Apache
/
hbase
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

HBASE-26212 Expose configuration to enable/disable AuthUtil (#3619) 

In some situations, a caller may know that it is properly managing the
Kerberos ticket to talk to HBase. In these situations, it's possible
that AuthUtil still tries to do renewals, but just fails repeatedly to
do so. Give a configuration flag for such clients to be able to tell
AuthUtil to simply stop trying.

Signed-off-by: Duo Zhang <zhangduo@apache.org>
This commit is contained in:
Josh Elser 2021-08-23 20:23:52 -04:00 committed by GitHub
parent 6ad7eb88c3
commit 2728821e62
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 21 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hbase-client/src/main/java/org/apache/hadoop/hbase/client/AsyncConnectionImpl.java
View File

@ -171,7 +171,7 @@ class AsyncConnectionImpl implements AsyncConnection {
private void spawnRenewalChore(final UserGroupInformation user) {
ChoreService service = getChoreService();
service.scheduleChore(AuthUtil.getAuthRenewalChore(user));
service.scheduleChore(AuthUtil.getAuthRenewalChore(user, conf));
}
/**

2
hbase-client/src/main/java/org/apache/hadoop/hbase/client/ConnectionImplementation.java
View File

@ -374,7 +374,7 @@ class ConnectionImplementation implements ClusterConnection, Closeable {
private void spawnRenewalChore(final UserGroupInformation user) {
ChoreService service = getChoreService();
service.scheduleChore(AuthUtil.getAuthRenewalChore(user));
service.scheduleChore(AuthUtil.getAuthRenewalChore(user, conf));
}
/**

22
hbase-common/src/main/java/org/apache/hadoop/hbase/AuthUtil.java
View File

@ -90,6 +90,10 @@ public final class AuthUtil {
/** Client principal */
public static final String HBASE_CLIENT_KERBEROS_PRINCIPAL = "hbase.client.keytab.principal";
/** Configuration to automatically try to renew keytab-based logins */
public static final String HBASE_CLIENT_AUTOMATIC_KEYTAB_RENEWAL_KEY = "hbase.client.keytab.automatic.renewal";
public static final boolean HBASE_CLIENT_AUTOMATIC_KEYTAB_RENEWAL_DEFAULT = true;
private AuthUtil() {
super();
}
@ -189,8 +193,8 @@ public final class AuthUtil {
* @return a ScheduledChore for renewals.
*/
@InterfaceAudience.Private
public static ScheduledChore getAuthRenewalChore(final UserGroupInformation user) {
if (!user.hasKerberosCredentials()) {
public static ScheduledChore getAuthRenewalChore(final UserGroupInformation user, Configuration conf) {
if (!user.hasKerberosCredentials() || !isAuthRenewalChoreEnabled(conf)) {
return null;
}
@ -221,8 +225,11 @@ public final class AuthUtil {
*/
@Deprecated
public static ScheduledChore getAuthChore(Configuration conf) throws IOException {
if (!isAuthRenewalChoreEnabled(conf)) {
return null;
}
User user = loginClientAsService(conf);
return getAuthRenewalChore(user.getUGI());
return getAuthRenewalChore(user.getUGI(), conf);
}
private static Stoppable createDummyStoppable() {
@ -271,4 +278,13 @@ public final class AuthUtil {
public static String toGroupEntry(String name) {
return GROUP_PREFIX + name;
}
/**
* Returns true if the chore to automatically renew Kerberos tickets (from
* keytabs) should be started. The default is true.
*/
static boolean isAuthRenewalChoreEnabled(Configuration conf) {
return conf.getBoolean(HBASE_CLIENT_AUTOMATIC_KEYTAB_RENEWAL_KEY,
HBASE_CLIENT_AUTOMATIC_KEYTAB_RENEWAL_DEFAULT);
}
}