TimelineAuthenticationFilterInitializer extends FilterInitializer { @Override public void initFilter(FilterContainer container, Configuration conf) { filterConfig = new HashMap<String, String>(); filterConfig.put(TimelineAuthenticationFilter.COOKIE_PATH, "/"); for (Map.Entry<String, String> entry : conf) { String name = entry.getKey(); if (name.startsWith(ProxyUsers.CONF_HADOOP_PROXYUSER)) { String value = conf.get(name); name = name.substring("hadoop.".length()); filterConfig.put(name, value); } } for (Map.Entry<String, String> entry : conf) { String name = entry.getKey(); if (name.startsWith(PREFIX)) { String value = conf.get(name); name = name.substring(PREFIX.length()); filterConfig.put(name, value); } } String signatureSecretFile = filterConfig.get(SIGNATURE_SECRET_FILE); if (signatureSecretFile != null) { Reader reader = null; try { StringBuilder secret = new StringBuilder(); reader = new FileReader(signatureSecretFile); int c = reader.read(); while (c > -1) { secret.append((char) c); c = reader.read(); } filterConfig .put(TimelineAuthenticationFilter.SIGNATURE_SECRET, secret.toString()); } catch (IOException ex) { throw new RuntimeException( "Could not read HTTP signature secret file: " + signatureSecretFile); } finally { IOUtils.closeStream(reader); } } String authType = filterConfig.get(AuthenticationFilter.AUTH_TYPE); if (authType.equals(PseudoAuthenticationHandler.TYPE)) { filterConfig.put(AuthenticationFilter.AUTH_TYPE, PseudoDelegationTokenAuthenticationHandler.class.getName()); } else if (authType.equals(KerberosAuthenticationHandler.TYPE)) { filterConfig.put(AuthenticationFilter.AUTH_TYPE, KerberosDelegationTokenAuthenticationHandler.class.getName()); String bindAddress = conf.get(HttpServer2.BIND_ADDRESS); String principal = filterConfig.get(KerberosAuthenticationHandler.PRINCIPAL); if (principal != null) { try { principal = SecurityUtil.getServerPrincipal(principal, bindAddress); } catch (IOException ex) { throw new RuntimeException( "Could not resolve Kerberos principal name: " + ex.toString(), ex); } filterConfig.put(KerberosAuthenticationHandler.PRINCIPAL, principal); } } filterConfig.put(DelegationTokenAuthenticationHandler.TOKEN_KIND, TimelineDelegationTokenIdentifier.KIND_NAME.toString()); container.addGlobalFilter("Timeline Authentication Filter", TimelineAuthenticationFilter.class.getName(), filterConfig); }  @Override void initFilter(FilterContainer container, Configuration conf); static final String PREFIX; }
@Test public void testProxyUserConfiguration() { FilterContainer container = Mockito.mock(FilterContainer.class); for (int i = 0; i < 3; ++i) { Configuration conf = new YarnConfiguration(); switch (i) { case 0: conf.set("hadoop.proxyuser.foo.hosts", "*"); conf.set("hadoop.proxyuser.foo.users", "*"); conf.set("hadoop.proxyuser.foo.groups", "*"); break; case 1: conf.set("yarn.timeline-service.http-authentication.proxyuser.foo.hosts", "*"); conf.set("yarn.timeline-service.http-authentication.proxyuser.foo.users", "*"); conf.set("yarn.timeline-service.http-authentication.proxyuser.foo.groups", "*"); break; case 2: conf.set("hadoop.proxyuser.foo.hosts", "bar"); conf.set("hadoop.proxyuser.foo.users", "bar"); conf.set("hadoop.proxyuser.foo.groups", "bar"); conf.set("yarn.timeline-service.http-authentication.proxyuser.foo.hosts", "*"); conf.set("yarn.timeline-service.http-authentication.proxyuser.foo.users", "*"); conf.set("yarn.timeline-service.http-authentication.proxyuser.foo.groups", "*"); break; default: break; } TimelineAuthenticationFilterInitializer initializer = new TimelineAuthenticationFilterInitializer(); initializer.initFilter(container, conf); Assert.assertEquals( "*", initializer.filterConfig.get("proxyuser.foo.hosts")); Assert.assertEquals( "*", initializer.filterConfig.get("proxyuser.foo.users")); Assert.assertEquals( "*", initializer.filterConfig.get("proxyuser.foo.groups")); } }