Package org.apache.hadoop.ozone.security

Class OzoneDelegationTokenSecretManager

java.lang.Object
org.apache.hadoop.security.token.SecretManager<org.apache.hadoop.ozone.security.OzoneTokenIdentifier>
org.apache.hadoop.hdds.security.OzoneSecretManager<org.apache.hadoop.ozone.security.OzoneTokenIdentifier>
org.apache.hadoop.ozone.security.OzoneDelegationTokenSecretManager
All Implemented Interfaces:
org.apache.hadoop.hdds.security.x509.certificate.client.CertificateNotification
@Private @Unstable public class OzoneDelegationTokenSecretManager extends org.apache.hadoop.hdds.security.OzoneSecretManager<org.apache.hadoop.ozone.security.OzoneTokenIdentifier>
SecretManager for Ozone Master. Responsible for signing identifiers with private key,

  • Nested Class Summary

    Nested Classes
    Modifier and Type
    Class
    Description
    static class 
    OzoneDelegationTokenSecretManager.Builder
    Builder to help construct OzoneDelegationTokenSecretManager.

    Nested classes/interfaces inherited from class org.apache.hadoop.security.token.SecretManager

    org.apache.hadoop.security.token.SecretManager.InvalidToken

  • Constructor Summary

    Constructors
    Constructor
    Description
    OzoneDelegationTokenSecretManager(OzoneDelegationTokenSecretManager.Builder b)
    Create a secret manager with a builder object.

  • Method Summary

    Modifier and Type
    Method
    Description
    org.apache.hadoop.ozone.security.OzoneTokenIdentifier
    cancelToken(org.apache.hadoop.security.token.Token<org.apache.hadoop.ozone.security.OzoneTokenIdentifier> token, String canceller)
    Cancel a token by removing it from store and cache.
    org.apache.hadoop.ozone.security.OzoneTokenIdentifier
    createIdentifier()
     
    org.apache.hadoop.ozone.security.OzoneTokenIdentifier
    createIdentifier(org.apache.hadoop.io.Text owner, org.apache.hadoop.io.Text renewer, org.apache.hadoop.io.Text realUser)
    Create new Identifier with given,owner,renwer and realUser.
    org.apache.hadoop.security.token.Token<org.apache.hadoop.ozone.security.OzoneTokenIdentifier>
    createToken(org.apache.hadoop.io.Text owner, org.apache.hadoop.io.Text renewer, org.apache.hadoop.io.Text realUser)
    Returns Token for given identifier.
    long
    getTokenRemoverScanInterval()
     
    void
    removeToken(org.apache.hadoop.ozone.security.OzoneTokenIdentifier ozoneTokenIdentifier)
    Remove the expired token from in-memory map.
    long
    renewToken(org.apache.hadoop.security.token.Token<org.apache.hadoop.ozone.security.OzoneTokenIdentifier> token, String renewer)
    Renew a delegation token.
    byte[]
    retrievePassword(org.apache.hadoop.ozone.security.OzoneTokenIdentifier identifier)
     
    void
    setSecretKeyClient(org.apache.hadoop.hdds.security.symmetric.SecretKeyClient client)
     
    void
    start(org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient certClient)
    Should be called before this object is used.
    void
    stop()
    Stops the OzoneDelegationTokenSecretManager.
    void
    updateRenewToken(org.apache.hadoop.security.token.Token<org.apache.hadoop.ozone.security.OzoneTokenIdentifier> token, org.apache.hadoop.ozone.security.OzoneTokenIdentifier ozoneTokenIdentifier, long expiryTime)
     
    long
    updateToken(org.apache.hadoop.security.token.Token<org.apache.hadoop.ozone.security.OzoneTokenIdentifier> token, org.apache.hadoop.ozone.security.OzoneTokenIdentifier ozoneTokenIdentifier, long tokenRenewInterval)
    Add delegation token in to in-memory map of tokens.
    boolean
    verifySignature(org.apache.hadoop.ozone.security.OzoneTokenIdentifier identifier, byte[] password)
    Validates if given hash is valid.

    Methods inherited from class org.apache.hadoop.hdds.security.OzoneSecretManager

    createPassword, createPassword, formatTokenId, getCertClient, getCertSerialId, getCurrentKey, getCurrentKeyId, getDefaultSignatureAlgorithm, getDelegationTokenSeqNum, getService, getTokenMaxLifetime, getTokenRenewInterval, getTokenSequenceNumber, incrementCurrentKeyId, incrementDelegationTokenSeqNum, isRunning, notifyCertificateRenewed, setCertClient, setDelegationTokenSeqNum, setIsRunning

    Methods inherited from class org.apache.hadoop.security.token.SecretManager

    checkAvailableForRead, createPassword, createSecretKey, generateSecret, retriableRetrievePassword

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

  • Method Details

    • createIdentifier

      public org.apache.hadoop.ozone.security.OzoneTokenIdentifier createIdentifier()
      Specified by:
      createIdentifier in class org.apache.hadoop.security.token.SecretManager<org.apache.hadoop.ozone.security.OzoneTokenIdentifier>

    • createIdentifier

      public org.apache.hadoop.ozone.security.OzoneTokenIdentifier createIdentifier(org.apache.hadoop.io.Text owner, org.apache.hadoop.io.Text renewer, org.apache.hadoop.io.Text realUser)
      Create new Identifier with given,owner,renwer and realUser.
      Returns:
      T

    • createToken

      public org.apache.hadoop.security.token.Token<org.apache.hadoop.ozone.security.OzoneTokenIdentifier> createToken(org.apache.hadoop.io.Text owner, org.apache.hadoop.io.Text renewer, org.apache.hadoop.io.Text realUser) throws IOException
      Returns Token for given identifier.
      Throws:
      IOException - to allow future exceptions to be added without breaking compatibility

    • updateToken

      public long updateToken(org.apache.hadoop.security.token.Token<org.apache.hadoop.ozone.security.OzoneTokenIdentifier> token, org.apache.hadoop.ozone.security.OzoneTokenIdentifier ozoneTokenIdentifier, long tokenRenewInterval)
      Add delegation token in to in-memory map of tokens.
      Returns:
      renewTime - If updated successfully, return renewTime.

    • renewToken

      public long renewToken(org.apache.hadoop.security.token.Token<org.apache.hadoop.ozone.security.OzoneTokenIdentifier> token, String renewer) throws IOException
      Renew a delegation token.
      Specified by:
      renewToken in class org.apache.hadoop.hdds.security.OzoneSecretManager<org.apache.hadoop.ozone.security.OzoneTokenIdentifier>
      Parameters:
      token - the token to renew
      renewer - the full principal name of the user doing the renewal
      Returns:
      the new expiration time
      Throws:
      org.apache.hadoop.security.token.SecretManager.InvalidToken - if the token is invalid
      org.apache.hadoop.security.AccessControlException - if the user can't renew token
      IOException

    • updateRenewToken

      public void updateRenewToken(org.apache.hadoop.security.token.Token<org.apache.hadoop.ozone.security.OzoneTokenIdentifier> token, org.apache.hadoop.ozone.security.OzoneTokenIdentifier ozoneTokenIdentifier, long expiryTime)

    • cancelToken

      public org.apache.hadoop.ozone.security.OzoneTokenIdentifier cancelToken(org.apache.hadoop.security.token.Token<org.apache.hadoop.ozone.security.OzoneTokenIdentifier> token, String canceller) throws IOException
      Cancel a token by removing it from store and cache.
      Specified by:
      cancelToken in class org.apache.hadoop.hdds.security.OzoneSecretManager<org.apache.hadoop.ozone.security.OzoneTokenIdentifier>
      Returns:
      Identifier of the canceled token
      Throws:
      org.apache.hadoop.security.token.SecretManager.InvalidToken - for invalid token
      org.apache.hadoop.security.AccessControlException - if the user isn't allowed to cancel
      IOException

    • removeToken

      public void removeToken(org.apache.hadoop.ozone.security.OzoneTokenIdentifier ozoneTokenIdentifier)
      Remove the expired token from in-memory map.

    • retrievePassword

      public byte[] retrievePassword(org.apache.hadoop.ozone.security.OzoneTokenIdentifier identifier) throws org.apache.hadoop.security.token.SecretManager.InvalidToken
      Specified by:
      retrievePassword in class org.apache.hadoop.security.token.SecretManager<org.apache.hadoop.ozone.security.OzoneTokenIdentifier>
      Throws:
      org.apache.hadoop.security.token.SecretManager.InvalidToken

    • verifySignature

      public boolean verifySignature(org.apache.hadoop.ozone.security.OzoneTokenIdentifier identifier, byte[] password)
      Validates if given hash is valid. HDDS-8829 changes the delegation token from sign by OM's RSA private key to secret key supported by SCM. The default delegation token lifetime is 7 days. In the 7 days period after OM is upgraded from version without HDDS-8829 to version with HDDS-8829, tokens signed by RSA private key, and tokens signed by secret key will coexist. After 7 days, there will be only tokens signed by secrete key still valid. Following logic will handle both types of tokens.

    • start

      public void start(org.apache.hadoop.hdds.security.x509.certificate.client.CertificateClient certClient) throws IOException
      Should be called before this object is used.
      Overrides:
      start in class org.apache.hadoop.hdds.security.OzoneSecretManager<org.apache.hadoop.ozone.security.OzoneTokenIdentifier>
      Throws:
      IOException

    • stop

      public void stop() throws IOException
      Stops the OzoneDelegationTokenSecretManager.
      Overrides:
      stop in class org.apache.hadoop.hdds.security.OzoneSecretManager<org.apache.hadoop.ozone.security.OzoneTokenIdentifier>
      Throws:
      IOException

    • setSecretKeyClient

      public void setSecretKeyClient(org.apache.hadoop.hdds.security.symmetric.SecretKeyClient client)

    • getTokenRemoverScanInterval

      public long getTokenRemoverScanInterval()