001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software
013 * distributed under the License is distributed on an "AS IS" BASIS,
014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
015 * See the License for the specific language governing permissions and
016 * limitations under the License.
017 */
018package org.apache.hadoop.hbase.security;
019
020import java.util.concurrent.ConcurrentHashMap;
021import java.util.concurrent.ConcurrentMap;
022import org.apache.yetus.audience.InterfaceAudience;
023
024import org.apache.hadoop.hbase.shaded.protobuf.generated.AdminProtos;
025import org.apache.hadoop.hbase.shaded.protobuf.generated.AuthenticationProtos.TokenIdentifier.Kind;
026import org.apache.hadoop.hbase.shaded.protobuf.generated.ClientProtos;
027import org.apache.hadoop.hbase.shaded.protobuf.generated.MasterProtos;
028import org.apache.hadoop.hbase.shaded.protobuf.generated.MasterProtos.MasterService;
029import org.apache.hadoop.hbase.shaded.protobuf.generated.RegionServerStatusProtos;
030
031/**
032 * Maps RPC protocol interfaces to required configuration
033 */
034@InterfaceAudience.Private
035public class SecurityInfo {
036  /** Maps RPC service names to authentication information */
037  private static ConcurrentMap<String,SecurityInfo> infos = new ConcurrentHashMap<>();
038  // populate info for known services
039  static {
040    infos.put(AdminProtos.AdminService.getDescriptor().getName(),
041        new SecurityInfo(SecurityConstants.REGIONSERVER_KRB_PRINCIPAL,
042            Kind.HBASE_AUTH_TOKEN));
043    infos.put(ClientProtos.ClientService.getDescriptor().getName(),
044        new SecurityInfo(SecurityConstants.REGIONSERVER_KRB_PRINCIPAL,
045            Kind.HBASE_AUTH_TOKEN));
046    infos.put(MasterService.getDescriptor().getName(),
047        new SecurityInfo(SecurityConstants.MASTER_KRB_PRINCIPAL, Kind.HBASE_AUTH_TOKEN));
048    infos.put(RegionServerStatusProtos.RegionServerStatusService.getDescriptor().getName(),
049        new SecurityInfo(SecurityConstants.MASTER_KRB_PRINCIPAL, Kind.HBASE_AUTH_TOKEN));
050    infos.put(MasterProtos.HbckService.getDescriptor().getName(),
051        new SecurityInfo(SecurityConstants.MASTER_KRB_PRINCIPAL, Kind.HBASE_AUTH_TOKEN));
052    infos.put(MasterProtos.ClientMetaService.getDescriptor().getName(),
053        new SecurityInfo(SecurityConstants.MASTER_KRB_PRINCIPAL, Kind.HBASE_AUTH_TOKEN));
054    // NOTE: IF ADDING A NEW SERVICE, BE SURE TO UPDATE HBasePolicyProvider ALSO ELSE
055    // new Service will not be found when all is Kerberized!!!!
056  }
057
058  /**
059   * Adds a security configuration for a new service name.  Note that this will have no effect if
060   * the service name was already registered.
061   */
062  public static void addInfo(String serviceName, SecurityInfo securityInfo) {
063    infos.putIfAbsent(serviceName, securityInfo);
064  }
065
066  /**
067   * Returns the security configuration associated with the given service name.
068   */
069  public static SecurityInfo getInfo(String serviceName) {
070    return infos.get(serviceName);
071  }
072
073  private final String serverPrincipal;
074  private final Kind tokenKind;
075
076  public SecurityInfo(String serverPrincipal, Kind tokenKind) {
077    this.serverPrincipal = serverPrincipal;
078    this.tokenKind = tokenKind;
079  }
080
081  public String getServerPrincipal() {
082    return serverPrincipal;
083  }
084
085  public Kind getTokenKind() {
086    return tokenKind;
087  }
088}