001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software
013 * distributed under the License is distributed on an "AS IS" BASIS,
014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
015 * See the License for the specific language governing permissions and
016 * limitations under the License.
017 */
018package org.apache.hadoop.hbase.security.token;
019
020import static org.apache.hadoop.hdfs.protocol.HdfsConstants.HDFS_URI_SCHEME;
021import static org.apache.hadoop.hdfs.security.token.delegation.DelegationTokenIdentifier.HDFS_DELEGATION_KIND;
022import static org.apache.hadoop.hdfs.web.WebHdfsConstants.SWEBHDFS_SCHEME;
023import static org.apache.hadoop.hdfs.web.WebHdfsConstants.SWEBHDFS_TOKEN_KIND;
024import static org.apache.hadoop.hdfs.web.WebHdfsConstants.WEBHDFS_SCHEME;
025import static org.apache.hadoop.hdfs.web.WebHdfsConstants.WEBHDFS_TOKEN_KIND;
026
027import java.io.IOException;
028import java.util.Objects;
029import org.apache.hadoop.fs.FileSystem;
030import org.apache.hadoop.hbase.security.UserProvider;
031import org.apache.hadoop.security.token.Token;
032import org.apache.yetus.audience.InterfaceAudience;
033import org.apache.yetus.audience.InterfaceStability;
034import org.slf4j.Logger;
035import org.slf4j.LoggerFactory;
036
037/**
038 * Helper class to obtain a filesystem delegation token.
039 * Mainly used by Map-Reduce jobs that requires to read/write data to 
040 * a remote file-system (e.g. BulkLoad, ExportSnapshot).
041 */
042@InterfaceAudience.Private
043@InterfaceStability.Evolving
044public class FsDelegationToken {
045  private static final Logger LOG = LoggerFactory.getLogger(FsDelegationToken.class);
046
047  private final UserProvider userProvider;
048  private final String renewer;
049
050  private boolean hasForwardedToken = false;
051  private Token<?> userToken = null;
052  private FileSystem fs = null;
053
054  /*
055   * @param renewer the account name that is allowed to renew the token.
056   */
057  public FsDelegationToken(final UserProvider userProvider, final String renewer) {
058    this.userProvider = userProvider;
059    this.renewer = renewer;
060  }
061
062  /**
063   * Acquire the delegation token for the specified filesystem.
064   * Before requesting a new delegation token, tries to find one already available.
065   * Currently supports checking existing delegation tokens for swebhdfs, webhdfs and hdfs.
066   *
067   * @param fs the filesystem that requires the delegation token
068   * @throws IOException on fs.getDelegationToken() failure
069   */
070  public void acquireDelegationToken(final FileSystem fs)
071      throws IOException {
072    String tokenKind;
073    String scheme = fs.getUri().getScheme();
074    if (SWEBHDFS_SCHEME.equalsIgnoreCase(scheme)) {
075      tokenKind = SWEBHDFS_TOKEN_KIND.toString();
076    } else if (WEBHDFS_SCHEME.equalsIgnoreCase(scheme)) {
077      tokenKind = WEBHDFS_TOKEN_KIND.toString();
078    } else if (HDFS_URI_SCHEME.equalsIgnoreCase(scheme)) {
079      tokenKind = HDFS_DELEGATION_KIND.toString();
080    } else {
081      LOG.warn("Unknown FS URI scheme: " + scheme);
082      // Preserve default behavior
083      tokenKind = HDFS_DELEGATION_KIND.toString();
084    }
085
086    acquireDelegationToken(tokenKind, fs);
087  }
088
089  /**
090   * Acquire the delegation token for the specified filesystem and token kind.
091   * Before requesting a new delegation token, tries to find one already available.
092   *
093   * @param tokenKind non-null token kind to get delegation token from the {@link UserProvider}
094   * @param fs the filesystem that requires the delegation token
095   * @throws IOException on fs.getDelegationToken() failure
096   */
097  public void acquireDelegationToken(final String tokenKind, final FileSystem fs)
098      throws IOException {
099    Objects.requireNonNull(tokenKind, "tokenKind:null");
100    if (userProvider.isHadoopSecurityEnabled()) {
101      this.fs = fs;
102      userToken = userProvider.getCurrent().getToken(tokenKind, fs.getCanonicalServiceName());
103      if (userToken == null) {
104        hasForwardedToken = false;
105        try {
106          userToken = fs.getDelegationToken(renewer);
107        } catch (NullPointerException npe) {
108          // we need to handle NullPointerException in case HADOOP-10009 is missing
109          LOG.error("Failed to get token for " + renewer);
110        }
111      } else {
112        hasForwardedToken = true;
113        LOG.info("Use the existing token: " + userToken);
114      }
115    }
116  }
117
118  /**
119   * Releases a previously acquired delegation token.
120   */
121  public void releaseDelegationToken() {
122    if (userProvider.isHadoopSecurityEnabled()) {
123      if (userToken != null && !hasForwardedToken) {
124        try {
125          userToken.cancel(this.fs.getConf());
126        } catch (Exception e) {
127          LOG.warn("Failed to cancel HDFS delegation token: " + userToken, e);
128        }
129      }
130      this.userToken = null;
131      this.fs = null;
132    }
133  }
134
135  public UserProvider getUserProvider() {
136    return userProvider;
137  }
138
139  /**
140   * @return the account name that is allowed to renew the token.
141   */
142  public String getRenewer() {
143    return renewer;
144  }
145
146  /**
147   * @return the delegation token acquired, or null in case it was not acquired
148   */
149  public Token<?> getUserToken() {
150    return userToken;
151  }
152
153  public FileSystem getFileSystem() {
154    return fs;
155  }
156}