zuston commented on PR #53: URL: https://github.com/apache/incubator-uniffle/pull/53#issuecomment-1214760527
@colinmjj Thanks for your comment. The secured write/read only depends on the secured filesystem. And the secured filesystem can be initialized in HadoopFilesystemProvider. As I know, there is no need to wrap all the real action into the `doAs` method. Same operations from Oozie: https://github.com/apache/oozie/blob/f1e01a9e155692aa5632f4573ab1b3ebeab7ef45/core/src/main/java/org/apache/oozie/service/HadoopAccessorService.java#L638 Filesystem will be created like this: ```java public class HadoopFilesystemProvider { private static final Logger LOGGER = LoggerFactory.getLogger([HadoopFilesystemProvider.class](https://github.com/apache/incubator-uniffle/pull/HadoopFilesystemProvider.class)); public static FileSystem getFilesystem(String user, Path path, Configuration configuration) throws Exception { UserGroupInformation.AuthenticationMethod authenticationMethod = SecurityUtil.getAuthenticationMethod(configuration); boolean needSecurity = authenticationMethod != [UserGroupInformation.AuthenticationMethod.SIMPLE](https://github.com/apache/incubator-uniffle/pull/UserGroupInformation.AuthenticationMethod.SIMPLE); Callable<FileSystem> callable = () -> [FileSystem.get](https://github.com/apache/incubator-uniffle/pull/FileSystem.get)([path.toUri](https://github.com/apache/incubator-uniffle/pull/path.toUri)(), configuration); FileSystem fileSystem = null; if (needSecurity) { // this will return a secured filesystem, right? fileSystem = SecurityContextFactory .get() .getSecurityContext() .runSecured(user, callable); } else { fileSystem = [callable.call](https://github.com/apache/incubator-uniffle/pull/callable.call)(); } if (fileSystem instanceof LocalFileSystem) { [LOGGER.debug](https://github.com/apache/incubator-uniffle/pull/LOGGER.debug)("{} is local file system", path); return ((LocalFileSystem) fileSystem).getRawFileSystem(); } return fileSystem; } } ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
