001/** 002 * Licensed to the Apache Software Foundation (ASF) under one 003 * or more contributor license agreements. See the NOTICE file 004 * distributed with this work for additional information 005 * regarding copyright ownership. The ASF licenses this file 006 * to you under the Apache License, Version 2.0 (the 007 * "License"); you may not use this file except in compliance 008 * with the License. You may obtain a copy of the License at 009 * 010 * http://www.apache.org/licenses/LICENSE-2.0 011 * 012 * Unless required by applicable law or agreed to in writing, software 013 * distributed under the License is distributed on an "AS IS" BASIS, 014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 015 * See the License for the specific language governing permissions and 016 * limitations under the License. 017 */ 018package org.apache.hadoop.hbase.security.token; 019 020import static org.hamcrest.CoreMatchers.containsString; 021import static org.hamcrest.CoreMatchers.instanceOf; 022import static org.junit.Assert.assertEquals; 023import static org.junit.Assert.assertThat; 024 025import com.google.protobuf.ServiceException; 026import java.io.IOException; 027import java.util.Arrays; 028import java.util.Collection; 029import org.apache.hadoop.hbase.HBaseClassTestRule; 030import org.apache.hadoop.hbase.HConstants; 031import org.apache.hadoop.hbase.TableName; 032import org.apache.hadoop.hbase.client.Connection; 033import org.apache.hadoop.hbase.client.ConnectionFactory; 034import org.apache.hadoop.hbase.client.Table; 035import org.apache.hadoop.hbase.ipc.BlockingRpcClient; 036import org.apache.hadoop.hbase.ipc.CoprocessorRpcChannel; 037import org.apache.hadoop.hbase.ipc.NettyRpcClient; 038import org.apache.hadoop.hbase.ipc.RpcClientFactory; 039import org.apache.hadoop.hbase.protobuf.ProtobufUtil; 040import org.apache.hadoop.hbase.protobuf.generated.AuthenticationProtos; 041import org.apache.hadoop.hbase.protobuf.generated.AuthenticationProtos.GetAuthenticationTokenRequest; 042import org.apache.hadoop.hbase.protobuf.generated.AuthenticationProtos.WhoAmIRequest; 043import org.apache.hadoop.hbase.protobuf.generated.AuthenticationProtos.WhoAmIResponse; 044import org.apache.hadoop.hbase.security.AccessDeniedException; 045import org.apache.hadoop.hbase.testclassification.MediumTests; 046import org.apache.hadoop.hbase.testclassification.SecurityTests; 047import org.apache.hadoop.security.UserGroupInformation; 048import org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod; 049import org.apache.hadoop.security.token.Token; 050import org.apache.hadoop.security.token.TokenIdentifier; 051import org.junit.Before; 052import org.junit.BeforeClass; 053import org.junit.ClassRule; 054import org.junit.Test; 055import org.junit.experimental.categories.Category; 056import org.junit.runner.RunWith; 057import org.junit.runners.Parameterized; 058import org.junit.runners.Parameterized.Parameter; 059import org.junit.runners.Parameterized.Parameters; 060 061@RunWith(Parameterized.class) 062@Category({ SecurityTests.class, MediumTests.class }) 063public class TestGenerateDelegationToken extends SecureTestCluster { 064 065 @ClassRule 066 public static final HBaseClassTestRule CLASS_RULE = 067 HBaseClassTestRule.forClass(TestGenerateDelegationToken.class); 068 069 @BeforeClass 070 public static void setUp() throws Exception { 071 SecureTestCluster.setUp(); 072 try (Connection conn = ConnectionFactory.createConnection(TEST_UTIL.getConfiguration())) { 073 Token<? extends TokenIdentifier> token = TokenUtil.obtainToken(conn); 074 UserGroupInformation.getCurrentUser().addToken(token); 075 } 076 } 077 078 @Parameters(name = "{index}: rpcClientImpl={0}") 079 public static Collection<Object[]> parameters() { 080 return Arrays.asList(new Object[] { BlockingRpcClient.class.getName() }, 081 new Object[] { NettyRpcClient.class.getName() }); 082 } 083 084 @Parameter 085 public String rpcClientImpl; 086 087 @Before 088 public void setUpBeforeMethod() { 089 TEST_UTIL.getConfiguration().set(RpcClientFactory.CUSTOM_RPC_CLIENT_IMPL_CONF_KEY, 090 rpcClientImpl); 091 } 092 093 @Test 094 public void test() throws Exception { 095 try (Connection conn = ConnectionFactory.createConnection(TEST_UTIL.getConfiguration()); 096 Table table = conn.getTable(TableName.META_TABLE_NAME)) { 097 CoprocessorRpcChannel rpcChannel = table.coprocessorService(HConstants.EMPTY_START_ROW); 098 AuthenticationProtos.AuthenticationService.BlockingInterface service = 099 AuthenticationProtos.AuthenticationService.newBlockingStub(rpcChannel); 100 WhoAmIResponse response = service.whoAmI(null, WhoAmIRequest.getDefaultInstance()); 101 assertEquals(USERNAME, response.getUsername()); 102 assertEquals(AuthenticationMethod.TOKEN.name(), response.getAuthMethod()); 103 try { 104 service.getAuthenticationToken(null, GetAuthenticationTokenRequest.getDefaultInstance()); 105 } catch (ServiceException e) { 106 IOException ioe = ProtobufUtil.getRemoteException(e); 107 assertThat(ioe, instanceOf(AccessDeniedException.class)); 108 assertThat(ioe.getMessage(), 109 containsString("Token generation only allowed for Kerberos authenticated clients")); 110 } 111 } 112 } 113}