org.apache.hadoop.security.token.delegation

Class AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>

java.lang.Object

org.apache.hadoop.security.token.SecretManager<TokenIdent>

org.apache.hadoop.security.token.delegation.AbstractDelegationTokenSecretManager<TokenIdent>

Direct Known Subclasses:

DelegationTokenSecretManager, DelegationTokenSecretManager, JHSDelegationTokenSecretManager, RMDelegationTokenSecretManager

@InterfaceAudience.LimitedPrivate(value={"HDFS","MapReduce"})
@InterfaceStability.Evolving
public abstract class AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>
extends SecretManager<TokenIdent>

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	AbstractDelegationTokenSecretManager.DelegationTokenInformation Class to encapsulate a token's renew date and password.

Nested classes/interfaces inherited from class org.apache.hadoop.security.token.SecretManager

SecretManager.InvalidToken

Field Summary

Fields

Modifier and Type	Field and Description
protected Map<Integer,DelegationKey>	allKeys Access to allKeys is protected by this object lock
protected int	currentId Access to currentId is protected by this object lock.
protected Map<TokenIdent,AbstractDelegationTokenSecretManager.DelegationTokenInformation>	currentTokens Cache of currently valid tokens, mapping from DelegationTokenIdentifier to DelegationTokenInformation.
protected int	delegationTokenSequenceNumber Sequence number to create DelegationTokenIdentifier.
protected Object	noInterruptsLock If the delegation token update thread holds this lock, it will not get interrupted.
protected boolean	running
protected boolean	storeTokenTrackingId Whether to store a token's tracking ID in its TokenInformation.

Constructor Summary

Constructors

Constructor and Description
AbstractDelegationTokenSecretManager(long delegationKeyUpdateInterval, long delegationTokenMaxLifetime, long delegationTokenRenewInterval, long delegationTokenRemoverScanInterval)

Method Summary

Methods

Modifier and Type	Method and Description
void	addKey(DelegationKey key) Add a previously used master key to cache (when NN restarts), should be called before activate().
void	addPersistedDelegationToken(TokenIdent identifier, long renewDate) This method is intended to be used for recovering persisted delegation tokens
TokenIdent	cancelToken(Token<TokenIdent> token, String canceller) Cancel a token by removing it from cache.
protected byte[]	createPassword(TokenIdent identifier) Create the password for the given identifier.
static SecretKey	createSecretKey(byte[] key) Convert the byte[] to a secret key
DelegationKey[]	getAllKeys()
String	getTokenTrackingId(TokenIdent identifier)
protected String	getTrackingIdIfEnabled(TokenIdent ident)
boolean	isRunning() is secretMgr running
protected void	logExpireToken(TokenIdent ident)
protected void	logUpdateMasterKey(DelegationKey key)
protected void	removeStoredMasterKey(DelegationKey key)
protected void	removeStoredToken(TokenIdent ident)
long	renewToken(Token<TokenIdent> token, String renewer) Renew a delegation token.
void	reset() Reset all data structures and mutable state.
byte[]	retrievePassword(TokenIdent identifier) Retrieve the password for the given token identifier.
void	startThreads() should be called before this object is used
void	stopThreads()
protected void	storeNewMasterKey(DelegationKey key)
protected void	storeNewToken(TokenIdent ident, long renewDate)
protected void	updateStoredToken(TokenIdent ident, long renewDate)
void	verifyToken(TokenIdent identifier, byte[] password) Verifies that the given identifier and password are valid and match.

Methods inherited from class org.apache.hadoop.security.token.SecretManager

checkAvailableForRead, createIdentifier, createPassword, generateSecret

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

currentTokens

protected final Map<TokenIdent extends AbstractDelegationTokenIdentifier,AbstractDelegationTokenSecretManager.DelegationTokenInformation> currentTokens

Cache of currently valid tokens, mapping from DelegationTokenIdentifier to DelegationTokenInformation. Protected by this object lock.

delegationTokenSequenceNumber

protected int delegationTokenSequenceNumber

Sequence number to create DelegationTokenIdentifier. Protected by this object lock.

allKeys

protected final Map<Integer,DelegationKey> allKeys

Access to allKeys is protected by this object lock

currentId

protected int currentId

Access to currentId is protected by this object lock.

storeTokenTrackingId

protected boolean storeTokenTrackingId

Whether to store a token's tracking ID in its TokenInformation. Can be overridden by a subclass.

running

protected volatile boolean running

noInterruptsLock

protected Object noInterruptsLock

If the delegation token update thread holds this lock, it will not get interrupted.

Constructor Detail

AbstractDelegationTokenSecretManager

public AbstractDelegationTokenSecretManager(long delegationKeyUpdateInterval,
                                    long delegationTokenMaxLifetime,
                                    long delegationTokenRenewInterval,
                                    long delegationTokenRemoverScanInterval)

Method Detail

startThreads

public void startThreads()
                  throws IOException

should be called before this object is used

Throws:

IOException

reset

public void reset()

Reset all data structures and mutable state.

addKey

public void addKey(DelegationKey key)
            throws IOException

Add a previously used master key to cache (when NN restarts), should be called before activate().

Throws:

IOException

getAllKeys

public DelegationKey[] getAllKeys()

logUpdateMasterKey

protected void logUpdateMasterKey(DelegationKey key)
                           throws IOException

Throws:

IOException

logExpireToken

protected void logExpireToken(TokenIdent ident)
                       throws IOException

Throws:

IOException

storeNewMasterKey

protected void storeNewMasterKey(DelegationKey key)
                          throws IOException

Throws:

IOException

removeStoredMasterKey

protected void removeStoredMasterKey(DelegationKey key)

storeNewToken

protected void storeNewToken(TokenIdent ident,
                 long renewDate)

removeStoredToken

protected void removeStoredToken(TokenIdent ident)
                          throws IOException

Throws:

IOException

updateStoredToken

protected void updateStoredToken(TokenIdent ident,
                     long renewDate)

addPersistedDelegationToken

public void addPersistedDelegationToken(TokenIdent identifier,
                               long renewDate)
                                 throws IOException

This method is intended to be used for recovering persisted delegation tokens

Parameters:

identifier - identifier read from persistent storage

renewDate - token renew time

Throws:

IOException

createPassword

protected byte[] createPassword(TokenIdent identifier)

Description copied from class: SecretManager

Create the password for the given identifier. identifier may be modified inside this method.

Specified by:

createPassword in class SecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>

Parameters:

identifier - the identifier to use

Returns:

the new password

retrievePassword

public byte[] retrievePassword(TokenIdent identifier)
                        throws SecretManager.InvalidToken

Description copied from class: SecretManager

Retrieve the password for the given token identifier. Should check the date or registry to make sure the token hasn't expired or been revoked. Returns the relevant password.

Specified by:

retrievePassword in class SecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>

Parameters:

identifier - the identifier to validate

Returns:

the password to use

Throws:

SecretManager.InvalidToken - the token was invalid

getTrackingIdIfEnabled

protected String getTrackingIdIfEnabled(TokenIdent ident)

getTokenTrackingId

public String getTokenTrackingId(TokenIdent identifier)

verifyToken

public void verifyToken(TokenIdent identifier,
               byte[] password)
                 throws SecretManager.InvalidToken

Verifies that the given identifier and password are valid and match.

Parameters:

identifier - Token identifier.

password - Password in the token.

Throws:

InvalidToken

SecretManager.InvalidToken

renewToken

public long renewToken(Token<TokenIdent> token,
              String renewer)
                throws SecretManager.InvalidToken,
                       IOException

Renew a delegation token.

Parameters:

token - the token to renew

renewer - the full principal name of the user doing the renewal

Returns:

the new expiration time

Throws:

InvalidToken - if the token is invalid

AccessControlException - if the user can't renew token

SecretManager.InvalidToken

IOException

cancelToken

public TokenIdent cancelToken(Token<TokenIdent> token,
                     String canceller)
                                                                 throws IOException

Cancel a token by removing it from cache.

Returns:

Identifier of the canceled token

Throws:

InvalidToken - for invalid token

AccessControlException - if the user isn't allowed to cancel

IOException

createSecretKey

public static SecretKey createSecretKey(byte[] key)

Convert the byte[] to a secret key

Parameters:

key - the byte[] to create the secret key from

Returns:

the secret key

stopThreads

public void stopThreads()

isRunning

public boolean isRunning()

is secretMgr running

Returns:

true if secret mgr is running