Package org.apache.hadoop.hbase.thrift

Class TestThriftServerSSLMutualAuth

java.lang.Object

org.apache.hadoop.hbase.thrift.TestThriftServerSSLMutualAuth

@Tag("org.apache.hadoop.hbase.testclassification.ClientTests") @Tag("org.apache.hadoop.hbase.testclassification.LargeTests")
public class TestThriftServerSSLMutualAuth
extends Object

Exercises the role-scoped hbase.thrift.ssl.server.* configuration and the new mutual-TLS activation on the Thrift-over-HTTP transport. Complements TestThriftHttpServerSSL, which covers plain (server-only) TLS termination.

Field Summary

Fields

Modifier and Type	Field	Description
private static final String	CLIENT_KEY_STORE_PASSWORD
private org.apache.http.client.methods.HttpPost	httpPost
private static final String	KEY_STORE_PASSWORD
private File	keyDir
private static final org.slf4j.Logger	LOG
private static final HBaseTestingUtil	TEST_UTIL
private static final String	TRUST_STORE_PASSWORD
private ThriftServerRunner	tsr

Constructor Summary

Constructors

Constructor	Description
TestThriftServerSSLMutualAuth()

Method Summary

Modifier and Type	Method	Description
private org.apache.hadoop.conf.Configuration	baseConf()
private org.apache.hadoop.conf.Configuration	baseConfWithLegacyKeystore()
private org.apache.http.impl.client.HttpClientBuilder	clientBuilderWithMutualTrust()	Builds a client that (a) trusts the server's cert and (b) presents the client keystore.
private org.apache.http.impl.client.HttpClientBuilder	clientBuilderWithServerTrust()
private org.apache.http.client.methods.CloseableHttpResponse	doOneRoundTrip(org.apache.http.impl.client.CloseableHttpClient httpClient)
private void	doRequest(org.apache.http.impl.client.HttpClientBuilder builder)
private void	doRequestExpectingSuccess(org.apache.http.impl.client.HttpClientBuilder builder)
private static void	generateKeyStore(String keyStorePath, KeyPair keyPair, X509Certificate cert)
private static void	generateKeyStoreWithPassword(String keyStorePath, KeyPair keyPair, X509Certificate cert, String password)
private static void	generateTrustStore(String path, X509Certificate cert)
private String	getClientCaTruststoreFilePath()
private String	getClientKeystoreFilePath()
private String	getServerKeystoreFilePath()
private String	getServerTruststoreFilePath()
private static void	initializeAlgorithmId()
private File	initKeystoreDir()
private static KeyStore	loadJksTrustStore(String path, String password)
void	setUp()
static void	setUpBeforeClass()
private void	startServer(org.apache.hadoop.conf.Configuration conf)
void	tearDown()
static void	tearDownAfterClass()
void	testClientAuthNeedAcceptsClientWithValidCert()	NEED accepts a client that presents a certificate trusted by the server.
void	testClientAuthNeedRejectsClientWithoutCert()	NEED rejects clients that do not present a valid client certificate.
void	testClientAuthNoneAcceptsClientWithoutCert()	With client.auth.mode=NONE (default), a client presenting no certificate is accepted — matches today's behavior.
void	testClientAuthWantAllowsAnonymousClient()	WANT lets anonymous clients through.
void	testServerFallsBackToLegacyKeystore()	Backward-compatibility regression: existing deployments that know only about the legacy unscoped keys must continue to work.
void	testServerUsesRoleScopedKeystoreWhenSet()	With only the role-scoped hbase.thrift.ssl.server.keystore.* keys set (legacy keys unset), a plain HTTPS request succeeds — proving the server-scoped keys are the ones the bootstrap actually reads.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOG

private static final org.slf4j.Logger LOG

TEST_UTIL

private static final HBaseTestingUtil TEST_UTIL

KEY_STORE_PASSWORD

private static final String KEY_STORE_PASSWORD

See Also:

• Constant Field Values

TRUST_STORE_PASSWORD

private static final String TRUST_STORE_PASSWORD

See Also:

• Constant Field Values

CLIENT_KEY_STORE_PASSWORD

private static final String CLIENT_KEY_STORE_PASSWORD

See Also:

• Constant Field Values

keyDir

private File keyDir

tsr

private ThriftServerRunner tsr

httpPost

private org.apache.http.client.methods.HttpPost httpPost

Constructor Details

TestThriftServerSSLMutualAuth

public TestThriftServerSSLMutualAuth()

Method Details

setUpBeforeClass

@BeforeAll
public static void setUpBeforeClass()
                             throws Exception

Throws:

Exception

tearDownAfterClass

@AfterAll
public static void tearDownAfterClass()
                               throws Exception

Throws:

Exception

setUp

@BeforeEach
public void setUp()
           throws Exception

Throws:

Exception

tearDown

@AfterEach
public void tearDown()
              throws IOException

Throws:

IOException

testServerUsesRoleScopedKeystoreWhenSet

@Test
public void testServerUsesRoleScopedKeystoreWhenSet()
                                             throws Exception

With only the role-scoped hbase.thrift.ssl.server.keystore.* keys set (legacy keys unset), a plain HTTPS request succeeds — proving the server-scoped keys are the ones the bootstrap actually reads.

Throws:

Exception

testServerFallsBackToLegacyKeystore

@Test
public void testServerFallsBackToLegacyKeystore()
                                         throws Exception

Backward-compatibility regression: existing deployments that know only about the legacy unscoped keys must continue to work.

Throws:

Exception

testClientAuthNoneAcceptsClientWithoutCert

@Test
public void testClientAuthNoneAcceptsClientWithoutCert()
                                                throws Exception

With client.auth.mode=NONE (default), a client presenting no certificate is accepted — matches today's behavior.

Throws:

Exception

testClientAuthWantAllowsAnonymousClient

@Test
public void testClientAuthWantAllowsAnonymousClient()
                                             throws Exception

WANT lets anonymous clients through.

Throws:

Exception

testClientAuthNeedRejectsClientWithoutCert

@Test
public void testClientAuthNeedRejectsClientWithoutCert()
                                                throws Exception

NEED rejects clients that do not present a valid client certificate. The handshake fails before any HTTP response is produced.

Throws:

Exception

testClientAuthNeedAcceptsClientWithValidCert

@Test
public void testClientAuthNeedAcceptsClientWithValidCert()
                                                  throws Exception

NEED accepts a client that presents a certificate trusted by the server.

Throws:

Exception

baseConf

private org.apache.hadoop.conf.Configuration baseConf()
                                               throws Exception

Throws:

Exception

baseConfWithLegacyKeystore

private org.apache.hadoop.conf.Configuration baseConfWithLegacyKeystore()
                                                                 throws Exception

Throws:

Exception

startServer

private void startServer(org.apache.hadoop.conf.Configuration conf)
                  throws Exception

Throws:

Exception

clientBuilderWithServerTrust

private org.apache.http.impl.client.HttpClientBuilder clientBuilderWithServerTrust()
                                                                            throws Exception

Throws:

Exception

clientBuilderWithMutualTrust

private org.apache.http.impl.client.HttpClientBuilder clientBuilderWithMutualTrust()
                                                                            throws Exception

Builds a client that (a) trusts the server's cert and (b) presents the client keystore. Used to satisfy client.auth.mode=NEED.

Throws:

Exception

doRequestExpectingSuccess

private void doRequestExpectingSuccess(org.apache.http.impl.client.HttpClientBuilder builder)
                                throws Exception

Throws:

Exception

doRequest

private void doRequest(org.apache.http.impl.client.HttpClientBuilder builder)
                throws Exception

Throws:

Exception

doOneRoundTrip

private org.apache.http.client.methods.CloseableHttpResponse doOneRoundTrip(org.apache.http.impl.client.CloseableHttpClient httpClient)
                                                                     throws Exception

Throws:

Exception

loadJksTrustStore

private static KeyStore loadJksTrustStore(String path,
 String password)
                                   throws Exception

Throws:

Exception

initializeAlgorithmId

private static void initializeAlgorithmId()

initKeystoreDir

private File initKeystoreDir()

generateKeyStore

private static void generateKeyStore(String keyStorePath,
 KeyPair keyPair,
 X509Certificate cert)
                              throws Exception

Throws:

Exception

generateKeyStoreWithPassword

private static void generateKeyStoreWithPassword(String keyStorePath,
 KeyPair keyPair,
 X509Certificate cert,
 String password)
                                          throws Exception

Throws:

Exception

generateTrustStore

private static void generateTrustStore(String path,
 X509Certificate cert)
                                throws Exception

Throws:

Exception

getServerKeystoreFilePath

private String getServerKeystoreFilePath()

getServerTruststoreFilePath

private String getServerTruststoreFilePath()

getClientKeystoreFilePath

private String getClientKeystoreFilePath()

getClientCaTruststoreFilePath

private String getClientCaTruststoreFilePath()