org.apache.kyuubi.shaded.hive.metastore.utils

Class SecurityUtils

java.lang.Object

org.apache.kyuubi.shaded.hive.metastore.utils.SecurityUtils

public class SecurityUtils
extends Object

Constructor Summary

Constructors

Constructor and Description
SecurityUtils()

Method Summary

Modifier and Type	Method and Description
static org.apache.kyuubi.shaded.thrift.transport.TServerSocket	getServerSocket(String hiveHost, int portNum)
static org.apache.kyuubi.shaded.thrift.transport.TServerSocket	getServerSSLSocket(String hiveHost, int portNum, String keyStorePath, String keyStorePassWord, String keyStoreType, String keyStoreAlgorithm, List<String> sslVersionBlacklist)
static org.apache.kyuubi.shaded.thrift.transport.TTransport	getSSLSocket(String host, int port, int socketTimeout, int connectionTimeout, String trustStorePath, String trustStorePassWord, String trustStoreType, String trustStoreAlgorithm)
static org.apache.kyuubi.shaded.thrift.transport.THttpClient	getThriftHttpsClient(String httpsUrl, String trustStorePath, String trustStorePasswd, String trustStoreAlgorithm, String trustStoreType, org.apache.http.impl.client.HttpClientBuilder underlyingHttpClientBuilder)
static String	getTokenStrForm(String tokenSignature) Get the string form of the token given a token signature.
static org.apache.hadoop.security.UserGroupInformation	getUGI()
static String	getUser()
static void	reloginExpiringKeytabUser() Relogin if login user is logged in using keytab Relogin is actually done by ugi code only if sufficient time has passed A no-op if kerberos security is not enabled
static void	setTokenStr(org.apache.hadoop.security.UserGroupInformation ugi, String tokenStr, String tokenService) Create a delegation token object for the given token string and service.
static void	setZookeeperClientKerberosJaasConfig(String principal, String keyTabFile) Dynamically sets up the JAAS configuration that uses kerberos

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SecurityUtils

public SecurityUtils()

Method Detail

getUGI

public static org.apache.hadoop.security.UserGroupInformation getUGI()
                                                              throws LoginException,
                                                                     IOException

Throws:

LoginException

IOException

setZookeeperClientKerberosJaasConfig

public static void setZookeeperClientKerberosJaasConfig(String principal,
                                                        String keyTabFile)
                                                 throws IOException

Dynamically sets up the JAAS configuration that uses kerberos

Parameters:

principal -

keyTabFile -

Throws:

IOException

getTokenStrForm

public static String getTokenStrForm(String tokenSignature)
                              throws IOException

Get the string form of the token given a token signature. The signature is used as the value of the "service" field in the token for lookup. Ref: AbstractDelegationTokenSelector in Hadoop. If there exists such a token in the token cache (credential store) of the job, the lookup returns that. This is relevant only when running against a "secure" hadoop release The method gets hold of the tokens if they are set up by hadoop - this should happen on the map/reduce tasks if the client added the tokens into hadoop's credential store in the front end during job submission. The method will select the hive delegation token among the set of tokens and return the string form of it

Parameters:

tokenSignature -

Returns:

the string form of the token found

Throws:

IOException

setTokenStr

public static void setTokenStr(org.apache.hadoop.security.UserGroupInformation ugi,
                               String tokenStr,
                               String tokenService)
                        throws IOException

Create a delegation token object for the given token string and service. Add the token to given UGI

Parameters:

ugi -

tokenStr -

tokenService -

Throws:

IOException

getUser

public static String getUser()
                      throws IOException

Returns:

the user name set in hadoop.job.ugi param or the current user from System

Throws:

IOException - if underlying Hadoop call throws LoginException

getServerSocket

public static org.apache.kyuubi.shaded.thrift.transport.TServerSocket getServerSocket(String hiveHost,
                                                                                      int portNum)
                                                                               throws org.apache.kyuubi.shaded.thrift.transport.TTransportException

Throws:

org.apache.kyuubi.shaded.thrift.transport.TTransportException

getServerSSLSocket

public static org.apache.kyuubi.shaded.thrift.transport.TServerSocket getServerSSLSocket(String hiveHost,
                                                                                         int portNum,
                                                                                         String keyStorePath,
                                                                                         String keyStorePassWord,
                                                                                         String keyStoreType,
                                                                                         String keyStoreAlgorithm,
                                                                                         List<String> sslVersionBlacklist)
                                                                                  throws org.apache.kyuubi.shaded.thrift.transport.TTransportException,
                                                                                         UnknownHostException

Throws:

org.apache.kyuubi.shaded.thrift.transport.TTransportException

UnknownHostException

getSSLSocket

public static org.apache.kyuubi.shaded.thrift.transport.TTransport getSSLSocket(String host,
                                                                                int port,
                                                                                int socketTimeout,
                                                                                int connectionTimeout,
                                                                                String trustStorePath,
                                                                                String trustStorePassWord,
                                                                                String trustStoreType,
                                                                                String trustStoreAlgorithm)
                                                                         throws org.apache.kyuubi.shaded.thrift.transport.TTransportException

Throws:

org.apache.kyuubi.shaded.thrift.transport.TTransportException

getThriftHttpsClient

public static org.apache.kyuubi.shaded.thrift.transport.THttpClient getThriftHttpsClient(String httpsUrl,
                                                                                         String trustStorePath,
                                                                                         String trustStorePasswd,
                                                                                         String trustStoreAlgorithm,
                                                                                         String trustStoreType,
                                                                                         org.apache.http.impl.client.HttpClientBuilder underlyingHttpClientBuilder)
                                                                                  throws org.apache.kyuubi.shaded.thrift.transport.TTransportException,
                                                                                         IOException,
                                                                                         KeyStoreException,
                                                                                         NoSuchAlgorithmException,
                                                                                         CertificateException,
                                                                                         KeyManagementException

Throws:

org.apache.kyuubi.shaded.thrift.transport.TTransportException

IOException

KeyStoreException

NoSuchAlgorithmException

CertificateException

KeyManagementException

reloginExpiringKeytabUser

public static void reloginExpiringKeytabUser()
                                      throws MetaException

Relogin if login user is logged in using keytab Relogin is actually done by ugi code only if sufficient time has passed A no-op if kerberos security is not enabled

Throws:

MetaException