View Javadoc

1   /*
2    *
3    * Licensed to the Apache Software Foundation (ASF) under one
4    * or more contributor license agreements.  See the NOTICE file
5    * distributed with this work for additional information
6    * regarding copyright ownership.  The ASF licenses this file
7    * to you under the Apache License, Version 2.0 (the
8    * "License"); you may not use this file except in compliance
9    * with the License.  You may obtain a copy of the License at
10   *
11   *     http://www.apache.org/licenses/LICENSE-2.0
12   *
13   * Unless required by applicable law or agreed to in writing, software
14   * distributed under the License is distributed on an "AS IS" BASIS,
15   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16   * See the License for the specific language governing permissions and
17   * limitations under the License.
18   */
19  
20  package org.apache.hadoop.hbase.security;
21  
22  import java.io.IOException;
23  import java.lang.reflect.UndeclaredThrowableException;
24  import java.security.PrivilegedAction;
25  import java.security.PrivilegedExceptionAction;
26  import java.util.Collection;
27  
28  import org.apache.hadoop.conf.Configuration;
29  import org.apache.hadoop.hbase.classification.InterfaceAudience;
30  import org.apache.hadoop.hbase.classification.InterfaceStability;
31  import org.apache.hadoop.hbase.util.Methods;
32  import org.apache.hadoop.mapred.JobConf;
33  import org.apache.hadoop.mapreduce.Job;
34  import org.apache.hadoop.security.SecurityUtil;
35  import org.apache.hadoop.security.UserGroupInformation;
36  import org.apache.hadoop.security.token.Token;
37  import org.apache.hadoop.security.token.TokenIdentifier;
38  
39  /**
40   * Wrapper to abstract out usage of user and group information in HBase.
41   *
42   * <p>
43   * This class provides a common interface for interacting with user and group
44   * information across changing APIs in different versions of Hadoop.  It only
45   * provides access to the common set of functionality in
46   * {@link org.apache.hadoop.security.UserGroupInformation} currently needed by
47   * HBase, but can be extended as needs change.
48   * </p>
49   */
50  @InterfaceAudience.Public
51  @InterfaceStability.Stable
52  public abstract class User {
53    public static final String HBASE_SECURITY_CONF_KEY =
54        "hbase.security.authentication";
55    public static final String HBASE_SECURITY_AUTHORIZATION_CONF_KEY =
56        "hbase.security.authorization";
57  
58    protected UserGroupInformation ugi;
59  
60    public UserGroupInformation getUGI() {
61      return ugi;
62    }
63  
64    /**
65     * Returns the full user name.  For Kerberos principals this will include
66     * the host and realm portions of the principal name.
67     *
68     * @return User full name.
69     */
70    public String getName() {
71      return ugi.getUserName();
72    }
73  
74    /**
75     * Returns the list of groups of which this user is a member.  On secure
76     * Hadoop this returns the group information for the user as resolved on the
77     * server.  For 0.20 based Hadoop, the group names are passed from the client.
78     */
79    public String[] getGroupNames() {
80      return ugi.getGroupNames();
81    }
82  
83    /**
84     * Returns the shortened version of the user name -- the portion that maps
85     * to an operating system user name.
86     *
87     * @return Short name
88     */
89    public abstract String getShortName();
90  
91    /**
92     * Executes the given action within the context of this user.
93     */
94    public abstract <T> T runAs(PrivilegedAction<T> action);
95  
96    /**
97     * Executes the given action within the context of this user.
98     */
99    public abstract <T> T runAs(PrivilegedExceptionAction<T> action)
100       throws IOException, InterruptedException;
101 
102   /**
103    * Requests an authentication token for this user and stores it in the
104    * user's credentials.
105    *
106    * @throws IOException
107    * @deprecated Use {@code TokenUtil.obtainAuthTokenForJob(Connection,User,Job)}
108    *     instead.
109    */
110   @Deprecated
111   public abstract void obtainAuthTokenForJob(Configuration conf, Job job)
112       throws IOException, InterruptedException;
113 
114   /**
115    * Requests an authentication token for this user and stores it in the
116    * user's credentials.
117    *
118    * @throws IOException
119    * @deprecated Use {@code TokenUtil.obtainAuthTokenForJob(Connection,JobConf,User)}
120    *     instead.
121    */
122   @Deprecated
123   public abstract void obtainAuthTokenForJob(JobConf job)
124       throws IOException, InterruptedException;
125 
126   /**
127    * Returns the Token of the specified kind associated with this user,
128    * or null if the Token is not present.
129    *
130    * @param kind the kind of token
131    * @param service service on which the token is supposed to be used
132    * @return the token of the specified kind.
133    */
134   public Token<?> getToken(String kind, String service) throws IOException {
135     for (Token<?> token : ugi.getTokens()) {
136       if (token.getKind().toString().equals(kind) &&
137           (service != null && token.getService().toString().equals(service))) {
138         return token;
139       }
140     }
141     return null;
142   }
143 
144   /**
145    * Returns all the tokens stored in the user's credentials.
146    */
147   public Collection<Token<? extends TokenIdentifier>> getTokens() {
148     return ugi.getTokens();
149   }
150 
151   /**
152    * Adds the given Token to the user's credentials.
153    *
154    * @param token the token to add
155    */
156   public void addToken(Token<? extends TokenIdentifier> token) {
157     ugi.addToken(token);
158   }
159 
160   @Override
161   public boolean equals(Object o) {
162     if (this == o) {
163       return true;
164     }
165     if (o == null || getClass() != o.getClass()) {
166       return false;
167     }
168     return ugi.equals(((User) o).ugi);
169   }
170 
171   @Override
172   public int hashCode() {
173     return ugi.hashCode();
174   }
175 
176   @Override
177   public String toString() {
178     return ugi.toString();
179   }
180 
181   /**
182    * Returns the {@code User} instance within current execution context.
183    */
184   public static User getCurrent() throws IOException {
185     User user = new SecureHadoopUser();
186     if (user.getUGI() == null) {
187       return null;
188     }
189     return user;
190   }
191 
192   /**
193    * Executes the given action as the login user
194    * @param action
195    * @return the result of the action
196    * @throws IOException
197    */
198   @SuppressWarnings({ "rawtypes", "unchecked" })
199   public static <T> T runAsLoginUser(PrivilegedExceptionAction<T> action) throws IOException {
200     try {
201       Class c = Class.forName("org.apache.hadoop.security.SecurityUtil");
202       Class [] types = new Class[]{PrivilegedExceptionAction.class};
203       Object[] args = new Object[]{action};
204       return (T) Methods.call(c, null, "doAsLoginUser", types, args);
205     } catch (Throwable e) {
206       throw new IOException(e);
207     }
208   }
209 
210   /**
211    * Wraps an underlying {@code UserGroupInformation} instance.
212    * @param ugi The base Hadoop user
213    * @return User
214    */
215   public static User create(UserGroupInformation ugi) {
216     if (ugi == null) {
217       return null;
218     }
219     return new SecureHadoopUser(ugi);
220   }
221 
222   /**
223    * Generates a new {@code User} instance specifically for use in test code.
224    * @param name the full username
225    * @param groups the group names to which the test user will belong
226    * @return a new <code>User</code> instance
227    */
228   public static User createUserForTesting(Configuration conf,
229       String name, String[] groups) {
230     User userForTesting = SecureHadoopUser.createUserForTesting(conf, name, groups);
231     return userForTesting;
232   }
233 
234   /**
235    * Log in the current process using the given configuration keys for the
236    * credential file and login principal.
237    *
238    * <p><strong>This is only applicable when
239    * running on secure Hadoop</strong> -- see
240    * org.apache.hadoop.security.SecurityUtil#login(Configuration,String,String,String).
241    * On regular Hadoop (without security features), this will safely be ignored.
242    * </p>
243    *
244    * @param conf The configuration data to use
245    * @param fileConfKey Property key used to configure path to the credential file
246    * @param principalConfKey Property key used to configure login principal
247    * @param localhost Current hostname to use in any credentials
248    * @throws IOException underlying exception from SecurityUtil.login() call
249    */
250   public static void login(Configuration conf, String fileConfKey,
251       String principalConfKey, String localhost) throws IOException {
252     SecureHadoopUser.login(conf, fileConfKey, principalConfKey, localhost);
253   }
254 
255   /**
256    * Returns whether or not Kerberos authentication is configured for Hadoop.
257    * For non-secure Hadoop, this always returns <code>false</code>.
258    * For secure Hadoop, it will return the value from
259    * {@code UserGroupInformation.isSecurityEnabled()}.
260    */
261   public static boolean isSecurityEnabled() {
262     return SecureHadoopUser.isSecurityEnabled();
263   }
264 
265   /**
266    * Returns whether or not secure authentication is enabled for HBase. Note that
267    * HBase security requires HDFS security to provide any guarantees, so it is
268    * recommended that secure HBase should run on secure HDFS.
269    */
270   public static boolean isHBaseSecurityEnabled(Configuration conf) {
271     return "kerberos".equalsIgnoreCase(conf.get(HBASE_SECURITY_CONF_KEY));
272   }
273 
274   /* Concrete implementations */
275 
276   /**
277    * Bridges {@code User} invocations to underlying calls to
278    * {@link org.apache.hadoop.security.UserGroupInformation} for secure Hadoop
279    * 0.20 and versions 0.21 and above.
280    */
281   private static class SecureHadoopUser extends User {
282     private String shortName;
283 
284     private SecureHadoopUser() throws IOException {
285       ugi = UserGroupInformation.getCurrentUser();
286     }
287 
288     private SecureHadoopUser(UserGroupInformation ugi) {
289       this.ugi = ugi;
290     }
291 
292     @Override
293     public String getShortName() {
294       if (shortName != null) return shortName;
295       try {
296         shortName = ugi.getShortUserName();
297         return shortName;
298       } catch (Exception e) {
299         throw new RuntimeException("Unexpected error getting user short name",
300           e);
301       }
302     }
303 
304     @Override
305     public <T> T runAs(PrivilegedAction<T> action) {
306       return ugi.doAs(action);
307     }
308 
309     @Override
310     public <T> T runAs(PrivilegedExceptionAction<T> action)
311         throws IOException, InterruptedException {
312       return ugi.doAs(action);
313     }
314 
315     @Override
316     public void obtainAuthTokenForJob(Configuration conf, Job job)
317         throws IOException, InterruptedException {
318       try {
319         Class<?> c = Class.forName(
320             "org.apache.hadoop.hbase.security.token.TokenUtil");
321         Methods.call(c, null, "obtainTokenForJob",
322             new Class[]{Configuration.class, UserGroupInformation.class,
323                 Job.class},
324             new Object[]{conf, ugi, job});
325       } catch (ClassNotFoundException cnfe) {
326         throw new RuntimeException("Failure loading TokenUtil class, "
327             +"is secure RPC available?", cnfe);
328       } catch (IOException ioe) {
329         throw ioe;
330       } catch (InterruptedException ie) {
331         throw ie;
332       } catch (RuntimeException re) {
333         throw re;
334       } catch (Exception e) {
335         throw new UndeclaredThrowableException(e,
336             "Unexpected error calling TokenUtil.obtainAndCacheToken()");
337       }
338     }
339 
340     @Override
341     public void obtainAuthTokenForJob(JobConf job)
342         throws IOException, InterruptedException {
343       try {
344         Class<?> c = Class.forName(
345             "org.apache.hadoop.hbase.security.token.TokenUtil");
346         Methods.call(c, null, "obtainTokenForJob",
347             new Class[]{JobConf.class, UserGroupInformation.class},
348             new Object[]{job, ugi});
349       } catch (ClassNotFoundException cnfe) {
350         throw new RuntimeException("Failure loading TokenUtil class, "
351             +"is secure RPC available?", cnfe);
352       } catch (IOException ioe) {
353         throw ioe;
354       } catch (InterruptedException ie) {
355         throw ie;
356       } catch (RuntimeException re) {
357         throw re;
358       } catch (Exception e) {
359         throw new UndeclaredThrowableException(e,
360             "Unexpected error calling TokenUtil.obtainAndCacheToken()");
361       }
362     }
363 
364     /** @see User#createUserForTesting(org.apache.hadoop.conf.Configuration, String, String[]) */
365     public static User createUserForTesting(Configuration conf,
366         String name, String[] groups) {
367       return new SecureHadoopUser(UserGroupInformation.createUserForTesting(name, groups));
368     }
369 
370     /**
371      * Obtain credentials for the current process using the configured
372      * Kerberos keytab file and principal.
373      * @see User#login(org.apache.hadoop.conf.Configuration, String, String, String)
374      *
375      * @param conf the Configuration to use
376      * @param fileConfKey Configuration property key used to store the path
377      * to the keytab file
378      * @param principalConfKey Configuration property key used to store the
379      * principal name to login as
380      * @param localhost the local hostname
381      */
382     public static void login(Configuration conf, String fileConfKey,
383         String principalConfKey, String localhost) throws IOException {
384       if (isSecurityEnabled()) {
385         SecurityUtil.login(conf, fileConfKey, principalConfKey, localhost);
386       }
387     }
388 
389     /**
390      * Returns the result of {@code UserGroupInformation.isSecurityEnabled()}.
391      */
392     public static boolean isSecurityEnabled() {
393       return UserGroupInformation.isSecurityEnabled();
394     }
395   }
396 }