() {
- @Override
- public Void run() throws Exception {
- authURL.cancelDelegationToken(new URL(credServiceUrl
- + Constants.DEFAULT_DELEGATION_TOKEN_MANAGER_ENDPOINT),
- authToken, (proxyUser != null) ? ugi.getShortUserName() : null);
- return null;
- }
- });
- }
-}
\ No newline at end of file
diff --git a/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azure/security/package.html b/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azure/security/package.html
deleted file mode 100644
index fe58c0a272a..00000000000
--- a/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azure/security/package.html
+++ /dev/null
@@ -1,28 +0,0 @@
-
-
-
-
-
-
-
- Infrastructure for WASB client Security to work with Kerberos and Delegation
- tokens.
-
-
-
-
diff --git a/hadoop-tools/hadoop-azure/src/main/resources/META-INF/services/org.apache.hadoop.security.token.TokenIdentifier b/hadoop-tools/hadoop-azure/src/main/resources/META-INF/services/org.apache.hadoop.security.token.TokenIdentifier
deleted file mode 100644
index 7ec8216deb0..00000000000
--- a/hadoop-tools/hadoop-azure/src/main/resources/META-INF/services/org.apache.hadoop.security.token.TokenIdentifier
+++ /dev/null
@@ -1,16 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-org.apache.hadoop.fs.azure.security.WasbDelegationTokenIdentifier
\ No newline at end of file
diff --git a/hadoop-tools/hadoop-azure/src/main/resources/META-INF/services/org.apache.hadoop.security.token.TokenRenewer b/hadoop-tools/hadoop-azure/src/main/resources/META-INF/services/org.apache.hadoop.security.token.TokenRenewer
deleted file mode 100644
index f9c590aad8d..00000000000
--- a/hadoop-tools/hadoop-azure/src/main/resources/META-INF/services/org.apache.hadoop.security.token.TokenRenewer
+++ /dev/null
@@ -1,16 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-org.apache.hadoop.fs.azure.security.WasbTokenRenewer
\ No newline at end of file
diff --git a/hadoop-tools/hadoop-azure/src/site/markdown/index.md b/hadoop-tools/hadoop-azure/src/site/markdown/index.md
index 25ae8f568b0..a92993e0dc1 100644
--- a/hadoop-tools/hadoop-azure/src/site/markdown/index.md
+++ b/hadoop-tools/hadoop-azure/src/site/markdown/index.md
@@ -330,40 +330,6 @@ The service is expected to return a response in JSON format:
"sasKey" : Requested SAS Key
}
```
-
-## Authorization Support in WASB.
-
-Authorization support can be enabled in WASB using the following configuration:
-
-```
-
- fs.azure.authorization
- true
-
-```
- The current implementation of authorization relies on the presence of an external service that can enforce
- the authorization. The service is expected to be running on a URL provided by the following config.
-
-```
-
- fs.azure.authorization.remote.service.url
- {URL}
-
-```
-
- The remote service is expected to provide support for the following REST call: ```{URL}/CHECK_AUTHORIZATION```
- An example request:
- ```{URL}/CHECK_AUTHORIZATION?wasb_absolute_path=&operation_type=&delegation_token=```
-
- The service is expected to return a response in JSON format:
- ```
- {
- "responseCode" : 0 or non-zero ,
- "responseMessage" : relavant message on failure ,
- "authorizationResult" : true/false
- }
- ```
-
## Testing the hadoop-azure Module
The hadoop-azure module includes a full suite of unit tests. Most of the tests
diff --git a/hadoop-tools/hadoop-azure/src/test/java/org/apache/hadoop/fs/azure/MockWasbAuthorizerImpl.java b/hadoop-tools/hadoop-azure/src/test/java/org/apache/hadoop/fs/azure/MockWasbAuthorizerImpl.java
deleted file mode 100644
index af5a537ce4d..00000000000
--- a/hadoop-tools/hadoop-azure/src/test/java/org/apache/hadoop/fs/azure/MockWasbAuthorizerImpl.java
+++ /dev/null
@@ -1,102 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.hadoop.fs.azure;
-
-import java.util.HashMap;
-import java.util.Map;
-
-import org.apache.hadoop.conf.Configuration;
-
-/**
- * A mock wasb authorizer implementation.
- */
-
-public class MockWasbAuthorizerImpl implements WasbAuthorizerInterface {
-
- private Map authRules;
-
- @Override
- public void init(Configuration conf) {
- authRules = new HashMap();
- }
-
- public void addAuthRule(String wasbAbsolutePath,
- String accessType, boolean access) {
- AuthorizationComponent component =
- new AuthorizationComponent(wasbAbsolutePath, accessType);
- this.authRules.put(component, access);
- }
-
- @Override
- public boolean authorize(String wasbAbsolutePath, String accessType)
- throws WasbAuthorizationException {
-
- AuthorizationComponent component =
- new AuthorizationComponent(wasbAbsolutePath, accessType);
-
- if (authRules.containsKey(component)) {
- return authRules.get(component);
- } else {
- return false;
- }
- }
-}
-
-class AuthorizationComponent {
-
- private String wasbAbsolutePath;
- private String accessType;
-
- public AuthorizationComponent(String wasbAbsolutePath,
- String accessType) {
- this.wasbAbsolutePath = wasbAbsolutePath;
- this.accessType = accessType;
- }
-
- @Override
- public int hashCode() {
- return this.wasbAbsolutePath.hashCode() ^ this.accessType.hashCode();
- }
-
- @Override
- public boolean equals(Object obj) {
-
- if (obj == this) {
- return true;
- }
-
- if (obj == null
- || !(obj instanceof AuthorizationComponent)) {
- return false;
- }
-
- return ((AuthorizationComponent)obj).
- getWasbAbsolutePath().equals(this.wasbAbsolutePath)
- && ((AuthorizationComponent)obj).
- getAccessType().equals(this.accessType);
- }
-
- public String getWasbAbsolutePath() {
- return this.wasbAbsolutePath;
- }
-
- public String getAccessType() {
- return accessType;
- }
-}
\ No newline at end of file
diff --git a/hadoop-tools/hadoop-azure/src/test/java/org/apache/hadoop/fs/azure/TestNativeAzureFileSystemAuthorization.java b/hadoop-tools/hadoop-azure/src/test/java/org/apache/hadoop/fs/azure/TestNativeAzureFileSystemAuthorization.java
deleted file mode 100644
index e76533550b4..00000000000
--- a/hadoop-tools/hadoop-azure/src/test/java/org/apache/hadoop/fs/azure/TestNativeAzureFileSystemAuthorization.java
+++ /dev/null
@@ -1,277 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.hadoop.fs.azure;
-
-import org.apache.hadoop.conf.Configuration;
-import org.apache.hadoop.fs.FSDataInputStream;
-import org.apache.hadoop.fs.Path;
-import org.junit.Test;
-
-import com.sun.tools.javac.util.Assert;
-
-/**
- * Test class to hold all WASB authorization tests.
- */
-public class TestNativeAzureFileSystemAuthorization
- extends AbstractWasbTestBase {
-
- @Override
- protected AzureBlobStorageTestAccount createTestAccount() throws Exception {
- Configuration conf = new Configuration();
- conf.set(NativeAzureFileSystem.KEY_AZURE_AUTHORIZATION, "true");
- conf.set(RemoteWasbAuthorizerImpl.KEY_REMOTE_AUTH_SERVICE_URL, "test_url");
- return AzureBlobStorageTestAccount.create(conf);
- }
-
- /**
- * Positive test to verify Create and delete access check
- * @throws Throwable
- */
- @Test
- public void testCreateAccessCheckPositive() throws Throwable {
-
- AzureBlobStorageTestAccount testAccount = createTestAccount();
- NativeAzureFileSystem fs = testAccount.getFileSystem();
-
- String testFile = "test.dat";
- Path testPath = new Path(fs.getWorkingDirectory(), testFile);
-
- MockWasbAuthorizerImpl authorizer = new MockWasbAuthorizerImpl();
- authorizer.init(null);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.WRITE.toString(), true);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.EXECUTE.toString(), true);
- fs.updateWasbAuthorizer(authorizer);
- authorizer.addAuthRule(fs.getWorkingDirectory().toString(),
- WasbAuthorizationOperations.EXECUTE.toString(), true);
-
- fs.create(testPath);
- Assert.check(fs.exists(testPath));
- fs.delete(testPath, false);
- }
-
- /**
- * Negative test to verify Create access check
- * @throws Throwable
- */
-
- @Test(expected=WasbAuthorizationException.class)
- public void testCreateAccessCheckNegative() throws Throwable {
-
- AzureBlobStorageTestAccount testAccount = createTestAccount();
- NativeAzureFileSystem fs = testAccount.getFileSystem();
-
- String testFile = "test.dat";
- Path testPath = new Path(fs.getWorkingDirectory(), testFile);
-
- MockWasbAuthorizerImpl authorizer = new MockWasbAuthorizerImpl();
- authorizer.init(null);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.WRITE.toString(), false);
- fs.updateWasbAuthorizer(authorizer);
-
- fs.create(new Path(testFile));
- }
-
- /**
- * Positive test to verify Create and delete access check
- * @throws Throwable
- */
- @Test
- public void testListAccessCheckPositive() throws Throwable {
-
- AzureBlobStorageTestAccount testAccount = createTestAccount();
- NativeAzureFileSystem fs = testAccount.getFileSystem();
-
- String testFolder = "\\";
- Path testPath = new Path(fs.getWorkingDirectory(), testFolder);
-
- MockWasbAuthorizerImpl authorizer = new MockWasbAuthorizerImpl();
- authorizer.init(null);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.EXECUTE.toString(), true);
- fs.updateWasbAuthorizer(authorizer);
-
- fs.listStatus(testPath);
- }
-
- /**
- * Negative test to verify Create access check
- * @throws Throwable
- */
-
- @Test(expected=WasbAuthorizationException.class)
- public void testListAccessCheckNegative() throws Throwable {
-
- AzureBlobStorageTestAccount testAccount = createTestAccount();
- NativeAzureFileSystem fs = testAccount.getFileSystem();
-
- String testFolder = "\\";
- Path testPath = new Path(fs.getWorkingDirectory(), testFolder);
-
- MockWasbAuthorizerImpl authorizer = new MockWasbAuthorizerImpl();
- authorizer.init(null);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.EXECUTE.toString(), false);
- fs.updateWasbAuthorizer(authorizer);
-
- fs.listStatus(testPath);
- }
-
- /**
- * Positive test to verify rename access check.
- * @throws Throwable
- */
- @Test
- public void testRenameAccessCheckPositive() throws Throwable {
-
- AzureBlobStorageTestAccount testAccount = createTestAccount();
- NativeAzureFileSystem fs = testAccount.getFileSystem();
-
- String testFile = "test.dat";
- Path testPath = new Path(fs.getWorkingDirectory(), testFile);
- String renameFile = "test2.dat";
- Path renamePath = new Path(fs.getWorkingDirectory(), renameFile);
-
- MockWasbAuthorizerImpl authorizer = new MockWasbAuthorizerImpl();
- authorizer.init(null);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.WRITE.toString(), true);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.EXECUTE.toString(), true);
- authorizer.addAuthRule(renamePath.toString(),
- WasbAuthorizationOperations.EXECUTE.toString(), true);
- authorizer.addAuthRule(fs.getWorkingDirectory().toString(),
- WasbAuthorizationOperations.EXECUTE.toString(), true);
- fs.updateWasbAuthorizer(authorizer);
- fs.create(testPath);
-
- Assert.check(fs.exists(testPath));
- fs.rename(testPath, renamePath);
- Assert.check(fs.exists(renamePath));
- fs.delete(renamePath, false);
- }
-
- /**
- * Negative test to verify rename access check.
- * @throws Throwable
- */
- @Test(expected=WasbAuthorizationException.class)
- public void testRenameAccessCheckNegative() throws Throwable {
-
- AzureBlobStorageTestAccount testAccount = createTestAccount();
- NativeAzureFileSystem fs = testAccount.getFileSystem();
- String testFile = "test.dat";
- Path testPath = new Path(fs.getWorkingDirectory(), testFile);
- Path renamePath = new Path("test2.dat");
-
- MockWasbAuthorizerImpl authorizer = new MockWasbAuthorizerImpl();
- authorizer.init(null);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.WRITE.toString(), true);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.EXECUTE.toString(), false);
- fs.updateWasbAuthorizer(authorizer);
-
- try {
- fs.create(testPath);
-
- Assert.check(fs.exists(testPath));
- fs.rename(testPath, renamePath);
- Assert.check(fs.exists(renamePath));
- fs.delete(renamePath, false);
- } catch (WasbAuthorizationException ex) {
- throw ex;
- } finally {
- authorizer = new MockWasbAuthorizerImpl();
- authorizer.init(null);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.EXECUTE.toString(), false);
- fs.updateWasbAuthorizer(authorizer);
- Assert.check(fs.exists(testPath));
- fs.delete(testPath, false);
- }
- }
-
- /**
- * Positive test for read access check.
- * @throws Throwable
- */
- @Test
- public void testReadAccessCheckPositive() throws Throwable {
-
- AzureBlobStorageTestAccount testAccount = createTestAccount();
- NativeAzureFileSystem fs = testAccount.getFileSystem();
- String testFile = "test.dat";
- Path testPath = new Path(fs.getWorkingDirectory(), testFile);
- MockWasbAuthorizerImpl authorizer = new MockWasbAuthorizerImpl();
- authorizer.init(null);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.WRITE.toString(), true);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.EXECUTE.toString(), true);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.READ.toString(), true);
- authorizer.addAuthRule(fs.getWorkingDirectory().toString(),
- WasbAuthorizationOperations.EXECUTE.toString(), true);
- fs.updateWasbAuthorizer(authorizer);
- fs.create(testPath);
- Assert.check(fs.exists(testPath));
- FSDataInputStream inputStream = fs.open(testPath);
- inputStream.close();
- fs.delete(testPath, false);
- }
-
- /**
- * Negative test to verify read access check.
- * @throws Throwable
- */
- @Test(expected=WasbAuthorizationException.class)
- public void testReadAccessCheckNegative() throws Throwable {
-
- AzureBlobStorageTestAccount testAccount = createTestAccount();
- NativeAzureFileSystem fs = testAccount.getFileSystem();
- String testFile = "test.dat";
- Path testPath = new Path(fs.getWorkingDirectory(), testFile);
- MockWasbAuthorizerImpl authorizer = new MockWasbAuthorizerImpl();
- authorizer.init(null);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.WRITE.toString(), true);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.EXECUTE.toString(), true);
- authorizer.addAuthRule(testPath.toString(),
- WasbAuthorizationOperations.READ.toString(), false);
- fs.updateWasbAuthorizer(authorizer);
-
- fs.create(new Path(testFile));
- Assert.check(fs.exists(testPath));
- FSDataInputStream inputStream = null;
- try {
- inputStream = fs.open(new Path(testFile));
- } catch (WasbAuthorizationException ex) {
- throw ex;
- } finally {
- fs.delete(new Path(testFile), false);
- if (inputStream != null) {
- inputStream.close();
- }
- }
- }
-}
\ No newline at end of file