This is an automated email from the ASF dual-hosted git repository.
adoroszlai pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ozone.git
The following commit(s) were added to refs/heads/master by this push:
new d4d5ec65d5a HDDS-15913. Extract common Kerberos/MiniKDC setup from
serveral tests (#10873)
d4d5ec65d5a is described below
commit d4d5ec65d5ad1935e72795348f7d7b30126be6df
Author: Mark Tsai <[email protected]>
AuthorDate: Fri Sep 25 04:07:27 2026 +0800
HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests
(#10873)
---
.../hadoop/hdds/scm/TestSecretKeySnapshot.java | 104 ++---------
.../apache/hadoop/hdds/scm/TestSecretKeysApi.java | 113 ++----------
.../apache/hadoop/ozone/TestDelegationToken.java | 122 +++----------
.../hadoop/ozone/TestSecureOzoneCluster.java | 116 ++++---------
.../java/org/apache/ozone/test/KerberosTests.java | 191 +++++++++++++++++++++
5 files changed, 271 insertions(+), 375 deletions(-)
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/TestSecretKeySnapshot.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/TestSecretKeySnapshot.java
index bd379a8d86e..8b4fc88a956 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/TestSecretKeySnapshot.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/TestSecretKeySnapshot.java
@@ -17,60 +17,40 @@
package org.apache.hadoop.hdds.scm;
-import static
org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION;
import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_BLOCK_TOKEN_ENABLED;
-import static
org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY;
-import static
org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY;
import static
org.apache.hadoop.hdds.HddsConfigKeys.HDDS_SECRET_KEY_EXPIRY_DURATION;
import static
org.apache.hadoop.hdds.HddsConfigKeys.HDDS_SECRET_KEY_ROTATE_CHECK_DURATION;
import static
org.apache.hadoop.hdds.HddsConfigKeys.HDDS_SECRET_KEY_ROTATE_DURATION;
-import static
org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY;
-import static
org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_PRINCIPAL_KEY;
-import static
org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_CLIENT_ADDRESS_KEY;
-import static
org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY;
-import static
org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY;
-import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ADMINISTRATORS;
-import static
org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_KEY;
import static
org.apache.hadoop.ozone.om.OMConfigKeys.DELEGATION_REMOVER_SCAN_INTERVAL_KEY;
import static
org.apache.hadoop.ozone.om.OMConfigKeys.DELEGATION_TOKEN_MAX_LIFETIME_KEY;
-import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE;
-import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY;
-import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
-import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
-import static
org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod.KERBEROS;
import static org.assertj.core.api.Assertions.assertThat;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertTrue;
-import java.io.File;
import java.io.IOException;
import java.net.InetAddress;
import java.util.ArrayList;
import java.util.List;
-import java.util.Properties;
import java.util.concurrent.TimeoutException;
import org.apache.hadoop.hdds.client.RatisReplicationConfig;
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import org.apache.hadoop.hdds.protocol.proto.HddsProtos.ReplicationFactor;
import org.apache.hadoop.hdds.scm.container.ContainerInfo;
import org.apache.hadoop.hdds.scm.ha.SCMStateMachine;
-import org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig;
import org.apache.hadoop.hdds.scm.server.StorageContainerManager;
import org.apache.hadoop.hdds.security.symmetric.ManagedSecretKey;
import org.apache.hadoop.hdds.security.symmetric.SecretKeyManager;
import org.apache.hadoop.hdds.utils.IOUtils;
-import org.apache.hadoop.minikdc.MiniKdc;
import org.apache.hadoop.ozone.MiniOzoneCluster;
import org.apache.hadoop.ozone.MiniOzoneHAClusterImpl;
-import org.apache.hadoop.security.UserGroupInformation;
import org.apache.ozone.test.GenericTestUtils;
+import org.apache.ozone.test.KerberosTests;
import org.apache.ratis.util.ExitUtils;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -78,7 +58,7 @@
* Integration test to verify that symmetric secret keys are correctly
* synchronized from leader to follower during snapshot installation.
*/
-public final class TestSecretKeySnapshot {
+public class TestSecretKeySnapshot extends KerberosTests {
private static final Logger LOG = LoggerFactory
.getLogger(TestSecretKeySnapshot.class);
private static final long SNAPSHOT_THRESHOLD = 100;
@@ -87,24 +67,24 @@ public final class TestSecretKeySnapshot {
public static final int ROTATE_DURATION_MS = 30_000;
public static final int EXPIRY_DURATION_MS = 61_000;
- private MiniKdc miniKdc;
- private OzoneConfiguration conf;
- @TempDir
- private File workDir;
- private File ozoneKeytab;
- private File spnegoKeytab;
private MiniOzoneHAClusterImpl cluster;
+ @Override
+ protected void setSecureConfig() throws IOException {
+ configureSecurityBasics();
+ String host =
InetAddress.getLocalHost().getCanonicalHostName().toLowerCase();
+ String hostAndRealm = host + "@" + getRealm();
+ configureSharedServicePrincipal(hostAndRealm);
+ configureSpnegoPrincipal(hostAndRealm);
+ }
+
@BeforeEach
public void init() throws Exception {
- conf = new OzoneConfiguration();
- conf.set(OZONE_SCM_CLIENT_ADDRESS_KEY, "localhost");
-
ExitUtils.disableSystemExit();
- startMiniKdc();
- setSecureConfig();
- createCredentialsInKDC();
+ initKerberos();
+ OzoneConfiguration conf = getConf();
+ conf.setBoolean(HDDS_BLOCK_TOKEN_ENABLED, true);
conf.setBoolean(ScmConfigKeys.OZONE_SCM_HA_RAFT_LOG_PURGE_ENABLED, true);
conf.setInt(ScmConfigKeys.OZONE_SCM_HA_RAFT_LOG_PURGE_GAP, LOG_PURGE_GAP);
@@ -133,64 +113,10 @@ public void init() throws Exception {
@AfterEach
public void stop() {
- miniKdc.stop();
+ stopMiniKdc();
IOUtils.closeQuietly(cluster);
}
- private void createCredentialsInKDC() throws Exception {
- ScmConfig scmConfig = conf.getObject(ScmConfig.class);
- SCMHTTPServerConfig httpServerConfig =
- conf.getObject(SCMHTTPServerConfig.class);
- createPrincipal(ozoneKeytab, scmConfig.getKerberosPrincipal());
- createPrincipal(spnegoKeytab, httpServerConfig.getKerberosPrincipal());
- }
-
- private void createPrincipal(File keytab, String... principal)
- throws Exception {
- miniKdc.createPrincipal(keytab, principal);
- }
-
- private void startMiniKdc() throws Exception {
- Properties securityProperties = MiniKdc.createConf();
- miniKdc = new MiniKdc(securityProperties, workDir);
- miniKdc.start();
- }
-
- private void setSecureConfig() throws IOException {
- conf.setBoolean(OZONE_SECURITY_ENABLED_KEY, true);
- String host = InetAddress.getLocalHost().getCanonicalHostName()
- .toLowerCase();
-
- conf.set(HADOOP_SECURITY_AUTHENTICATION, KERBEROS.name());
-
- String curUser = UserGroupInformation.getCurrentUser().getUserName();
- conf.set(OZONE_ADMINISTRATORS, curUser);
-
- String realm = miniKdc.getRealm();
- String hostAndRealm = host + "@" + realm;
- conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, "scm/" + hostAndRealm);
- conf.set(HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_SCM/" + hostAndRealm);
- conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, "scm/" + hostAndRealm);
- conf.set(OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_OM/" + hostAndRealm);
- conf.set(HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY, "scm/" + hostAndRealm);
-
- ozoneKeytab = new File(workDir, "scm.keytab");
- spnegoKeytab = new File(workDir, "http.keytab");
-
- conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY,
- ozoneKeytab.getAbsolutePath());
- conf.set(HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY,
- spnegoKeytab.getAbsolutePath());
- conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY,
- ozoneKeytab.getAbsolutePath());
- conf.set(OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE,
- spnegoKeytab.getAbsolutePath());
- conf.set(HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY,
- ozoneKeytab.getAbsolutePath());
-
- conf.setBoolean(HDDS_BLOCK_TOKEN_ENABLED, true);
- }
-
@Test
public void testInstallSnapshot() throws Exception {
// Get the leader SCM
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/TestSecretKeysApi.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/TestSecretKeysApi.java
index 59021773bb1..d29ae72cea6 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/TestSecretKeysApi.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/hdds/scm/TestSecretKeysApi.java
@@ -17,28 +17,14 @@
package org.apache.hadoop.hdds.scm;
-import static
org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION;
import static
org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHORIZATION;
import static org.apache.hadoop.hdds.HddsConfigKeys.HDDS_BLOCK_TOKEN_ENABLED;
-import static
org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY;
-import static
org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY;
import static
org.apache.hadoop.hdds.HddsConfigKeys.HDDS_SECRET_KEY_EXPIRY_DURATION;
import static
org.apache.hadoop.hdds.HddsConfigKeys.HDDS_SECRET_KEY_ROTATE_CHECK_DURATION;
import static
org.apache.hadoop.hdds.HddsConfigKeys.HDDS_SECRET_KEY_ROTATE_DURATION;
-import static
org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY;
-import static
org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_PRINCIPAL_KEY;
-import static
org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_CLIENT_ADDRESS_KEY;
-import static
org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY;
-import static
org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY;
import static
org.apache.hadoop.hdds.utils.HddsServerUtil.getSecretKeyClientForDatanode;
-import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ADMINISTRATORS;
-import static
org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_KEY;
import static
org.apache.hadoop.ozone.om.OMConfigKeys.DELEGATION_REMOVER_SCAN_INTERVAL_KEY;
import static
org.apache.hadoop.ozone.om.OMConfigKeys.DELEGATION_TOKEN_MAX_LIFETIME_KEY;
-import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE;
-import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY;
-import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
-import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
import static
org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod.KERBEROS;
import static org.assertj.core.api.Assertions.assertThat;
import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -49,20 +35,16 @@
import jakarta.annotation.Nonnull;
import java.io.File;
import java.io.IOException;
-import java.net.InetAddress;
import java.util.List;
-import java.util.Properties;
import java.util.UUID;
import java.util.concurrent.TimeoutException;
import org.apache.hadoop.hdds.annotation.InterfaceAudience;
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import org.apache.hadoop.hdds.protocol.SecretKeyProtocol;
-import org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig;
import org.apache.hadoop.hdds.scm.server.StorageContainerManager;
import org.apache.hadoop.hdds.security.symmetric.ManagedSecretKey;
import org.apache.hadoop.hdds.utils.IOUtils;
import org.apache.hadoop.ipc_.RemoteException;
-import org.apache.hadoop.minikdc.MiniKdc;
import org.apache.hadoop.ozone.MiniOzoneCluster;
import org.apache.hadoop.ozone.MiniOzoneHAClusterImpl;
import org.apache.hadoop.ozone.om.OzoneManager;
@@ -70,12 +52,12 @@
import org.apache.hadoop.security.authorize.AuthorizationException;
import org.apache.hadoop.util.ExitUtil;
import org.apache.ozone.test.GenericTestUtils;
+import org.apache.ozone.test.KerberosTests;
import org.apache.ozone.test.tag.Flaky;
import org.apache.ratis.util.ExitUtils;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -84,96 +66,25 @@
*/
@InterfaceAudience.Private
-public final class TestSecretKeysApi {
+public class TestSecretKeysApi extends KerberosTests {
private static final Logger LOG = LoggerFactory
.getLogger(TestSecretKeysApi.class);
- private MiniKdc miniKdc;
- private OzoneConfiguration conf;
- @TempDir
- private File workDir;
- private File ozoneKeytab;
- private File spnegoKeytab;
- private File testUserKeytab;
- private String testUserPrincipal;
- private String ozonePrincipal;
private MiniOzoneHAClusterImpl cluster;
@BeforeEach
public void init() throws Exception {
- conf = new OzoneConfiguration();
- conf.set(OZONE_SCM_CLIENT_ADDRESS_KEY, "localhost");
-
ExitUtils.disableSystemExit();
ExitUtil.disableSystemExit();
- startMiniKdc();
- setSecureConfig();
- createCredentialsInKDC();
+ initKerberos();
}
@AfterEach
public void stop() {
- miniKdc.stop();
+ stopMiniKdc();
IOUtils.closeQuietly(cluster);
}
- private void createCredentialsInKDC() throws Exception {
- SCMHTTPServerConfig httpServerConfig =
- conf.getObject(SCMHTTPServerConfig.class);
- createPrincipal(ozoneKeytab, ozonePrincipal);
- createPrincipal(spnegoKeytab, httpServerConfig.getKerberosPrincipal());
- createPrincipal(testUserKeytab, testUserPrincipal);
- }
-
- private void createPrincipal(File keytab, String... principal)
- throws Exception {
- miniKdc.createPrincipal(keytab, principal);
- }
-
- private void startMiniKdc() throws Exception {
- Properties securityProperties = MiniKdc.createConf();
- miniKdc = new MiniKdc(securityProperties, workDir);
- miniKdc.start();
- }
-
- private void setSecureConfig() throws IOException {
- conf.setBoolean(OZONE_SECURITY_ENABLED_KEY, true);
- String host = InetAddress.getLocalHost().getCanonicalHostName()
- .toLowerCase();
-
- conf.set(HADOOP_SECURITY_AUTHENTICATION, KERBEROS.name());
-
- String curUser = UserGroupInformation.getCurrentUser().getUserName();
- conf.set(OZONE_ADMINISTRATORS, curUser);
-
- String realm = miniKdc.getRealm();
- String hostAndRealm = host + "@" + realm;
- ozonePrincipal = "scm/" + hostAndRealm;
- conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
- conf.set(HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_SCM/" + hostAndRealm);
- conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
- conf.set(OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_OM/" + hostAndRealm);
- conf.set(HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
-
- ozoneKeytab = new File(workDir, "scm.keytab");
- spnegoKeytab = new File(workDir, "http.keytab");
- testUserKeytab = new File(workDir, "testuser.keytab");
- testUserPrincipal = "test@" + realm;
-
- conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY,
- ozoneKeytab.getAbsolutePath());
- conf.set(HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY,
- spnegoKeytab.getAbsolutePath());
- conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY,
- ozoneKeytab.getAbsolutePath());
- conf.set(OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE,
- spnegoKeytab.getAbsolutePath());
- conf.set(HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY,
- ozoneKeytab.getAbsolutePath());
-
- conf.setBoolean(HADOOP_SECURITY_AUTHORIZATION, true);
- }
-
/**
* Test secret key apis in happy case.
*/
@@ -183,6 +94,7 @@ public void testSecretKeyApiSuccess() throws Exception {
enableBlockToken();
// set a low rotation period, of 1s, expiry is 3s, expect 3 active keys
// at any moment.
+ OzoneConfiguration conf = getConf();
conf.set(HDDS_SECRET_KEY_ROTATE_CHECK_DURATION, "100ms");
conf.set(HDDS_SECRET_KEY_ROTATE_DURATION, "1s");
conf.set(HDDS_SECRET_KEY_EXPIRY_DURATION, "3000ms");
@@ -258,6 +170,7 @@ public void testSecretKeyAfterSCMFailover() throws
Exception {
enableBlockToken();
// set a long duration period, so that no rotation happens during SCM
// leader change.
+ OzoneConfiguration conf = getConf();
conf.set(HDDS_SECRET_KEY_ROTATE_CHECK_DURATION, "10m");
conf.set(HDDS_SECRET_KEY_ROTATE_DURATION, "1d");
conf.set(HDDS_SECRET_KEY_EXPIRY_DURATION, "7d");
@@ -288,7 +201,7 @@ private void testSecretKeyAuthorization() throws Exception {
// is only available for Datanode and OM, any other authenticated user
// can't access the protocol.
SecretKeyProtocol secretKeyProtocol =
- getSecretKeyProtocol(testUserPrincipal, testUserKeytab);
+ getSecretKeyProtocol(getTestUserPrincipal(), getTestUserKeytab());
RemoteException ex =
assertThrows(RemoteException.class,
secretKeyProtocol::getCurrentSecretKey);
@@ -301,20 +214,20 @@ private void testSecretKeyAuthorization() throws
Exception {
@Test
public void testSecretKeyWithoutAuthorization() throws Exception {
enableBlockToken();
- conf.setBoolean(HADOOP_SECURITY_AUTHORIZATION, false);
+ getConf().setBoolean(HADOOP_SECURITY_AUTHORIZATION, false);
startCluster(1);
// When HADOOP_SECURITY_AUTHORIZATION is not enabled, any other
// authenticated user can access the protocol.
SecretKeyProtocol secretKeyProtocol =
- getSecretKeyProtocol(testUserPrincipal, testUserKeytab);
+ getSecretKeyProtocol(getTestUserPrincipal(), getTestUserKeytab());
assertNotNull(secretKeyProtocol.getCurrentSecretKey());
}
private void startCluster(int numSCMs)
throws IOException, TimeoutException, InterruptedException {
OzoneManager.setTestSecureOmFlag(true);
- MiniOzoneHAClusterImpl.Builder builder =
MiniOzoneCluster.newHABuilder(conf)
+ MiniOzoneHAClusterImpl.Builder builder =
MiniOzoneCluster.newHABuilder(getConf())
.setSCMServiceId("TestSecretKey")
.setNumOfStorageContainerManagers(numSCMs)
.setNumOfOzoneManagers(1);
@@ -325,7 +238,7 @@ private void startCluster(int numSCMs)
@Nonnull
private SecretKeyProtocol getSecretKeyProtocol() throws IOException {
- return getSecretKeyProtocol(ozonePrincipal, ozoneKeytab);
+ return getSecretKeyProtocol(getOzonePrincipal(), getOzoneKeytab());
}
@Nonnull
@@ -335,10 +248,10 @@ private SecretKeyProtocol getSecretKeyProtocol(
UserGroupInformation.loginUserFromKeytabAndReturnUGI(
user, keyTab.getCanonicalPath());
ugi.setAuthenticationMethod(KERBEROS);
- return getSecretKeyClientForDatanode(conf, ugi);
+ return getSecretKeyClientForDatanode(getConf(), ugi);
}
private void enableBlockToken() {
- conf.setBoolean(HDDS_BLOCK_TOKEN_ENABLED, true);
+ getConf().setBoolean(HDDS_BLOCK_TOKEN_ENABLED, true);
}
}
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestDelegationToken.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestDelegationToken.java
index 444b6c313fa..a2a3a22584a 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestDelegationToken.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestDelegationToken.java
@@ -17,58 +17,43 @@
package org.apache.hadoop.ozone;
-import static
org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION;
import static org.apache.hadoop.hdds.HddsConfigKeys.OZONE_METADATA_DIRS;
-import static
org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY;
-import static
org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_PRINCIPAL_KEY;
import static
org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_BLOCK_CLIENT_PORT_DEFAULT;
import static
org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_BLOCK_CLIENT_PORT_KEY;
-import static
org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_CLIENT_ADDRESS_KEY;
import static
org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_CLIENT_PORT_DEFAULT;
import static
org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_CLIENT_PORT_KEY;
import static
org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_DATANODE_PORT_DEFAULT;
import static
org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_DATANODE_PORT_KEY;
import static
org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_SECURITY_SERVICE_PORT_DEFAULT;
import static
org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_SECURITY_SERVICE_PORT_KEY;
-import static
org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY;
-import static
org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY;
import static org.apache.hadoop.net.ServerSocketUtil.getPort;
-import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ADMINISTRATORS;
-import static
org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_KEY;
import static
org.apache.hadoop.ozone.om.OMConfigKeys.DELEGATION_TOKEN_MAX_LIFETIME_KEY;
-import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE;
-import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY;
import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
import static
org.apache.hadoop.ozone.om.exceptions.OMException.ResultCodes.INVALID_AUTH_METHOD;
import static
org.apache.hadoop.ozone.om.exceptions.OMException.ResultCodes.TOKEN_ERROR_OTHER;
import static
org.apache.hadoop.ozone.om.exceptions.OMException.ResultCodes.TOKEN_EXPIRED;
import static
org.apache.hadoop.ozone.om.exceptions.OMException.ResultCodes.VOLUME_NOT_FOUND;
-import static
org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod.KERBEROS;
import static org.assertj.core.api.Assertions.assertThat;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.slf4j.event.Level.INFO;
-import java.io.File;
import java.io.IOException;
import java.net.InetAddress;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.security.KeyPair;
import java.security.PrivilegedExceptionAction;
-import java.util.Properties;
import java.util.UUID;
import java.util.stream.Stream;
import org.apache.commons.io.IOUtils;
import org.apache.commons.lang3.RandomStringUtils;
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import org.apache.hadoop.hdds.scm.HddsTestUtils;
-import org.apache.hadoop.hdds.scm.ScmConfig;
import org.apache.hadoop.hdds.scm.client.ScmTopologyClient;
import org.apache.hadoop.hdds.scm.ha.HASecurityUtils;
-import org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig;
import org.apache.hadoop.hdds.scm.server.SCMStorageConfig;
import org.apache.hadoop.hdds.scm.server.StorageContainerManager;
import org.apache.hadoop.hdds.security.SecurityConfig;
@@ -78,7 +63,6 @@
import org.apache.hadoop.io.Text;
import org.apache.hadoop.ipc_.Server;
import org.apache.hadoop.metrics2.lib.DefaultMetricsSystem;
-import org.apache.hadoop.minikdc.MiniKdc;
import org.apache.hadoop.ozone.om.OMStorage;
import org.apache.hadoop.ozone.om.OzoneManager;
import org.apache.hadoop.ozone.om.ScmBlockLocationTestingClient;
@@ -92,6 +76,7 @@
import org.apache.hadoop.security.token.Token;
import org.apache.ozone.test.GenericTestUtils;
import org.apache.ozone.test.GenericTestUtils.LogCapturer;
+import org.apache.ozone.test.KerberosTests;
import org.apache.ratis.util.ExitUtils;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeAll;
@@ -105,7 +90,7 @@
/**
* Test class to for security enabled Ozone cluster.
*/
-public final class TestDelegationToken {
+public class TestDelegationToken extends KerberosTests {
private static final String TEST_USER = "[email protected]";
private static final String COMPONENT = "test";
@@ -116,23 +101,23 @@ public final class TestDelegationToken {
@TempDir
private Path folder;
- @TempDir
- private File workDir;
-
- private MiniKdc miniKdc;
- private OzoneConfiguration conf;
- private File scmKeytab;
- private File spnegoKeytab;
- private File omKeyTab;
- private File testUserKeytab;
- private String testUserPrincipal;
+
private StorageContainerManager scm;
private OzoneManager om;
- private String host;
private String clusterId = UUID.randomUUID().toString();
private String scmId = UUID.randomUUID().toString();
private OzoneManagerProtocolClientSideTranslatorPB omClient;
+ @Override
+ protected void setSecureConfig() throws IOException {
+ configureSecurityBasics();
+ String host =
InetAddress.getLocalHost().getCanonicalHostName().toLowerCase();
+ String hostAndRealm = host + "@" + getRealm();
+ configureSeparateServicePrincipals(hostAndRealm);
+ configureSpnegoPrincipal(hostAndRealm);
+ createTestUserCredentials();
+ }
+
public static Stream<Boolean> options() {
return Stream.of(false, true);
}
@@ -145,8 +130,8 @@ public static void setup() {
@BeforeEach
public void init() {
try {
- conf = new OzoneConfiguration();
- conf.set(OZONE_SCM_CLIENT_ADDRESS_KEY, "localhost");
+ initKerberos();
+ OzoneConfiguration conf = getConf();
conf.setInt(OZONE_SCM_CLIENT_PORT_KEY,
getPort(OZONE_SCM_CLIENT_PORT_DEFAULT, 100));
@@ -161,12 +146,7 @@ public void init() {
final String path = folder.resolve("om-meta").toString();
Path metaDirPath = Paths.get(path, "om-meta");
conf.set(OZONE_METADATA_DIRS, metaDirPath.toString());
- conf.setBoolean(OZONE_SECURITY_ENABLED_KEY, true);
- conf.set(HADOOP_SECURITY_AUTHENTICATION, KERBEROS.name());
- startMiniKdc();
- setSecureConfig();
- createCredentialsInKDC();
generateKeyPair();
} catch (Exception e) {
LOG.error("Failed to initialize TestSecureOzoneCluster", e);
@@ -187,66 +167,8 @@ public void stop() {
}
}
- private void createCredentialsInKDC() throws Exception {
- ScmConfig scmConfig = conf.getObject(ScmConfig.class);
- SCMHTTPServerConfig httpServerConfig =
- conf.getObject(SCMHTTPServerConfig.class);
- createPrincipal(scmKeytab, scmConfig.getKerberosPrincipal());
- createPrincipal(spnegoKeytab, httpServerConfig.getKerberosPrincipal());
- createPrincipal(testUserKeytab, testUserPrincipal);
- createPrincipal(omKeyTab,
- conf.get(OZONE_OM_KERBEROS_PRINCIPAL_KEY));
- }
-
- private void createPrincipal(File keytab, String... principal)
- throws Exception {
- miniKdc.createPrincipal(keytab, principal);
- }
-
- private void startMiniKdc() throws Exception {
- Properties securityProperties = MiniKdc.createConf();
- miniKdc = new MiniKdc(securityProperties, workDir);
- miniKdc.start();
- }
-
- private void stopMiniKdc() {
- miniKdc.stop();
- }
-
- private void setSecureConfig() throws IOException {
- conf.setBoolean(OZONE_SECURITY_ENABLED_KEY, true);
- host = InetAddress.getLocalHost().getCanonicalHostName()
- .toLowerCase();
-
- conf.set(HADOOP_SECURITY_AUTHENTICATION, "kerberos");
-
- String curUser = UserGroupInformation.getCurrentUser().getUserName();
- conf.set(OZONE_ADMINISTRATORS, curUser);
-
- String realm = miniKdc.getRealm();
- String hostAndRealm = host + "@" + realm;
- conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, "scm/" + hostAndRealm);
- conf.set(HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_SCM/" + hostAndRealm);
- conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, "om/" + hostAndRealm);
- conf.set(OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_OM/" + hostAndRealm);
-
- scmKeytab = new File(workDir, "scm.keytab");
- spnegoKeytab = new File(workDir, "http.keytab");
- omKeyTab = new File(workDir, "om.keytab");
- testUserKeytab = new File(workDir, "testuser.keytab");
- testUserPrincipal = "test@" + realm;
-
- conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY,
- scmKeytab.getAbsolutePath());
- conf.set(HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY,
- spnegoKeytab.getAbsolutePath());
- conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY,
- omKeyTab.getAbsolutePath());
- conf.set(OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE,
- spnegoKeytab.getAbsolutePath());
- }
-
private void initSCM() throws IOException {
+ OzoneConfiguration conf = getConf();
SCMStorageConfig scmStore = new SCMStorageConfig(conf);
scmStore.setClusterId(clusterId);
scmStore.setScmId(scmId);
@@ -271,6 +193,7 @@ private void initSCM() throws IOException {
@ParameterizedTest
@MethodSource("options")
public void testDelegationToken(boolean useIp) throws Exception {
+ OzoneConfiguration conf = getConf();
initSCM();
scm = HddsTestUtils.getScmSimple(conf);
scm.start();
@@ -425,7 +348,7 @@ private void assertDelegationTokenRenewalFailures(
omClient.close();
UserGroupInformation.setLoginUser(ugi);
omClient = new OzoneManagerProtocolClientSideTranslatorPB(
- OmTransportFactory.create(conf, ugi, null),
+ OmTransportFactory.create(getConf(), ugi, null),
RandomStringUtils.secure().nextAscii(5));
Token<OzoneTokenIdentifier> seedToken =
omClient.getDelegationToken(new Text("om"));
@@ -469,7 +392,7 @@ private void assertDelegationTokenRenewalFailures(
}
private void generateKeyPair() throws Exception {
- SecurityConfig securityConfig = new SecurityConfig(conf);
+ SecurityConfig securityConfig = new SecurityConfig(getConf());
HDDSKeyGenerator keyGenerator = new HDDSKeyGenerator(securityConfig);
KeyPair keyPair = keyGenerator.generateKey();
KeyStorage keyStorage = new KeyStorage(securityConfig, COMPONENT);
@@ -484,10 +407,9 @@ private void setupOm(OzoneConfiguration config) throws
Exception {
omStore.initialize();
// OM uses scm/[email protected] to access SCM
- config.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY,
- "scm/" + host + "@" + miniKdc.getRealm());
- omKeyTab = new File(workDir, "scm.keytab");
- config.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY, omKeyTab.getAbsolutePath());
+ config.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, getOzonePrincipal());
+ config.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY,
+ getOzoneKeytab().getAbsolutePath());
OzoneManager.setTestSecureOmFlag(true);
om = OzoneManager.createOm(config);
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestSecureOzoneCluster.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestSecureOzoneCluster.java
index e6178ee380c..5561e13a062 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestSecureOzoneCluster.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestSecureOzoneCluster.java
@@ -35,18 +35,13 @@
import static org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_GRPC_PORT_KEY;
import static
org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_RATIS_PORT_KEY;
import static
org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_SECURITY_SERVICE_PORT_KEY;
-import static
org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY;
-import static
org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY;
import static
org.apache.hadoop.hdds.security.x509.exception.CertificateException.ErrorCode.ROLLBACK_ERROR;
import static org.apache.hadoop.hdds.utils.HddsServerUtil.getScmSecurityClient;
import static
org.apache.hadoop.hdds.utils.HddsServerUtil.getValidInetsForCurrentHost;
-import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ADMINISTRATORS;
import static
org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_CLIENT_FAILOVER_MAX_ATTEMPTS_KEY;
import static
org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_KEY;
import static org.apache.hadoop.ozone.OzoneConsts.SCM_SUB_CA;
import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_ADDRESS_KEY;
-import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE;
-import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY;
import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_S3_GPRC_SERVER_ENABLED;
@@ -83,7 +78,6 @@
import java.util.ArrayList;
import java.util.Date;
import java.util.List;
-import java.util.Properties;
import java.util.UUID;
import java.util.concurrent.Callable;
import java.util.concurrent.TimeUnit;
@@ -124,7 +118,6 @@
import org.apache.hadoop.io.Text;
import org.apache.hadoop.ipc_.Client;
import org.apache.hadoop.metrics2.lib.DefaultMetricsSystem;
-import org.apache.hadoop.minikdc.MiniKdc;
import org.apache.hadoop.ozone.client.OzoneClient;
import org.apache.hadoop.ozone.client.OzoneClientFactory;
import org.apache.hadoop.ozone.common.Storage;
@@ -153,6 +146,7 @@
import org.apache.hadoop.util.ExitUtil;
import org.apache.ozone.test.GenericTestUtils;
import org.apache.ozone.test.GenericTestUtils.LogCapturer;
+import org.apache.ozone.test.KerberosTests;
import org.apache.ozone.test.tag.Flaky;
import org.apache.ozone.test.tag.Unhealthy;
import org.apache.ratis.protocol.ClientId;
@@ -162,6 +156,7 @@
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestInstance;
import org.junit.jupiter.api.io.TempDir;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -169,7 +164,8 @@
/**
* Test class to for security enabled Ozone cluster.
*/
-final class TestSecureOzoneCluster {
+@TestInstance(TestInstance.Lifecycle.PER_CLASS)
+class TestSecureOzoneCluster extends KerberosTests {
private static final String COMPONENT = "om";
private static final String OM_CERT_SERIAL_ID = "9879877970576";
@@ -179,18 +175,6 @@ final class TestSecureOzoneCluster {
private static final int CERT_GRACE_TIME_MS = 10 * 1000; // 10s
private static final int DELEGATION_TOKEN_MAX_TIME_MS = 9 * 1000; // 9s
- @TempDir
- private static File workDir;
- private static MiniKdc miniKdc;
- private static OzoneConfiguration kdcConf;
- private static File scmKeytab;
- private static File spnegoKeytab;
- private static File omKeytab;
- private static File testUserKeytab;
- private static String testUserPrincipal;
- private static String host;
- private static String realm;
-
@TempDir
private File tempDir;
private OzoneConfiguration conf;
@@ -205,33 +189,32 @@ final class TestSecureOzoneCluster {
private KeyPair keyPair;
private Path omMetaDirPath;
+ @Override
+ protected void setSecureConfig() throws IOException {
+ configureSecurityBasics();
+ String host =
InetAddress.getLocalHost().getCanonicalHostName().toLowerCase();
+ String hostAndRealm = host + "@" + getRealm();
+ configureSeparateServicePrincipals(hostAndRealm);
+ configureSpnegoPrincipal(hostAndRealm);
+ createTestUserCredentials();
+ }
+
@BeforeAll
- static void setupKdc() throws Exception {
+ void setupKdc() throws Exception {
ExitUtils.disableSystemExit();
DefaultMetricsSystem.setMiniClusterMode(true);
- host = InetAddress.getLocalHost().getCanonicalHostName().toLowerCase();
- startMiniKdc();
- realm = miniKdc.getRealm();
- testUserPrincipal = "test@" + realm;
- scmKeytab = new File(workDir, "scm.keytab");
- spnegoKeytab = new File(workDir, "http.keytab");
- omKeytab = new File(workDir, "om.keytab");
- testUserKeytab = new File(workDir, "testuser.keytab");
- kdcConf = new OzoneConfiguration();
- setSecureConfig(kdcConf);
- createCredentialsInKDC(kdcConf);
+ initKerberos();
}
@AfterAll
- static void tearDownKdc() {
+ void tearDownKdc() {
stopMiniKdc();
}
@BeforeEach
void init() {
try {
- conf = new OzoneConfiguration(kdcConf);
- conf.set(OZONE_SCM_CLIENT_ADDRESS_KEY, "localhost");
+ conf = new OzoneConfiguration(getConf());
conf.setInt(OZONE_SCM_CLIENT_PORT_KEY, getFreePort());
conf.setInt(OZONE_SCM_DATANODE_PORT_KEY, getFreePort());
@@ -280,52 +263,12 @@ void stop() throws Exception {
} finally {
IOUtils.closeQuietly(om);
IOUtils.closeQuietly(omClient);
+ scm = null;
+ om = null;
+ omClient = null;
}
}
- private static void createCredentialsInKDC(OzoneConfiguration conf) throws
Exception {
- createPrincipal(scmKeytab, conf.get(HDDS_SCM_KERBEROS_PRINCIPAL_KEY));
- createPrincipal(spnegoKeytab,
conf.get(HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY));
- createPrincipal(omKeytab, conf.get(OZONE_OM_KERBEROS_PRINCIPAL_KEY));
- createPrincipal(testUserKeytab, testUserPrincipal);
- }
-
- private static void createPrincipal(File keytab, String... principal)
- throws Exception {
- miniKdc.createPrincipal(keytab, principal);
- }
-
- private static void startMiniKdc() throws Exception {
- Properties securityProperties = MiniKdc.createConf();
- miniKdc = new MiniKdc(securityProperties, workDir);
- miniKdc.start();
- }
-
- private static void stopMiniKdc() {
- if (miniKdc != null) {
- miniKdc.stop();
- }
- }
-
- private static void setSecureConfig(OzoneConfiguration conf) throws
IOException {
- conf.setBoolean(OZONE_SECURITY_ENABLED_KEY, true);
- conf.set(HADOOP_SECURITY_AUTHENTICATION, "kerberos");
-
- String curUser = UserGroupInformation.getCurrentUser().getUserName();
- conf.set(OZONE_ADMINISTRATORS, curUser);
-
- String hostAndRealm = host + "@" + realm;
- conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, "scm/" + hostAndRealm);
- conf.set(HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_SCM/" + hostAndRealm);
- conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, "om/" + hostAndRealm);
- conf.set(OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_OM/" + hostAndRealm);
-
- conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY, scmKeytab.getAbsolutePath());
- conf.set(HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY,
spnegoKeytab.getAbsolutePath());
- conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY, omKeytab.getAbsolutePath());
- conf.set(OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE,
spnegoKeytab.getAbsolutePath());
- }
-
/**
* Exercises a secure SCM and OM sharing a single SCM instance to avoid
paying
* the SCM startup cost twice. Covers SCM startup and cert trust chain, SCM
@@ -366,7 +309,7 @@ private void assertScmExposesClusterInfoAndTrustChain()
throws IOException {
private void assertScmSecurityProtocolAllowsKerberosUser() throws Exception {
UserGroupInformation ugi =
UserGroupInformation.loginUserFromKeytabAndReturnUGI(
- testUserPrincipal, testUserKeytab.getCanonicalPath());
+ getTestUserPrincipal(), getTestUserKeytab().getCanonicalPath());
ugi.setAuthenticationMethod(KERBEROS);
try (SCMSecurityProtocolClientSideTranslatorPB securityClient =
getScmSecurityClient(conf, ugi)) {
@@ -402,7 +345,7 @@ private void
assertScmSecurityProtocolRejectsNonKerberosUser() throws Exception
/** SCM admin protocol - authenticated non-admin user is denied. */
private void assertScmAdminProtocolDeniesNonAdminUser() throws IOException {
UserGroupInformation ugi =
UserGroupInformation.loginUserFromKeytabAndReturnUGI(
- testUserPrincipal, testUserKeytab.getCanonicalPath());
+ getTestUserPrincipal(), getTestUserKeytab().getCanonicalPath());
StorageContainerLocationProtocol scmRpcClient =
HAUtils.getScmContainerClient(conf, ugi);
IOException adminException = assertThrows(IOException.class,
@@ -473,7 +416,8 @@ private void
assertSecureOmInitFailsWithNonExistentPrincipal() {
*/
private void assertSecureOmInitWhenAlreadyInitialized() throws Exception {
conf.set(HADOOP_SECURITY_AUTHENTICATION, "kerberos");
- conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, "om/" + host + "@" + realm);
+ conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY,
+ getConf().get(OZONE_OM_KERBEROS_PRINCIPAL_KEY));
conf.set(OZONE_OM_ADDRESS_KEY,
InetAddress.getLocalHost().getCanonicalHostName() + ":" +
getFreePort());
LogCapturer omLogs = LogCapturer.captureLogs(OMCertificateClient.class);
@@ -533,9 +477,9 @@ private void initSCM() throws IOException {
*
*/
conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY,
- "om/" + host + "@" + miniKdc.getRealm());
- File keyTab = new File(workDir, "om.keytab");
- conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY, keyTab.getAbsolutePath());
+ conf.get(OZONE_OM_KERBEROS_PRINCIPAL_KEY));
+ conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY,
+ conf.get(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY));
}
@Test
@@ -595,7 +539,7 @@ void testAccessControlExceptionOnClient() throws Exception {
// positive case (happy-path)
UserGroupInformation ugi =
UserGroupInformation.loginUserFromKeytabAndReturnUGI(
- testUserPrincipal, testUserKeytab.getCanonicalPath());
+ getTestUserPrincipal(), getTestUserKeytab().getCanonicalPath());
ugi.setAuthenticationMethod(KERBEROS);
OzoneManagerProtocolClientSideTranslatorPB secureClient =
new OzoneManagerProtocolClientSideTranslatorPB(
@@ -724,7 +668,7 @@ void testGetSetRevokeS3Secret() throws Exception {
// testUser is not an admin
final UserGroupInformation ugiNonAdmin =
UserGroupInformation.loginUserFromKeytabAndReturnUGI(
- testUserPrincipal, testUserKeytab.getCanonicalPath());
+ getTestUserPrincipal(), getTestUserKeytab().getCanonicalPath());
final OzoneManagerProtocolClientSideTranslatorPB omClientNonAdmin =
new OzoneManagerProtocolClientSideTranslatorPB(
OmTransportFactory.create(conf, ugiNonAdmin, null),
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/ozone/test/KerberosTests.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/ozone/test/KerberosTests.java
new file mode 100644
index 00000000000..a58f495369a
--- /dev/null
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/ozone/test/KerberosTests.java
@@ -0,0 +1,191 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ozone.test;
+
+import static
org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHENTICATION;
+import static
org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_AUTHORIZATION;
+import static
org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY;
+import static
org.apache.hadoop.hdds.HddsConfigKeys.HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY;
+import static
org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY;
+import static
org.apache.hadoop.hdds.scm.ScmConfig.ConfigStrings.HDDS_SCM_KERBEROS_PRINCIPAL_KEY;
+import static
org.apache.hadoop.hdds.scm.ScmConfigKeys.OZONE_SCM_CLIENT_ADDRESS_KEY;
+import static
org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY;
+import static
org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig.ConfigStrings.HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ADMINISTRATORS;
+import static
org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_KEY;
+import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE;
+import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY;
+import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
+import static
org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
+import static
org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod.KERBEROS;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.InetAddress;
+import java.nio.file.Files;
+import java.util.Properties;
+import org.apache.commons.io.FileUtils;
+import org.apache.hadoop.hdds.conf.OzoneConfiguration;
+import org.apache.hadoop.hdds.scm.server.SCMHTTPServerConfig;
+import org.apache.hadoop.minikdc.MiniKdc;
+import org.apache.hadoop.security.UserGroupInformation;
+
+/**
+ * Shared MiniKdc / Kerberos setup for secure cluster integration tests
(HDDS-15913).
+ */
+public abstract class KerberosTests {
+
+ private MiniKdc miniKdc;
+ private final OzoneConfiguration conf = new OzoneConfiguration();
+
+ private File workDir;
+
+ /** Service keytab (scm.keytab); shared by SCM/OM/DN when using {@link
#configureSharedServicePrincipal}. */
+ private File ozoneKeytab;
+ private File spnegoKeytab;
+ private File testUserKeytab;
+ private String testUserPrincipal;
+ /** e.g. scm/host@REALM. */
+ private String ozonePrincipal;
+
+ /** Separate OM keytab, only used with {@link
#configureSeparateServicePrincipals}. */
+ private File omKeytab;
+
+ protected OzoneConfiguration getConf() {
+ return conf;
+ }
+
+ protected File getOzoneKeytab() {
+ return ozoneKeytab;
+ }
+
+ protected String getOzonePrincipal() {
+ return ozonePrincipal;
+ }
+
+ protected File getTestUserKeytab() {
+ return testUserKeytab;
+ }
+
+ protected String getTestUserPrincipal() {
+ return testUserPrincipal;
+ }
+
+ protected void initKerberos() throws Exception {
+ startMiniKdc();
+ setSecureConfig();
+ createCredentialsInKDC();
+ }
+
+ protected void startMiniKdc() throws Exception {
+ if (workDir == null) {
+ workDir = Files.createTempDirectory("kerberos").toFile();
+ }
+ Properties securityProperties = MiniKdc.createConf();
+ miniKdc = new MiniKdc(securityProperties, workDir);
+ miniKdc.start();
+ }
+
+ protected void stopMiniKdc() {
+ if (miniKdc != null) {
+ miniKdc.stop();
+ }
+ FileUtils.deleteQuietly(workDir);
+ }
+
+ protected void createPrincipal(File keytab, String... principal)
+ throws Exception {
+ miniKdc.createPrincipal(keytab, principal);
+ }
+
+ protected void setSecureConfig() throws IOException {
+ configureSecurityBasics();
+ String host = InetAddress.getLocalHost().getCanonicalHostName()
+ .toLowerCase();
+ String hostAndRealm = host + "@" + getRealm();
+ configureSharedServicePrincipal(hostAndRealm);
+ configureSpnegoPrincipal(hostAndRealm);
+ createTestUserCredentials();
+ conf.setBoolean(HADOOP_SECURITY_AUTHORIZATION, true);
+ }
+
+ /** Mints the principals for whichever keytabs {@link #setSecureConfig()}
configured. */
+ protected void createCredentialsInKDC() throws Exception {
+ createPrincipal(ozoneKeytab, conf.get(HDDS_SCM_KERBEROS_PRINCIPAL_KEY));
+ if (omKeytab != null) {
+ createPrincipal(omKeytab, conf.get(OZONE_OM_KERBEROS_PRINCIPAL_KEY));
+ }
+ SCMHTTPServerConfig httpServerConfig =
conf.getObject(SCMHTTPServerConfig.class);
+ createPrincipal(spnegoKeytab, httpServerConfig.getKerberosPrincipal());
+ if (testUserKeytab != null) {
+ createPrincipal(testUserKeytab, testUserPrincipal);
+ }
+ }
+
+ protected String getRealm() {
+ return miniKdc.getRealm();
+ }
+
+ /** Security basics common to every subclass's setSecureConfig(). */
+ protected void configureSecurityBasics() throws IOException {
+ conf.setBoolean(OZONE_SECURITY_ENABLED_KEY, true);
+ conf.set(OZONE_SCM_CLIENT_ADDRESS_KEY, "localhost");
+ conf.set(HADOOP_SECURITY_AUTHENTICATION, KERBEROS.name());
+ String curUser = UserGroupInformation.getCurrentUser().getUserName();
+ conf.set(OZONE_ADMINISTRATORS, curUser);
+ }
+
+ /** SCM/OM/DN share a single "scm/..." principal and keytab. */
+ protected void configureSharedServicePrincipal(String hostAndRealm) {
+ ozonePrincipal = "scm/" + hostAndRealm;
+ ozoneKeytab = new File(workDir, "scm.keytab");
+ conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ conf.set(HDDS_DATANODE_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_DATANODE_KERBEROS_KEYTAB_FILE_KEY,
+ ozoneKeytab.getAbsolutePath());
+ }
+
+ /** SCM and OM use separate "scm/..." and "om/..." principals and keytabs. */
+ protected void configureSeparateServicePrincipals(String hostAndRealm) {
+ ozonePrincipal = "scm/" + hostAndRealm;
+ ozoneKeytab = new File(workDir, "scm.keytab");
+ conf.set(HDDS_SCM_KERBEROS_PRINCIPAL_KEY, ozonePrincipal);
+ conf.set(HDDS_SCM_KERBEROS_KEYTAB_FILE_KEY, ozoneKeytab.getAbsolutePath());
+ omKeytab = new File(workDir, "om.keytab");
+ conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY, "om/" + hostAndRealm);
+ conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY, omKeytab.getAbsolutePath());
+ }
+
+ protected void configureSpnegoPrincipal(String hostAndRealm) {
+ spnegoKeytab = new File(workDir, "http.keytab");
+ conf.set(HDDS_SCM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_SCM/" + hostAndRealm);
+ conf.set(OZONE_OM_HTTP_KERBEROS_PRINCIPAL_KEY, "HTTP_OM/" + hostAndRealm);
+ conf.set(HDDS_SCM_HTTP_KERBEROS_KEYTAB_FILE_KEY,
+ spnegoKeytab.getAbsolutePath());
+ conf.set(OZONE_OM_HTTP_KERBEROS_KEYTAB_FILE,
+ spnegoKeytab.getAbsolutePath());
+ }
+
+ protected void createTestUserCredentials() {
+ testUserKeytab = new File(workDir, "testuser.keytab");
+ testUserPrincipal = "test@" + getRealm();
+ }
+}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
