| <!DOCTYPE HTML> |
| <html lang="en"> |
| <head> |
| <!-- Generated by javadoc (17) --> |
| <title>Source code</title> |
| <meta name="viewport" content="width=device-width, initial-scale=1"> |
| <meta name="description" content="source: package: org.apache.hadoop.hbase.security, class: TestMultipleServerPrincipalsFallbackToSimple"> |
| <meta name="generator" content="javadoc/SourceToHTMLConverter"> |
| <link rel="stylesheet" type="text/css" href="../../../../../../stylesheet.css" title="Style"> |
| </head> |
| <body class="source-page"> |
| <main role="main"> |
| <div class="source-container"> |
| <pre><span class="source-line-no">001</span><span id="line-1">/*</span> |
| <span class="source-line-no">002</span><span id="line-2"> * Licensed to the Apache Software Foundation (ASF) under one</span> |
| <span class="source-line-no">003</span><span id="line-3"> * or more contributor license agreements. See the NOTICE file</span> |
| <span class="source-line-no">004</span><span id="line-4"> * distributed with this work for additional information</span> |
| <span class="source-line-no">005</span><span id="line-5"> * regarding copyright ownership. The ASF licenses this file</span> |
| <span class="source-line-no">006</span><span id="line-6"> * to you under the Apache License, Version 2.0 (the</span> |
| <span class="source-line-no">007</span><span id="line-7"> * "License"); you may not use this file except in compliance</span> |
| <span class="source-line-no">008</span><span id="line-8"> * with the License. You may obtain a copy of the License at</span> |
| <span class="source-line-no">009</span><span id="line-9"> *</span> |
| <span class="source-line-no">010</span><span id="line-10"> * http://www.apache.org/licenses/LICENSE-2.0</span> |
| <span class="source-line-no">011</span><span id="line-11"> *</span> |
| <span class="source-line-no">012</span><span id="line-12"> * Unless required by applicable law or agreed to in writing, software</span> |
| <span class="source-line-no">013</span><span id="line-13"> * distributed under the License is distributed on an "AS IS" BASIS,</span> |
| <span class="source-line-no">014</span><span id="line-14"> * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.</span> |
| <span class="source-line-no">015</span><span id="line-15"> * See the License for the specific language governing permissions and</span> |
| <span class="source-line-no">016</span><span id="line-16"> * limitations under the License.</span> |
| <span class="source-line-no">017</span><span id="line-17"> */</span> |
| <span class="source-line-no">018</span><span id="line-18">package org.apache.hadoop.hbase.security;</span> |
| <span class="source-line-no">019</span><span id="line-19"></span> |
| <span class="source-line-no">020</span><span id="line-20">import static org.hamcrest.MatcherAssert.assertThat;</span> |
| <span class="source-line-no">021</span><span id="line-21">import static org.hamcrest.Matchers.instanceOf;</span> |
| <span class="source-line-no">022</span><span id="line-22">import static org.junit.Assert.assertEquals;</span> |
| <span class="source-line-no">023</span><span id="line-23">import static org.junit.Assert.assertThrows;</span> |
| <span class="source-line-no">024</span><span id="line-24"></span> |
| <span class="source-line-no">025</span><span id="line-25">import java.io.File;</span> |
| <span class="source-line-no">026</span><span id="line-26">import java.io.IOException;</span> |
| <span class="source-line-no">027</span><span id="line-27">import java.lang.reflect.UndeclaredThrowableException;</span> |
| <span class="source-line-no">028</span><span id="line-28">import java.net.InetSocketAddress;</span> |
| <span class="source-line-no">029</span><span id="line-29">import java.security.PrivilegedExceptionAction;</span> |
| <span class="source-line-no">030</span><span id="line-30">import java.util.Arrays;</span> |
| <span class="source-line-no">031</span><span id="line-31">import java.util.List;</span> |
| <span class="source-line-no">032</span><span id="line-32">import org.apache.hadoop.conf.Configuration;</span> |
| <span class="source-line-no">033</span><span id="line-33">import org.apache.hadoop.fs.CommonConfigurationKeys;</span> |
| <span class="source-line-no">034</span><span id="line-34">import org.apache.hadoop.hbase.HBaseClassTestRule;</span> |
| <span class="source-line-no">035</span><span id="line-35">import org.apache.hadoop.hbase.HBaseTestingUtil;</span> |
| <span class="source-line-no">036</span><span id="line-36">import org.apache.hadoop.hbase.HConstants;</span> |
| <span class="source-line-no">037</span><span id="line-37">import org.apache.hadoop.hbase.ServerName;</span> |
| <span class="source-line-no">038</span><span id="line-38">import org.apache.hadoop.hbase.ipc.BlockingRpcClient;</span> |
| <span class="source-line-no">039</span><span id="line-39">import org.apache.hadoop.hbase.ipc.FallbackDisallowedException;</span> |
| <span class="source-line-no">040</span><span id="line-40">import org.apache.hadoop.hbase.ipc.FifoRpcScheduler;</span> |
| <span class="source-line-no">041</span><span id="line-41">import org.apache.hadoop.hbase.ipc.NettyRpcClient;</span> |
| <span class="source-line-no">042</span><span id="line-42">import org.apache.hadoop.hbase.ipc.RpcClient;</span> |
| <span class="source-line-no">043</span><span id="line-43">import org.apache.hadoop.hbase.ipc.RpcClientFactory;</span> |
| <span class="source-line-no">044</span><span id="line-44">import org.apache.hadoop.hbase.ipc.RpcServer;</span> |
| <span class="source-line-no">045</span><span id="line-45">import org.apache.hadoop.hbase.ipc.RpcServerFactory;</span> |
| <span class="source-line-no">046</span><span id="line-46">import org.apache.hadoop.hbase.ipc.TestProtobufRpcServiceImpl;</span> |
| <span class="source-line-no">047</span><span id="line-47">import org.apache.hadoop.hbase.testclassification.MediumTests;</span> |
| <span class="source-line-no">048</span><span id="line-48">import org.apache.hadoop.hbase.testclassification.SecurityTests;</span> |
| <span class="source-line-no">049</span><span id="line-49">import org.apache.hadoop.minikdc.MiniKdc;</span> |
| <span class="source-line-no">050</span><span id="line-50">import org.apache.hadoop.security.UserGroupInformation;</span> |
| <span class="source-line-no">051</span><span id="line-51">import org.junit.After;</span> |
| <span class="source-line-no">052</span><span id="line-52">import org.junit.Before;</span> |
| <span class="source-line-no">053</span><span id="line-53">import org.junit.BeforeClass;</span> |
| <span class="source-line-no">054</span><span id="line-54">import org.junit.ClassRule;</span> |
| <span class="source-line-no">055</span><span id="line-55">import org.junit.Test;</span> |
| <span class="source-line-no">056</span><span id="line-56">import org.junit.experimental.categories.Category;</span> |
| <span class="source-line-no">057</span><span id="line-57">import org.junit.runner.RunWith;</span> |
| <span class="source-line-no">058</span><span id="line-58">import org.junit.runners.Parameterized;</span> |
| <span class="source-line-no">059</span><span id="line-59">import org.junit.runners.Parameterized.Parameter;</span> |
| <span class="source-line-no">060</span><span id="line-60">import org.junit.runners.Parameterized.Parameters;</span> |
| <span class="source-line-no">061</span><span id="line-61"></span> |
| <span class="source-line-no">062</span><span id="line-62">import org.apache.hbase.thirdparty.com.google.common.collect.Lists;</span> |
| <span class="source-line-no">063</span><span id="line-63">import org.apache.hbase.thirdparty.com.google.common.io.Closeables;</span> |
| <span class="source-line-no">064</span><span id="line-64">import org.apache.hbase.thirdparty.com.google.protobuf.BlockingRpcChannel;</span> |
| <span class="source-line-no">065</span><span id="line-65"></span> |
| <span class="source-line-no">066</span><span id="line-66">import org.apache.hadoop.hbase.shaded.ipc.protobuf.generated.TestProtos;</span> |
| <span class="source-line-no">067</span><span id="line-67">import org.apache.hadoop.hbase.shaded.ipc.protobuf.generated.TestRpcServiceProtos.TestProtobufRpcProto;</span> |
| <span class="source-line-no">068</span><span id="line-68">import org.apache.hadoop.hbase.shaded.protobuf.generated.AuthenticationProtos.TokenIdentifier.Kind;</span> |
| <span class="source-line-no">069</span><span id="line-69"></span> |
| <span class="source-line-no">070</span><span id="line-70">/**</span> |
| <span class="source-line-no">071</span><span id="line-71"> * Test secure client connecting to a non secure server, where we have multiple server principal</span> |
| <span class="source-line-no">072</span><span id="line-72"> * candidates for a rpc service. See HBASE-28321.</span> |
| <span class="source-line-no">073</span><span id="line-73"> */</span> |
| <span class="source-line-no">074</span><span id="line-74">@RunWith(Parameterized.class)</span> |
| <span class="source-line-no">075</span><span id="line-75">@Category({ SecurityTests.class, MediumTests.class })</span> |
| <span class="source-line-no">076</span><span id="line-76">public class TestMultipleServerPrincipalsFallbackToSimple {</span> |
| <span class="source-line-no">077</span><span id="line-77"></span> |
| <span class="source-line-no">078</span><span id="line-78"> @ClassRule</span> |
| <span class="source-line-no">079</span><span id="line-79"> public static final HBaseClassTestRule CLASS_RULE =</span> |
| <span class="source-line-no">080</span><span id="line-80"> HBaseClassTestRule.forClass(TestMultipleServerPrincipalsFallbackToSimple.class);</span> |
| <span class="source-line-no">081</span><span id="line-81"></span> |
| <span class="source-line-no">082</span><span id="line-82"> private static final HBaseTestingUtil TEST_UTIL = new HBaseTestingUtil();</span> |
| <span class="source-line-no">083</span><span id="line-83"></span> |
| <span class="source-line-no">084</span><span id="line-84"> private static final File KEYTAB_FILE =</span> |
| <span class="source-line-no">085</span><span id="line-85"> new File(TEST_UTIL.getDataTestDir("keytab").toUri().getPath());</span> |
| <span class="source-line-no">086</span><span id="line-86"></span> |
| <span class="source-line-no">087</span><span id="line-87"> private static MiniKdc KDC;</span> |
| <span class="source-line-no">088</span><span id="line-88"> private static String HOST = "localhost";</span> |
| <span class="source-line-no">089</span><span id="line-89"> private static String SERVER_PRINCIPAL;</span> |
| <span class="source-line-no">090</span><span id="line-90"> private static String SERVER_PRINCIPAL2;</span> |
| <span class="source-line-no">091</span><span id="line-91"> private static String CLIENT_PRINCIPAL;</span> |
| <span class="source-line-no">092</span><span id="line-92"></span> |
| <span class="source-line-no">093</span><span id="line-93"> @Parameter</span> |
| <span class="source-line-no">094</span><span id="line-94"> public Class<? extends RpcClient> rpcClientImpl;</span> |
| <span class="source-line-no">095</span><span id="line-95"></span> |
| <span class="source-line-no">096</span><span id="line-96"> private Configuration clientConf;</span> |
| <span class="source-line-no">097</span><span id="line-97"> private UserGroupInformation clientUGI;</span> |
| <span class="source-line-no">098</span><span id="line-98"> private RpcServer rpcServer;</span> |
| <span class="source-line-no">099</span><span id="line-99"> private RpcClient rpcClient;</span> |
| <span class="source-line-no">100</span><span id="line-100"></span> |
| <span class="source-line-no">101</span><span id="line-101"> @Parameters(name = "{index}: rpcClientImpl={0}")</span> |
| <span class="source-line-no">102</span><span id="line-102"> public static List<Object[]> params() {</span> |
| <span class="source-line-no">103</span><span id="line-103"> return Arrays.asList(new Object[] { NettyRpcClient.class },</span> |
| <span class="source-line-no">104</span><span id="line-104"> new Object[] { BlockingRpcClient.class });</span> |
| <span class="source-line-no">105</span><span id="line-105"> }</span> |
| <span class="source-line-no">106</span><span id="line-106"></span> |
| <span class="source-line-no">107</span><span id="line-107"> private static void setSecuredConfiguration(Configuration conf) {</span> |
| <span class="source-line-no">108</span><span id="line-108"> conf.set(CommonConfigurationKeys.HADOOP_SECURITY_AUTHENTICATION, "kerberos");</span> |
| <span class="source-line-no">109</span><span id="line-109"> conf.set(User.HBASE_SECURITY_CONF_KEY, "kerberos");</span> |
| <span class="source-line-no">110</span><span id="line-110"> conf.setBoolean(User.HBASE_SECURITY_AUTHORIZATION_CONF_KEY, true);</span> |
| <span class="source-line-no">111</span><span id="line-111"> }</span> |
| <span class="source-line-no">112</span><span id="line-112"></span> |
| <span class="source-line-no">113</span><span id="line-113"> @BeforeClass</span> |
| <span class="source-line-no">114</span><span id="line-114"> public static void setUpBeforeClass() throws Exception {</span> |
| <span class="source-line-no">115</span><span id="line-115"> KDC = TEST_UTIL.setupMiniKdc(KEYTAB_FILE);</span> |
| <span class="source-line-no">116</span><span id="line-116"> SERVER_PRINCIPAL = "server/" + HOST;</span> |
| <span class="source-line-no">117</span><span id="line-117"> SERVER_PRINCIPAL2 = "server2/" + HOST;</span> |
| <span class="source-line-no">118</span><span id="line-118"> CLIENT_PRINCIPAL = "client";</span> |
| <span class="source-line-no">119</span><span id="line-119"> KDC.createPrincipal(KEYTAB_FILE, CLIENT_PRINCIPAL, SERVER_PRINCIPAL, SERVER_PRINCIPAL2);</span> |
| <span class="source-line-no">120</span><span id="line-120"> TEST_UTIL.getConfiguration().setInt("hbase.security.relogin.maxbackoff", 1);</span> |
| <span class="source-line-no">121</span><span id="line-121"> TEST_UTIL.getConfiguration().setInt("hbase.security.relogin.maxretries", 0);</span> |
| <span class="source-line-no">122</span><span id="line-122"> TEST_UTIL.getConfiguration().setInt(RpcClient.FAILED_SERVER_EXPIRY_KEY, 10);</span> |
| <span class="source-line-no">123</span><span id="line-123"> }</span> |
| <span class="source-line-no">124</span><span id="line-124"></span> |
| <span class="source-line-no">125</span><span id="line-125"> @Before</span> |
| <span class="source-line-no">126</span><span id="line-126"> public void setUp() throws Exception {</span> |
| <span class="source-line-no">127</span><span id="line-127"> clientConf = new Configuration(TEST_UTIL.getConfiguration());</span> |
| <span class="source-line-no">128</span><span id="line-128"> setSecuredConfiguration(clientConf);</span> |
| <span class="source-line-no">129</span><span id="line-129"> clientConf.setClass(RpcClientFactory.CUSTOM_RPC_CLIENT_IMPL_CONF_KEY, rpcClientImpl,</span> |
| <span class="source-line-no">130</span><span id="line-130"> RpcClient.class);</span> |
| <span class="source-line-no">131</span><span id="line-131"> String serverPrincipalConfigName = "hbase.test.multiple.principal.first";</span> |
| <span class="source-line-no">132</span><span id="line-132"> String serverPrincipalConfigName2 = "hbase.test.multiple.principal.second";</span> |
| <span class="source-line-no">133</span><span id="line-133"> clientConf.set(serverPrincipalConfigName, "server/localhost@" + KDC.getRealm());</span> |
| <span class="source-line-no">134</span><span id="line-134"> clientConf.set(serverPrincipalConfigName2, "server2/localhost@" + KDC.getRealm());</span> |
| <span class="source-line-no">135</span><span id="line-135"> SecurityInfo securityInfo = new SecurityInfo(Kind.HBASE_AUTH_TOKEN, serverPrincipalConfigName2,</span> |
| <span class="source-line-no">136</span><span id="line-136"> serverPrincipalConfigName);</span> |
| <span class="source-line-no">137</span><span id="line-137"> SecurityInfo.addInfo(TestProtobufRpcProto.getDescriptor().getName(), securityInfo);</span> |
| <span class="source-line-no">138</span><span id="line-138"></span> |
| <span class="source-line-no">139</span><span id="line-139"> UserGroupInformation.setConfiguration(clientConf);</span> |
| <span class="source-line-no">140</span><span id="line-140"> clientUGI = UserGroupInformation.loginUserFromKeytabAndReturnUGI(CLIENT_PRINCIPAL,</span> |
| <span class="source-line-no">141</span><span id="line-141"> KEYTAB_FILE.getCanonicalPath());</span> |
| <span class="source-line-no">142</span><span id="line-142"></span> |
| <span class="source-line-no">143</span><span id="line-143"> rpcServer = RpcServerFactory.createRpcServer(null, getClass().getSimpleName(),</span> |
| <span class="source-line-no">144</span><span id="line-144"> Lists.newArrayList(</span> |
| <span class="source-line-no">145</span><span id="line-145"> new RpcServer.BlockingServiceAndInterface(TestProtobufRpcServiceImpl.SERVICE, null)),</span> |
| <span class="source-line-no">146</span><span id="line-146"> new InetSocketAddress(HOST, 0), TEST_UTIL.getConfiguration(),</span> |
| <span class="source-line-no">147</span><span id="line-147"> new FifoRpcScheduler(TEST_UTIL.getConfiguration(), 1));</span> |
| <span class="source-line-no">148</span><span id="line-148"> rpcServer.start();</span> |
| <span class="source-line-no">149</span><span id="line-149"> }</span> |
| <span class="source-line-no">150</span><span id="line-150"></span> |
| <span class="source-line-no">151</span><span id="line-151"> @After</span> |
| <span class="source-line-no">152</span><span id="line-152"> public void tearDown() throws IOException {</span> |
| <span class="source-line-no">153</span><span id="line-153"> Closeables.close(rpcClient, true);</span> |
| <span class="source-line-no">154</span><span id="line-154"> rpcServer.stop();</span> |
| <span class="source-line-no">155</span><span id="line-155"> }</span> |
| <span class="source-line-no">156</span><span id="line-156"></span> |
| <span class="source-line-no">157</span><span id="line-157"> private RpcClient createClient() throws Exception {</span> |
| <span class="source-line-no">158</span><span id="line-158"> return clientUGI.doAs((PrivilegedExceptionAction<RpcClient>) () -> RpcClientFactory</span> |
| <span class="source-line-no">159</span><span id="line-159"> .createClient(clientConf, HConstants.DEFAULT_CLUSTER_ID.toString()));</span> |
| <span class="source-line-no">160</span><span id="line-160"> }</span> |
| <span class="source-line-no">161</span><span id="line-161"></span> |
| <span class="source-line-no">162</span><span id="line-162"> private String echo(String msg) throws Exception {</span> |
| <span class="source-line-no">163</span><span id="line-163"> return clientUGI.doAs((PrivilegedExceptionAction<String>) () -> {</span> |
| <span class="source-line-no">164</span><span id="line-164"> BlockingRpcChannel channel = rpcClient.createBlockingRpcChannel(</span> |
| <span class="source-line-no">165</span><span id="line-165"> ServerName.valueOf(HOST, rpcServer.getListenerAddress().getPort(), -1), User.getCurrent(),</span> |
| <span class="source-line-no">166</span><span id="line-166"> 10000);</span> |
| <span class="source-line-no">167</span><span id="line-167"> TestProtobufRpcProto.BlockingInterface stub = TestProtobufRpcProto.newBlockingStub(channel);</span> |
| <span class="source-line-no">168</span><span id="line-168"> return stub.echo(null, TestProtos.EchoRequestProto.newBuilder().setMessage(msg).build())</span> |
| <span class="source-line-no">169</span><span id="line-169"> .getMessage();</span> |
| <span class="source-line-no">170</span><span id="line-170"> });</span> |
| <span class="source-line-no">171</span><span id="line-171"> }</span> |
| <span class="source-line-no">172</span><span id="line-172"></span> |
| <span class="source-line-no">173</span><span id="line-173"> @Test</span> |
| <span class="source-line-no">174</span><span id="line-174"> public void testAllowFallbackToSimple() throws Exception {</span> |
| <span class="source-line-no">175</span><span id="line-175"> clientConf.setBoolean(RpcClient.IPC_CLIENT_FALLBACK_TO_SIMPLE_AUTH_ALLOWED_KEY, true);</span> |
| <span class="source-line-no">176</span><span id="line-176"> rpcClient = createClient();</span> |
| <span class="source-line-no">177</span><span id="line-177"> assertEquals("allow", echo("allow"));</span> |
| <span class="source-line-no">178</span><span id="line-178"> }</span> |
| <span class="source-line-no">179</span><span id="line-179"></span> |
| <span class="source-line-no">180</span><span id="line-180"> @Test</span> |
| <span class="source-line-no">181</span><span id="line-181"> public void testDisallowFallbackToSimple() throws Exception {</span> |
| <span class="source-line-no">182</span><span id="line-182"> clientConf.setBoolean(RpcClient.IPC_CLIENT_FALLBACK_TO_SIMPLE_AUTH_ALLOWED_KEY, false);</span> |
| <span class="source-line-no">183</span><span id="line-183"> rpcClient = createClient();</span> |
| <span class="source-line-no">184</span><span id="line-184"> UndeclaredThrowableException error =</span> |
| <span class="source-line-no">185</span><span id="line-185"> assertThrows(UndeclaredThrowableException.class, () -> echo("disallow"));</span> |
| <span class="source-line-no">186</span><span id="line-186"> Throwable cause = error.getCause().getCause().getCause();</span> |
| <span class="source-line-no">187</span><span id="line-187"> assertThat(cause, instanceOf(FallbackDisallowedException.class));</span> |
| <span class="source-line-no">188</span><span id="line-188"> }</span> |
| <span class="source-line-no">189</span><span id="line-189">}</span> |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| </pre> |
| </div> |
| </main> |
| </body> |
| </html> |
