@InterfaceAudience.LimitedPrivate(value="authorization-subsystems") @InterfaceStability.Unstable

Package org.apache.hadoop.fs.s3a.auth.delegation

Extensible delegation token support for the S3A connector.

See: Description

Interface Summary

Interface	Description
AWSPolicyProvider	Interface for providers of AWS policy for accessing data.
DelegationOperations	All operations used for delegation which aren't in the store context.
DelegationTokenProvider	Interface for S3A Delegation Token access.

Class Summary

Class	Description
AbstractDelegationTokenBinding	An AbstractDelegationTokenBinding implementation is a class which handles the binding of its underlying authentication mechanism to the Hadoop Delegation token mechanism.
AbstractDTService	This is the base class for both the delegation binding code and the back end service created; allows for shared methods across both.
AbstractS3ATokenIdentifier	An S3A Delegation Token Identifier: contains the information needed to talk to S3A.
DelegationBindingInfo	Binding information returned by the token provider.
DelegationConstants	All the constants related to delegation tokens.
EncryptionSecretOperations	These support operations on EncryptionSecrets which use the AWS SDK operations.
EncryptionSecrets	Encryption options in a form which can serialized or marshalled as a hadoop Writeable.
FullCredentialsTokenBinding	Full credentials: they are simply passed as-is, rather than converted to a session.
FullCredentialsTokenIdentifier	The full credentials payload is the same of that for a session token, but a different token kind is used.
RoleTokenBinding	Role Token support requests an explicit role and automatically restricts that role to the given policy of the binding.
RoleTokenIdentifier	Role token identifier.
S3ADelegationTokens	Support for creating a DT from a filesystem.
S3ADtFetcher	A DT fetcher for S3A.
SessionTokenBinding	The session token DT binding: creates an AWS session token for the DT, extracts and serves it up afterwards.
SessionTokenIdentifier	A token identifier which contains a set of AWS session credentials, credentials which will be valid until they expire.

Enum Summary

Enum	Description
AWSPolicyProvider.AccessLevel	Access levels.
S3ADelegationTokens.TokenIssuingPolicy	How will tokens be issued on request? The S3ADelegationTokens.TokenIssuingPolicy.RequestNewToken policy does not guarantee that a tokens can be created, only that an attempt will be made to request one.

Exception Summary

Exception	Description
DelegationTokenIOException	General IOException for Delegation Token issues.

Package org.apache.hadoop.fs.s3a.auth.delegation Description

Extensible delegation token support for the S3A connector. Goal: support multiple back end token issue/renewal services, from "pure client side" session tokens to full "Kerberos auth". It is intended for internal use only; any external implementation of AbstractDelegationTokenBinding must consider this API unstable and track changes as they happen.