org.apache.hadoop.security

## Class SecurityUtil

- java.lang.Object
- - org.apache.hadoop.security.SecurityUtil

-     @InterfaceAudience.Public
       @InterfaceStability.Evolving
      public final class SecurityUtil
      extends Object

  Security Utils.

- - ### Nested Class Summary

    Nested Classes
    Modifier and Type | Class and Description
    --- | ---
    `protected static class` | `SecurityUtil.QualifiedHostResolver` This an alternate resolver with important properties that the standard java resolver lacks: 1) The hostname is fully qualified.

  - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static String` | `FAILED_TO_GET_UGI_MSG_HEADER`
    `static String` | `HOSTNAME_PATTERN`
    `static org.slf4j.Logger` | `LOG`

  - ### Method Summary

    All Methods Static Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `static String` | `buildDTServiceName(URI uri, int defPort)` create the service name for a Delegation token
    `static Text` | `buildTokenService(InetSocketAddress addr)` Construct the service key for a token
    `static Text` | `buildTokenService(URI uri)` Construct the service key for a token
    `static <T> T` | `doAsCurrentUser(PrivilegedExceptionAction<T> action)` Perform the given action as the daemon's current user.
    `static <T> T` | `doAsLoginUser(PrivilegedExceptionAction<T> action)` Perform the given action as the daemon's login user.
    `static <T> T` | `doAsLoginUserOrFatal(PrivilegedAction<T> action)` Perform the given action as the daemon's login user.
    `static UserGroupInformation.AuthenticationMethod` | `getAuthenticationMethod(Configuration conf)`
    `static String` | `getClientPrincipal(Class<?> protocol, Configuration conf)` Look up the client principal for a given protocol.
    `static String` | `getHostFromPrincipal(String principalName)` Get the host name from the principal name of format /host@realm.
    `static org.apache.hadoop.security.KerberosInfo` | `getKerberosInfo(Class<?> protocol, Configuration conf)` Look up the KerberosInfo for a given protocol.
    `static String` | `getServerPrincipal(String principalConfig, InetAddress addr)` Convert Kerberos principal name pattern to valid Kerberos principal names.
    `static String` | `getServerPrincipal(String principalConfig, String hostname)` Convert Kerberos principal name pattern to valid Kerberos principal names.
    `static TokenInfo` | `getTokenInfo(Class<?> protocol, Configuration conf)` Look up the TokenInfo for a given protocol.
    `static InetSocketAddress` | `getTokenServiceAddr(Token<?> token)` Decode the given token's service field into an InetAddress
    `static List<org.apache.hadoop.util.ZKUtil.ZKAuthInfo>` | `getZKAuthInfos(Configuration conf, String configKey)` Utility method to fetch ZK auth info from the configuration.
    `protected static boolean` | `isOriginalTGT(KerberosTicket ticket)` Check whether the server principal is the TGS's principal
    `static boolean` | `isPrivilegedPort(int port)`
    `static void` | `login(Configuration conf, String keytabFileKey, String userNameKey)` Login as a principal specified in config.
    `static void` | `login(Configuration conf, String keytabFileKey, String userNameKey, String hostname)` Login as a principal specified in config.
    `static void` | `setAuthenticationMethod(UserGroupInformation.AuthenticationMethod authenticationMethod, Configuration conf)`
    `static void` | `setConfiguration(Configuration conf)`
    `static void` | `setTokenService(Token<?> token, InetSocketAddress addr)` Set the given token's service to the format expected by the RPC client

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Field Detail

    - #### LOG

          public static final org.slf4j.Logger LOG

    - #### HOSTNAME_PATTERN

          public static final String HOSTNAME_PATTERN

      See Also:
        Constant Field Values

    - #### FAILED_TO_GET_UGI_MSG_HEADER

          public static final String FAILED_TO_GET_UGI_MSG_HEADER

      See Also:
        Constant Field Values

  - ### Method Detail

    - #### setConfiguration

          @InterfaceAudience.Public
           @InterfaceStability.Evolving
          public static void setConfiguration(Configuration conf)

    - #### isOriginalTGT

          protected static boolean isOriginalTGT(KerberosTicket ticket)

      Check whether the server principal is the TGS's principal
      Parameters:
        `ticket` - the original TGT (the ticket that is obtained when a kinit is done)
      Returns:
        true or false

    - #### getServerPrincipal

          @InterfaceAudience.Public
           @InterfaceStability.Evolving
          public static String getServerPrincipal(String principalConfig,
                                                                                                          String hostname)
                                                                                                   throws IOException

      Convert Kerberos principal name pattern to valid Kerberos principal names. It replaces hostname pattern with hostname, which should be fully-qualified domain name. If hostname is null or "0.0.0.0", it uses dynamically looked-up fqdn of the current host instead.
      Parameters:
        `principalConfig` - the Kerberos principal name conf value to convert
        `hostname` - the fully-qualified domain name used for substitution
      Returns:
        converted Kerberos principal name
      Throws:
        `IOException` - if the client address cannot be determined

    - #### getServerPrincipal

          @InterfaceAudience.Public
           @InterfaceStability.Evolving
          public static String getServerPrincipal(String principalConfig,
                                                                                                          InetAddress addr)
                                                                                                   throws IOException

      Convert Kerberos principal name pattern to valid Kerberos principal names. This method is similar to `getServerPrincipal(String, String)`, except 1) the reverse DNS lookup from addr to hostname is done only when necessary, 2) param addr can't be null (no default behavior of using local hostname when addr is null).
      Parameters:
        `principalConfig` - Kerberos principal name pattern to convert
        `addr` - InetAddress of the host used for substitution
      Returns:
        converted Kerberos principal name
      Throws:
        `IOException` - if the client address cannot be determined

    - #### login

          @InterfaceAudience.Public
           @InterfaceStability.Evolving
          public static void login(Configuration conf,
                                                                                           String keytabFileKey,
                                                                                           String userNameKey)
                                                                                    throws IOException

      Login as a principal specified in config. Substitute $host in user's Kerberos principal name with a dynamically looked-up fully-qualified domain name of the current host.
      Parameters:
        `conf` - conf to use
        `keytabFileKey` - the key to look for keytab file in conf
        `userNameKey` - the key to look for user's Kerberos principal name in conf
      Throws:
        `IOException` - if login fails

    - #### login

          @InterfaceAudience.Public
           @InterfaceStability.Evolving
          public static void login(Configuration conf,
                                                                                           String keytabFileKey,
                                                                                           String userNameKey,
                                                                                           String hostname)
                                                                                    throws IOException

      Login as a principal specified in config. Substitute $host in user's Kerberos principal name with hostname. If non-secure mode - return. If no keytab available - bail out with an exception
      Parameters:
        `conf` - conf to use
        `keytabFileKey` - the key to look for keytab file in conf
        `userNameKey` - the key to look for user's Kerberos principal name in conf
        `hostname` - hostname to use for substitution
      Throws:
        `IOException` - if the config doesn't specify a keytab

    - #### buildDTServiceName

          public static String buildDTServiceName(URI uri,
                                                  int defPort)

      create the service name for a Delegation token
      Parameters:
        `uri` - of the service
        `defPort` - is used if the uri lacks a port
      Returns:
        the token service, or null if no authority
      See Also:
        `buildTokenService(InetSocketAddress)`

    - #### getHostFromPrincipal

          public static String getHostFromPrincipal(String principalName)

      Get the host name from the principal name of format /host@realm.
      Parameters:
        `principalName` - principal name of format as described above
      Returns:
        host name if the the string conforms to the above format, else null

    - #### getKerberosInfo

          public static org.apache.hadoop.security.KerberosInfo getKerberosInfo(Class<?> protocol,
                                                                                Configuration conf)

      Look up the KerberosInfo for a given protocol. It searches all known SecurityInfo providers.
      Parameters:
        `protocol` - the protocol class to get the information for
        `conf` - configuration object
      Returns:
        the KerberosInfo or null if it has no KerberosInfo defined

    - #### getClientPrincipal

          public static String getClientPrincipal(Class<?> protocol,
                                                  Configuration conf)

      Look up the client principal for a given protocol. It searches all known SecurityInfo providers.
      Parameters:
        `protocol` - the protocol class to get the information for
        `conf` - configuration object
      Returns:
        client principal or null if it has no client principal defined.

    - #### getTokenInfo

          public static TokenInfo getTokenInfo(Class<?> protocol,
                                               Configuration conf)

      Look up the TokenInfo for a given protocol. It searches all known SecurityInfo providers.
      Parameters:
        `protocol` - The protocol class to get the information for.
        `conf` - Configuration object
      Returns:
        the TokenInfo or null if it has no KerberosInfo defined

    - #### getTokenServiceAddr

          public static InetSocketAddress getTokenServiceAddr(Token<?> token)

      Decode the given token's service field into an InetAddress
      Parameters:
        `token` - from which to obtain the service
      Returns:
        InetAddress for the service

    - #### setTokenService

          public static void setTokenService(Token<?> token,
                                             InetSocketAddress addr)

      Set the given token's service to the format expected by the RPC client
      Parameters:
        `token` - a delegation token
        `addr` - the socket for the rpc connection

    - #### buildTokenService

          public static Text buildTokenService(InetSocketAddress addr)

      Construct the service key for a token
      Parameters:
        `addr` - InetSocketAddress of remote connection with a token
      Returns:
        "ip:port" or "host:port" depending on the value of hadoop.security.token.service.use_ip

    - #### buildTokenService

          public static Text buildTokenService(URI uri)

      Construct the service key for a token
      Parameters:
        `uri` - of remote connection with a token
      Returns:
        "ip:port" or "host:port" depending on the value of hadoop.security.token.service.use_ip

    - #### doAsLoginUserOrFatal

          public static <T> T doAsLoginUserOrFatal(PrivilegedAction<T> action)

      Perform the given action as the daemon's login user. If the login user cannot be determined, this will log a FATAL error and exit the whole JVM.

    - #### doAsLoginUser

          public static <T> T doAsLoginUser(PrivilegedExceptionAction<T> action)
                                     throws IOException

      Perform the given action as the daemon's login user. If an InterruptedException is thrown, it is converted to an IOException.
      Parameters:
        `action` - the action to perform
      Returns:
        the result of the action
      Throws:
        `IOException` - in the event of error

    - #### doAsCurrentUser

          public static <T> T doAsCurrentUser(PrivilegedExceptionAction<T> action)
                                       throws IOException

      Perform the given action as the daemon's current user. If an InterruptedException is thrown, it is converted to an IOException.
      Parameters:
        `action` - the action to perform
      Returns:
        the result of the action
      Throws:
        `IOException` - in the event of error

    - #### getAuthenticationMethod

          public static UserGroupInformation.AuthenticationMethod getAuthenticationMethod(Configuration conf)

    - #### setAuthenticationMethod

          public static void setAuthenticationMethod(UserGroupInformation.AuthenticationMethod authenticationMethod,
                                                     Configuration conf)

    - #### isPrivilegedPort

          public static boolean isPrivilegedPort(int port)

    - #### getZKAuthInfos

          public static List<org.apache.hadoop.util.ZKUtil.ZKAuthInfo> getZKAuthInfos(Configuration conf,
                                                                                      String configKey)
                                                                               throws IOException

      Utility method to fetch ZK auth info from the configuration.
      Throws:
        `IOException` - if the Zookeeper ACLs configuration file cannot be read
        `ZKUtil.BadAuthFormatException` - if the auth format is invalid

Copyright © 2008–2022 Apache Software Foundation. All rights reserved.