Skip to content

Commit 1220bb7

Browse files
zjshen14zjshen14
committed
YARN-2656. Made RM web services authentication filter support proxy user. Contributed by Varun Vasudev and Zhijie Shen.
1 parent 0260231 commit 1220bb7

File tree

9 files changed

+218
-46
lines changed

9 files changed

+218
-46
lines changed

‎hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/web/DelegationTokenAuthenticationHandler.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ public abstract class DelegationTokenAuthenticationHandler
8181

8282
private static final Set<String> DELEGATION_TOKEN_OPS = new HashSet<String>();
8383

84-
static final String DELEGATION_TOKEN_UGI_ATTRIBUTE =
84+
public static final String DELEGATION_TOKEN_UGI_ATTRIBUTE =
8585
"hadoop.security.delegation-token.ugi";
8686

8787
static {

‎hadoop-yarn-project/CHANGES.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,9 @@ Release 2.6.0 - UNRELEASED
162162
YARN-2501. Enhanced AMRMClient library to support requests against node
163163
labels. (Wangda Tan via vinodkv)
164164

165+
YARN-2656. Made RM web services authentication filter support proxy user.
166+
(Varun Vasudev and Zhijie Shen via zjshen)
167+
165168
IMPROVEMENTS
166169

167170
YARN-2197. Add a link to YARN CHANGES.txt in the left side of doc

‎hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-common/src/main/java/org/apache/hadoop/yarn/server/security/http/RMAuthenticationFilter.java‎

Lines changed: 49 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -18,46 +18,74 @@
1818

1919
package org.apache.hadoop.yarn.server.security.http;
2020

21-
import java.util.Properties;
21+
import java.io.IOException;
2222

23+
import javax.servlet.FilterChain;
2324
import javax.servlet.FilterConfig;
2425
import javax.servlet.ServletException;
26+
import javax.servlet.ServletRequest;
27+
import javax.servlet.ServletResponse;
28+
import javax.servlet.http.HttpServletRequest;
29+
import javax.servlet.http.HttpServletRequestWrapper;
2530

2631
import org.apache.hadoop.classification.InterfaceAudience.Private;
2732
import org.apache.hadoop.classification.InterfaceStability.Unstable;
28-
import org.apache.hadoop.security.authentication.server.AuthenticationFilter;
33+
import org.apache.hadoop.security.token.delegation.AbstractDelegationTokenSecretManager;
34+
import org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticationFilter;
35+
import org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticator;
2936

3037
@Private
3138
@Unstable
32-
public class RMAuthenticationFilter extends AuthenticationFilter {
39+
public class RMAuthenticationFilter extends
40+
DelegationTokenAuthenticationFilter {
3341

42+
static private AbstractDelegationTokenSecretManager<?> manager;
3443
public static final String AUTH_HANDLER_PROPERTY =
3544
"yarn.resourcemanager.authentication-handler";
45+
private static final String OLD_HEADER = "Hadoop-YARN-Auth-Delegation-Token";
3646

3747
public RMAuthenticationFilter() {
3848
}
3949

4050
@Override
41-
protected Properties getConfiguration(String configPrefix,
42-
FilterConfig filterConfig) throws ServletException {
43-
44-
// In yarn-site.xml, we can simply set type to "kerberos". However, we need
45-
// to replace the name here to use the customized Kerberos + DT service
46-
// instead of the standard Kerberos handler.
47-
48-
Properties properties = super.getConfiguration(configPrefix, filterConfig);
49-
String yarnAuthHandler = properties.getProperty(AUTH_HANDLER_PROPERTY);
50-
if (yarnAuthHandler == null || yarnAuthHandler.isEmpty()) {
51-
// if http auth type is simple, the default authentication filter
52-
// will handle it, else throw an exception
53-
if (!properties.getProperty(AUTH_TYPE).equals("simple")) {
54-
throw new ServletException("Authentication handler class is empty");
51+
public void init(FilterConfig filterConfig) throws ServletException {
52+
filterConfig.getServletContext().setAttribute(
53+
DelegationTokenAuthenticationFilter.DELEGATION_TOKEN_SECRET_MANAGER_ATTR,
54+
manager);
55+
super.init(filterConfig);
56+
}
57+
58+
/**
59+
* {@inheritDoc}
60+
*/
61+
@Override
62+
public void doFilter(ServletRequest request, ServletResponse response,
63+
FilterChain filterChain) throws IOException, ServletException {
64+
HttpServletRequest req = (HttpServletRequest) request;
65+
String newHeader =
66+
req.getHeader(DelegationTokenAuthenticator.DELEGATION_TOKEN_HEADER);
67+
if (newHeader == null || newHeader.isEmpty()) {
68+
// For backward compatibility, allow use of the old header field
69+
// only when the new header doesn't exist
70+
final String oldHeader = req.getHeader(OLD_HEADER);
71+
if (oldHeader != null && !oldHeader.isEmpty()) {
72+
request = new HttpServletRequestWrapper(req) {
73+
@Override
74+
public String getHeader(String name) {
75+
if (name
76+
.equals(DelegationTokenAuthenticator.DELEGATION_TOKEN_HEADER)) {
77+
return oldHeader;
78+
}
79+
return super.getHeader(name);
80+
}
81+
};
5582
}
5683
}
57-
if (properties.getProperty(AUTH_TYPE).equalsIgnoreCase("kerberos")) {
58-
properties.setProperty(AUTH_TYPE, yarnAuthHandler);
59-
}
60-
return properties;
84+
super.doFilter(request, response, filterChain);
6185
}
6286

87+
public static void setDelegationTokenSecretManager(
88+
AbstractDelegationTokenSecretManager<?> manager) {
89+
RMAuthenticationFilter.manager = manager;
90+
}
6391
}

‎hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-common/src/main/java/org/apache/hadoop/yarn/server/security/http/RMAuthenticationFilterInitializer.java‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,17 +35,21 @@
3535
import org.apache.hadoop.security.UserGroupInformation;
3636
import org.apache.hadoop.security.authentication.server.AuthenticationFilter;
3737
import org.apache.hadoop.security.authentication.server.KerberosAuthenticationHandler;
38+
import org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticationHandler;
39+
import org.apache.hadoop.yarn.security.client.RMDelegationTokenIdentifier;
3840

3941
@Unstable
4042
public class RMAuthenticationFilterInitializer extends FilterInitializer {
4143

4244
String configPrefix;
45+
String proxyPrefix;
4346
String signatureSecretFileProperty;
4447
String kerberosPrincipalProperty;
4548
String cookiePath;
4649

4750
public RMAuthenticationFilterInitializer() {
4851
this.configPrefix = "hadoop.http.authentication.";
52+
this.proxyPrefix = "yarn.resourcemanager.webapp.proxyuser.";
4953
this.signatureSecretFileProperty =
5054
AuthenticationFilter.SIGNATURE_SECRET + ".file";
5155
this.kerberosPrincipalProperty = KerberosAuthenticationHandler.PRINCIPAL;
@@ -59,10 +63,14 @@ protected Map<String, String> createFilterConfig(Configuration conf) {
5963
filterConfig.put(AuthenticationFilter.COOKIE_PATH, cookiePath);
6064

6165
for (Map.Entry<String, String> entry : conf) {
62-
String name = entry.getKey();
63-
if (name.startsWith(configPrefix)) {
64-
String value = conf.get(name);
65-
name = name.substring(configPrefix.length());
66+
String propName = entry.getKey();
67+
if (propName.startsWith(configPrefix)) {
68+
String value = conf.get(propName);
69+
String name = propName.substring(configPrefix.length());
70+
filterConfig.put(name, value);
71+
} else if (propName.startsWith(proxyPrefix)) {
72+
String value = conf.get(propName);
73+
String name = propName.substring("yarn.resourcemanager.webapp.".length());
6674
filterConfig.put(name, value);
6775
}
6876
}
@@ -107,6 +115,10 @@ protected Map<String, String> createFilterConfig(Configuration conf) {
107115
}
108116
filterConfig.put(KerberosAuthenticationHandler.PRINCIPAL, principal);
109117
}
118+
119+
filterConfig.put(DelegationTokenAuthenticationHandler.TOKEN_KIND,
120+
RMDelegationTokenIdentifier.KIND_NAME.toString());
121+
110122
return filterConfig;
111123
}
112124

‎hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/ResourceManager.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -901,6 +901,8 @@ protected void startWepApp() {
901901
+ " for RM webapp authentication");
902902
RMAuthenticationHandler
903903
.setSecretManager(getClientRMService().rmDTSecretManager);
904+
RMAuthenticationFilter
905+
.setDelegationTokenSecretManager(getClientRMService().rmDTSecretManager);
904906
String yarnAuthKey =
905907
authPrefix + RMAuthenticationFilter.AUTH_HANDLER_PROPERTY;
906908
conf.setStrings(yarnAuthKey, RMAuthenticationHandler.class.getName());

‎hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/webapp/RMWebServices.java‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@
6565
import org.apache.hadoop.security.authorize.AuthorizationException;
6666
import org.apache.hadoop.security.token.Token;
6767
import org.apache.hadoop.security.token.TokenIdentifier;
68+
import org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticationHandler;
6869
import org.apache.hadoop.yarn.api.protocolrecords.GetApplicationsRequest;
6970
import org.apache.hadoop.yarn.api.protocolrecords.GetNewApplicationRequest;
7071
import org.apache.hadoop.yarn.api.protocolrecords.GetNewApplicationResponse;
@@ -1085,10 +1086,18 @@ private UserGroupInformation createKerberosUserGroupInformation(
10851086
}
10861087

10871088
String authType = hsr.getAuthType();
1088-
if (!KerberosAuthenticationHandler.TYPE.equals(authType)) {
1089+
if (!KerberosAuthenticationHandler.TYPE.equalsIgnoreCase(authType)) {
10891090
String msg =
10901091
"Delegation token operations can only be carried out on a "
1091-
+ "Kerberos authenticated channel";
1092+
+ "Kerberos authenticated channel. Expected auth type is "
1093+
+ KerberosAuthenticationHandler.TYPE + ", got type " + authType;
1094+
throw new YarnException(msg);
1095+
}
1096+
if (hsr
1097+
.getAttribute(DelegationTokenAuthenticationHandler.DELEGATION_TOKEN_UGI_ATTRIBUTE) != null) {
1098+
String msg =
1099+
"Delegation token operations cannot be carried out using delegation"
1100+
+ " token authentication.";
10921101
throw new YarnException(msg);
10931102
}
10941103

‎hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/test/java/org/apache/hadoop/yarn/server/resourcemanager/TestRMAdminService.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -708,6 +708,7 @@ public void testRMInitialsWithFileSystemBasedConfigurationProvider()
708708
aclsString);
709709

710710
// verify ProxyUsers and ProxyHosts
711+
ProxyUsers.refreshSuperUserGroupsConfiguration(configuration);
711712
Assert.assertTrue(ProxyUsers.getDefaultImpersonationProvider().getProxyGroups()
712713
.get("hadoop.proxyuser.test.groups").size() == 1);
713714
Assert.assertTrue(ProxyUsers.getDefaultImpersonationProvider().getProxyGroups()

0 commit comments

Comments
 (0)