org.apache.hadoop.hive.metastore.utils

Class SecurityUtils

java.lang.Object

org.apache.hadoop.hive.metastore.utils.SecurityUtils

public class SecurityUtils
extends Object

Constructor Summary

Constructors

Constructor and Description
SecurityUtils()

Method Summary

Modifier and Type	Method and Description
static org.apache.thrift.transport.TServerSocket	getServerSocket(String hiveHost, int portNum)
static org.apache.thrift.transport.TServerSocket	getServerSSLSocket(String hiveHost, int portNum, String keyStorePath, String keyStorePassWord, List<String> sslVersionBlacklist)
static org.apache.thrift.transport.TTransport	getSSLSocket(String host, int port, int loginTimeout, String trustStorePath, String trustStorePassWord)
static String	getTokenStoreClassName(org.apache.hadoop.conf.Configuration conf) This method should be used to return the metastore specific tokenstore class name to main backwards compatibility
static String	getTokenStrForm(String tokenSignature) Get the string form of the token given a token signature.
static org.apache.hadoop.security.UserGroupInformation	getUGI()
static String	getUser()
static void	setTokenStr(org.apache.hadoop.security.UserGroupInformation ugi, String tokenStr, String tokenService) Create a delegation token object for the given token string and service.
static void	setZookeeperClientKerberosJaasConfig(String principal, String keyTabFile) Dynamically sets up the JAAS configuration that uses kerberos

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SecurityUtils

public SecurityUtils()

Method Detail

getUGI

public static org.apache.hadoop.security.UserGroupInformation getUGI()
                                                              throws LoginException,
                                                                     IOException

Throws:

LoginException

IOException

setZookeeperClientKerberosJaasConfig

public static void setZookeeperClientKerberosJaasConfig(String principal,
                                                        String keyTabFile)
                                                 throws IOException

Dynamically sets up the JAAS configuration that uses kerberos

Parameters:

principal -

keyTabFile -

Throws:

IOException

getTokenStrForm

public static String getTokenStrForm(String tokenSignature)
                              throws IOException

Get the string form of the token given a token signature. The signature is used as the value of the "service" field in the token for lookup. Ref: AbstractDelegationTokenSelector in Hadoop. If there exists such a token in the token cache (credential store) of the job, the lookup returns that. This is relevant only when running against a "secure" hadoop release The method gets hold of the tokens if they are set up by hadoop - this should happen on the map/reduce tasks if the client added the tokens into hadoop's credential store in the front end during job submission. The method will select the hive delegation token among the set of tokens and return the string form of it

Parameters:

tokenSignature -

Returns:

the string form of the token found

Throws:

IOException

setTokenStr

public static void setTokenStr(org.apache.hadoop.security.UserGroupInformation ugi,
                               String tokenStr,
                               String tokenService)
                        throws IOException

Create a delegation token object for the given token string and service. Add the token to given UGI

Parameters:

ugi -

tokenStr -

tokenService -

Throws:

IOException

getTokenStoreClassName

public static String getTokenStoreClassName(org.apache.hadoop.conf.Configuration conf)

This method should be used to return the metastore specific tokenstore class name to main backwards compatibility

Parameters:

conf - - HiveConf object

Returns:

the tokenStoreClass name from the HiveConf. It maps the hive specific tokenstoreclass name to metastore module specific class name. For eg: hive.cluster.delegation.token.store.class is set to org.apache.hadoop.hive.thrift.MemoryTokenStore it returns the equivalent tokenstore class defined in the metastore module which is org.apache.hadoop.hive.metastore.security.MemoryTokenStore Similarly, org.apache.hadoop.hive.thrift.DBTokenStore maps to org.apache.hadoop.hive.metastore.security.DBTokenStore and org.apache.hadoop.hive.thrift.ZooKeeperTokenStore maps to org.apache.hadoop.hive.metastore.security.ZooKeeperTokenStore

getUser

public static String getUser()
                      throws IOException

Returns:

the user name set in hadoop.job.ugi param or the current user from System

Throws:

IOException - if underlying Hadoop call throws LoginException

getServerSocket

public static org.apache.thrift.transport.TServerSocket getServerSocket(String hiveHost,
                                                                        int portNum)
                                                                 throws org.apache.thrift.transport.TTransportException

Throws:

org.apache.thrift.transport.TTransportException

getServerSSLSocket

public static org.apache.thrift.transport.TServerSocket getServerSSLSocket(String hiveHost,
                                                                           int portNum,
                                                                           String keyStorePath,
                                                                           String keyStorePassWord,
                                                                           List<String> sslVersionBlacklist)
                                                                    throws org.apache.thrift.transport.TTransportException,
                                                                           UnknownHostException

Throws:

org.apache.thrift.transport.TTransportException

UnknownHostException

getSSLSocket

public static org.apache.thrift.transport.TTransport getSSLSocket(String host,
                                                                  int port,
                                                                  int loginTimeout,
                                                                  String trustStorePath,
                                                                  String trustStorePassWord)
                                                           throws org.apache.thrift.transport.TTransportException

Throws:

org.apache.thrift.transport.TTransportException