDir, conf); conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k1.ALL", "*"); conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k2.MANAGEMENT", "*"); conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k2.READ", "*"); @@ -691,9 +708,8 @@ public Void call() throws Exception { public void testKeyACLs() throws Exception { Configuration conf = new Configuration(); conf.set("hadoop.security.authentication", "kerberos"); - UserGroupInformation.setConfiguration(conf); final File testDir = getTestDir(); - conf = createBaseKMSConf(testDir); + conf = createBaseKMSConf(testDir, conf); conf.set("hadoop.kms.authentication.type", "kerberos"); conf.set("hadoop.kms.authentication.kerberos.keytab", keytab.getAbsolutePath()); @@ -969,9 +985,8 @@ public void testKMSRestartSimpleAuth() throws Exception { public void doKMSRestart(boolean useKrb) throws Exception { Configuration conf = new Configuration(); conf.set("hadoop.security.authentication", "kerberos"); - UserGroupInformation.setConfiguration(conf); final File testDir = getTestDir(); - conf = createBaseKMSConf(testDir); + conf = createBaseKMSConf(testDir, conf); if (useKrb) { conf.set("hadoop.kms.authentication.type", "kerberos"); } @@ -1049,9 +1064,8 @@ public Void run() throws Exception { public void testKMSAuthFailureRetry() throws Exception { Configuration conf = new Configuration(); conf.set("hadoop.security.authentication", "kerberos"); - UserGroupInformation.setConfiguration(conf); final File testDir = getTestDir(); - conf = createBaseKMSConf(testDir); + conf = createBaseKMSConf(testDir, conf); conf.set("hadoop.kms.authentication.kerberos.keytab", keytab.getAbsolutePath()); conf.set("hadoop.kms.authentication.kerberos.principal", "HTTP/localhost"); @@ -1143,9 +1157,8 @@ public Void run() throws Exception { public void testACLs() throws Exception { Configuration conf = new Configuration(); conf.set("hadoop.security.authentication", "kerberos"); - UserGroupInformation.setConfiguration(conf); final File testDir = getTestDir(); - conf = createBaseKMSConf(testDir); + conf = createBaseKMSConf(testDir, conf); conf.set("hadoop.kms.authentication.type", "kerberos"); conf.set("hadoop.kms.authentication.kerberos.keytab", keytab.getAbsolutePath()); @@ -1453,9 +1466,8 @@ public Void run() throws Exception { public void testKMSBlackList() throws Exception { Configuration conf = new Configuration(); conf.set("hadoop.security.authentication", "kerberos"); - UserGroupInformation.setConfiguration(conf); File testDir = getTestDir(); - conf = createBaseKMSConf(testDir); + conf = createBaseKMSConf(testDir, conf); conf.set("hadoop.kms.authentication.type", "kerberos"); conf.set("hadoop.kms.authentication.kerberos.keytab", keytab.getAbsolutePath()); @@ -1542,9 +1554,8 @@ public Void run() throws Exception { public void testServicePrincipalACLs() throws Exception { Configuration conf = new Configuration(); conf.set("hadoop.security.authentication", "kerberos"); - UserGroupInformation.setConfiguration(conf); File testDir = getTestDir(); - conf = createBaseKMSConf(testDir); + conf = createBaseKMSConf(testDir, conf); conf.set("hadoop.kms.authentication.type", "kerberos"); conf.set("hadoop.kms.authentication.kerberos.keytab", keytab.getAbsolutePath()); @@ -1669,9 +1680,8 @@ public void testKMSTimeout() throws Exception { public void testDelegationTokenAccess() throws Exception { Configuration conf = new Configuration(); conf.set("hadoop.security.authentication", "kerberos"); - UserGroupInformation.setConfiguration(conf); final File testDir = getTestDir(); - conf = createBaseKMSConf(testDir); + conf = createBaseKMSConf(testDir, conf); conf.set("hadoop.kms.authentication.type", "kerberos"); conf.set("hadoop.kms.authentication.kerberos.keytab", keytab.getAbsolutePath()); @@ -1752,9 +1762,8 @@ public void testDelegationTokensOpsKerberized() throws Exception { private void testDelegationTokensOps(Configuration conf, final boolean useKrb) throws Exception { - UserGroupInformation.setConfiguration(conf); File confDir = getTestDir(); - conf = createBaseKMSConf(confDir); + conf = createBaseKMSConf(confDir, conf); if (useKrb) { conf.set("hadoop.kms.authentication.type", "kerberos"); conf.set("hadoop.kms.authentication.kerberos.keytab", @@ -1898,9 +1907,8 @@ public void doKMSWithZK(boolean zkDTSM, boolean zkSigner) throws Exception { Configuration conf = new Configuration(); conf.set("hadoop.security.authentication", "kerberos"); - UserGroupInformation.setConfiguration(conf); final File testDir = getTestDir(); - conf = createBaseKMSConf(testDir); + conf = createBaseKMSConf(testDir, conf); conf.set("hadoop.kms.authentication.type", "kerberos"); conf.set("hadoop.kms.authentication.kerberos.keytab", keytab.getAbsolutePath()); conf.set("hadoop.kms.authentication.kerberos.principal", "HTTP/localhost"); @@ -1988,9 +1996,8 @@ public void testProxyUserSimple() throws Exception { public void doProxyUserTest(final boolean kerberos) throws Exception { Configuration conf = new Configuration(); conf.set("hadoop.security.authentication", "kerberos"); - UserGroupInformation.setConfiguration(conf); final File testDir = getTestDir(); - conf = createBaseKMSConf(testDir); + conf = createBaseKMSConf(testDir, conf); if (kerberos) { conf.set("hadoop.kms.authentication.type", "kerberos"); } @@ -2093,9 +2100,8 @@ public void testWebHDFSProxyUserSimple() throws Exception { public void doWebHDFSProxyUserTest(final boolean kerberos) throws Exception { Configuration conf = new Configuration(); conf.set("hadoop.security.authentication", "kerberos"); - UserGroupInformation.setConfiguration(conf); final File testDir = getTestDir(); - conf = createBaseKMSConf(testDir); + conf = createBaseKMSConf(testDir, conf); if (kerberos) { conf.set("hadoop.kms.authentication.type", "kerberos"); }