org.apache.hadoop.security
Class SecurityUtil

java.lang.Object
  extended by org.apache.hadoop.security.SecurityUtil

public class SecurityUtil
extends Object


Field Summary
static String HOSTNAME_PATTERN
           
static org.apache.commons.logging.Log LOG
           
 
Constructor Summary
SecurityUtil()
           
 
Method Summary
static String buildDTServiceName(URI uri, int defPort)
          create service name for Delegation token ip:port
static void fetchServiceTicket(URL remoteHost)
          Explicitly pull the service ticket for the specified host.
static AccessControlList getAdminAcls(Configuration conf, String configKey)
          Get the ACL object representing the cluster administrators The user who starts the daemon is automatically added as an admin
static String getServerPrincipal(String principalConfig, String hostname)
          Convert Kerberos principal name conf values to valid Kerberos principal names.
protected static boolean isOriginalTGT(String name)
           
static void login(Configuration conf, String keytabFileKey, String userNameKey)
          If a keytab has been provided, login as that user.
static void login(Configuration conf, String keytabFileKey, String userNameKey, String hostname)
          If a keytab has been provided, login as that user.
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

LOG

public static final org.apache.commons.logging.Log LOG

HOSTNAME_PATTERN

public static final String HOSTNAME_PATTERN
See Also:
Constant Field Values
Constructor Detail

SecurityUtil

public SecurityUtil()
Method Detail

isOriginalTGT

protected static boolean isOriginalTGT(String name)

fetchServiceTicket

public static void fetchServiceTicket(URL remoteHost)
                               throws IOException
Explicitly pull the service ticket for the specified host. This solves a problem with Java's Kerberos SSL problem where the client cannot authenticate against a cross-realm service. It is necessary for clients making kerberized https requests to call this method on the target URL to ensure that in a cross-realm environment the remote host will be successfully authenticated. This method is internal to Hadoop and should not be used by other applications. This method should not be considered stable or open: it will be removed when the Java behavior is changed.

Parameters:
remoteHost - Target URL the krb-https client will access
Throws:
IOException

getServerPrincipal

public static String getServerPrincipal(String principalConfig,
                                        String hostname)
                                 throws IOException
Convert Kerberos principal name conf values to valid Kerberos principal names. It replaces $host in the conf values with hostname, which should be fully-qualified domain name. If hostname is null or "0.0.0.0", it uses dynamically looked-up fqdn of the current host instead.

Parameters:
principalConfig - the Kerberos principal name conf value to convert
hostname - the fully-qualified domain name used for substitution
Returns:
converted Kerberos principal name
Throws:
IOException

login

public static void login(Configuration conf,
                         String keytabFileKey,
                         String userNameKey)
                  throws IOException
If a keytab has been provided, login as that user. Substitute $host in user's Kerberos principal name with a dynamically looked-up fully-qualified domain name of the current host.

Parameters:
conf - conf to use
keytabFileKey - the key to look for keytab file in conf
userNameKey - the key to look for user's Kerberos principal name in conf
Throws:
IOException

login

public static void login(Configuration conf,
                         String keytabFileKey,
                         String userNameKey,
                         String hostname)
                  throws IOException
If a keytab has been provided, login as that user. Substitute $host in user's Kerberos principal name with hostname.

Parameters:
conf - conf to use
keytabFileKey - the key to look for keytab file in conf
userNameKey - the key to look for user's Kerberos principal name in conf
hostname - hostname to use for substitution
Throws:
IOException

buildDTServiceName

public static String buildDTServiceName(URI uri,
                                        int defPort)
create service name for Delegation token ip:port

Parameters:
uri -
Returns:
"ip:port"

getAdminAcls

public static AccessControlList getAdminAcls(Configuration conf,
                                             String configKey)
Get the ACL object representing the cluster administrators The user who starts the daemon is automatically added as an admin

Parameters:
conf -
configKey - the key that holds the ACL string in its value
Returns:
AccessControlList instance


Copyright © 2009 The Apache Software Foundation