HADOOP-10776 Open up already widely-used APIs for delegation-token fetching & renewal to ecosystem projects. Contributed by Vinod Kumar Vavilapalli
This commit is contained in:
Steve Loughran
parent
1e25fd6b3b
commit
24715cefe8
|
|
@ -312,9 +312,10 @@ public abstract class FileSystem extends Configured implements Closeable {
|
|||
*
|
||||
* @return a service string that uniquely identifies this file system, null
|
||||
* if the filesystem does not implement tokens
|
||||
* @see SecurityUtil#buildDTServiceName(URI, int)
|
||||
* @see SecurityUtil#buildDTServiceName(URI, int)
|
||||
*/
|
||||
@InterfaceAudience.LimitedPrivate({ "HDFS", "MapReduce" })
|
||||
@InterfaceAudience.Public
|
||||
@InterfaceStability.Evolving
|
||||
public String getCanonicalServiceName() {
|
||||
return (getChildFileSystems() == null)
|
||||
? SecurityUtil.buildDTServiceName(getUri(), getDefaultPort())
|
||||
|
|
@ -515,7 +516,8 @@ public abstract class FileSystem extends Configured implements Closeable {
|
|||
* @return list of new delegation tokens
|
||||
* @throws IOException
|
||||
*/
|
||||
@InterfaceAudience.LimitedPrivate({ "HDFS", "MapReduce" })
|
||||
@InterfaceAudience.Public
|
||||
@InterfaceStability.Evolving
|
||||
public Token<?>[] addDelegationTokens(
|
||||
final String renewer, Credentials credentials) throws IOException {
|
||||
if (credentials == null) {
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@ import org.apache.hadoop.classification.InterfaceStability;
|
|||
/**
|
||||
* An exception class for access control related issues.
|
||||
*/
|
||||
@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce"})
|
||||
@InterfaceAudience.Public
|
||||
@InterfaceStability.Evolving
|
||||
public class AccessControlException
|
||||
extends org.apache.hadoop.fs.permission.AccessControlException {
|
||||
|
|
|
|||
|
|
@ -50,10 +50,10 @@ import org.apache.hadoop.security.token.Token;
|
|||
import org.apache.hadoop.security.token.TokenIdentifier;
|
||||
|
||||
/**
|
||||
* A class that provides the facilities of reading and writing
|
||||
* A class that provides the facilities of reading and writing
|
||||
* secret keys and Tokens.
|
||||
*/
|
||||
@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce"})
|
||||
@InterfaceAudience.Public
|
||||
@InterfaceStability.Evolving
|
||||
public class Credentials implements Writable {
|
||||
private static final Log LOG = LogFactory.getLog(Credentials.class);
|
||||
|
|
|
|||
|
|
@ -58,14 +58,20 @@ import sun.net.util.IPAddressUtil;
|
|||
|
||||
import com.google.common.annotations.VisibleForTesting;
|
||||
|
||||
@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce"})
|
||||
/**
|
||||
* Security Utils.
|
||||
*/
|
||||
@InterfaceAudience.Public
|
||||
@InterfaceStability.Evolving
|
||||
public class SecurityUtil {
|
||||
public final class SecurityUtil {
|
||||
public static final Log LOG = LogFactory.getLog(SecurityUtil.class);
|
||||
public static final String HOSTNAME_PATTERN = "_HOST";
|
||||
public static final String FAILED_TO_GET_UGI_MSG_HEADER =
|
||||
"Failed to obtain user group information:";
|
||||
|
||||
private SecurityUtil() {
|
||||
}
|
||||
|
||||
// controls whether buildTokenService will use an ip or host/ip as given
|
||||
// by the user
|
||||
@VisibleForTesting
|
||||
|
|
|
|||
|
|
@ -85,7 +85,7 @@ import org.slf4j.LoggerFactory;
|
|||
* user's username and groups. It supports both the Windows, Unix and Kerberos
|
||||
* login modules.
|
||||
*/
|
||||
@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce", "HBase", "Hive", "Oozie"})
|
||||
@InterfaceAudience.Public
|
||||
@InterfaceStability.Evolving
|
||||
public class UserGroupInformation {
|
||||
@VisibleForTesting
|
||||
|
|
@ -703,7 +703,7 @@ public class UserGroupInformation {
|
|||
*
|
||||
* @param user The principal name to load from the ticket
|
||||
* cache
|
||||
* @param ticketCachePath the path to the ticket cache file
|
||||
* @param ticketCache the path to the ticket cache file
|
||||
*
|
||||
* @throws IOException if the kerberos login fails
|
||||
*/
|
||||
|
|
@ -763,7 +763,7 @@ public class UserGroupInformation {
|
|||
/**
|
||||
* Create a UserGroupInformation from a Subject with Kerberos principal.
|
||||
*
|
||||
* @param user The KerberosPrincipal to use in UGI
|
||||
* @param subject The KerberosPrincipal to use in UGI
|
||||
*
|
||||
* @throws IOException if the kerberos login fails
|
||||
*/
|
||||
|
|
@ -821,7 +821,7 @@ public class UserGroupInformation {
|
|||
|
||||
/**
|
||||
* Log in a user using the given subject
|
||||
* @parma subject the subject to use when logging in a user, or null to
|
||||
* @param subject the subject to use when logging in a user, or null to
|
||||
* create a new subject.
|
||||
* @throws IOException if login fails
|
||||
*/
|
||||
|
|
@ -1644,7 +1644,7 @@ public class UserGroupInformation {
|
|||
}
|
||||
|
||||
/**
|
||||
* Get the group names for this user. {@ #getGroups(String)} is less
|
||||
* Get the group names for this user. {@link #getGroups()} is less
|
||||
* expensive alternative when checking for a contained element.
|
||||
* @return the list of users with the primary group first. If the command
|
||||
* fails, it returns an empty list.
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ import org.apache.hadoop.security.AccessControlException;
|
|||
*
|
||||
* This class <em>does not</em> provide the stack trace for security purposes.
|
||||
*/
|
||||
@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce", "YARN"})
|
||||
@InterfaceAudience.Public
|
||||
@InterfaceStability.Evolving
|
||||
public class AuthorizationException extends AccessControlException {
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
|
|
|||
|
|
@ -399,10 +399,10 @@ public class Token<T extends TokenIdentifier> implements Writable {
|
|||
* A trivial renewer for token kinds that aren't managed. Sub-classes need
|
||||
* to implement getKind for their token kind.
|
||||
*/
|
||||
@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce"})
|
||||
@InterfaceAudience.Public
|
||||
@InterfaceStability.Evolving
|
||||
public static class TrivialRenewer extends TokenRenewer {
|
||||
|
||||
|
||||
// define the kind for this renewer
|
||||
protected Text getKind() {
|
||||
return null;
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ import org.apache.hadoop.security.token.TokenIdentifier;
|
|||
|
||||
import com.google.common.annotations.VisibleForTesting;
|
||||
|
||||
@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce"})
|
||||
@InterfaceAudience.Public
|
||||
@InterfaceStability.Evolving
|
||||
public abstract class AbstractDelegationTokenIdentifier
|
||||
extends TokenIdentifier {
|
||||
|
|
|
|||
|
|
@ -44,7 +44,7 @@ import org.apache.hadoop.util.Time;
|
|||
|
||||
import com.google.common.base.Preconditions;
|
||||
|
||||
@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce", "Hive"})
|
||||
@InterfaceAudience.Public
|
||||
@InterfaceStability.Evolving
|
||||
public abstract
|
||||
class AbstractDelegationTokenSecretManager<TokenIdent
|
||||
|
|
|
|||
Loading…
Reference in New Issue