KerberosChecker { public static void checkJaasConfiguration() throws AmbariException { if (config.isKerberosJaasConfigurationCheckEnabled()) { LOG.info("Checking Ambari Server Kerberos credentials."); String jaasConfPath = System.getProperty(JAVA_SECURITY_AUTH_LOGIN_CONFIG); javax.security.auth.login.Configuration jaasConf = javax.security.auth.login.Configuration.getConfiguration(); AppConfigurationEntry[] jaasConfEntries = jaasConf.getAppConfigurationEntry(HTTP_SPNEGO_STANDARD_ENTRY); if (jaasConfEntries == null) { LOG.warn("Can't find " + HTTP_SPNEGO_STANDARD_ENTRY + " entry in " + jaasConfPath); } else { boolean krb5LoginModulePresent = false; for (AppConfigurationEntry ace : jaasConfEntries) { if (KRB5_LOGIN_MODULE.equals(ace.getLoginModuleName())) { krb5LoginModulePresent = true; Map<String, ?> options = ace.getOptions(); if ((options != null)) { if (options.containsKey("keyTab")) { String keytabPath = (String) options.get("keyTab"); File keytabFile = new File(keytabPath); if (!keytabFile.exists()) { LOG.warn(keytabPath + " doesn't exist."); } else if (!keytabFile.canRead()) { LOG.warn("Unable to read " + keytabPath + " Please check the file access permissions for user " + System.getProperty("user.name")); } } else { LOG.warn("Can't find keyTab option in " + KRB5_LOGIN_MODULE + " module of " + HTTP_SPNEGO_STANDARD_ENTRY + " entry in " + jaasConfPath); } if (!options.containsKey("principal")) { LOG.warn("Can't find principal option in " + KRB5_LOGIN_MODULE + " module of " + HTTP_SPNEGO_STANDARD_ENTRY + " entry in " + jaasConfPath); } } } } if (!krb5LoginModulePresent) { LOG.warn("Can't find " + KRB5_LOGIN_MODULE + " module in " + HTTP_SPNEGO_STANDARD_ENTRY + " entry in " + jaasConfPath); } } try { LoginContext loginContext = loginContextHelper.createLoginContext(HTTP_SPNEGO_STANDARD_ENTRY); loginContext.login(); loginContext.logout(); } catch (LoginException le) { LOG.error(le.getMessage()); throw new AmbariException( "Ambari Server Kerberos credentials check failed. \n" + "Check KDC availability and JAAS configuration in " + jaasConfPath); } LOG.info("Ambari Server Kerberos credentials check passed."); } else { LOG.info("Skipping Ambari Server Kerberos credentials check."); } }  static void checkJaasConfiguration(); static final String JAVA_SECURITY_AUTH_LOGIN_CONFIG; }
@Test public void testCheckPassed() throws Exception { Configuration config = createMock(Configuration.class); LoginContextHelper loginContextHelper = createMock(LoginContextHelper.class); LoginContext lc = createMock(LoginContext.class); expect(config.isKerberosJaasConfigurationCheckEnabled()).andReturn(true).once(); expect(loginContextHelper.createLoginContext(KerberosChecker.HTTP_SPNEGO_STANDARD_ENTRY)).andReturn(lc).once(); lc.login(); expectLastCall().once(); lc.logout(); expectLastCall().once(); replayAll(); KerberosChecker.config = config; KerberosChecker.loginContextHelper = loginContextHelper; KerberosChecker.checkJaasConfiguration(); verifyAll(); }
@Test(expected = AmbariException.class) public void testCheckFailed() throws Exception { Configuration config = createMock(Configuration.class); LoginContextHelper loginContextHelper = createMock(LoginContextHelper.class); expect(config.isKerberosJaasConfigurationCheckEnabled()).andReturn(true).once(); expect(loginContextHelper.createLoginContext(KerberosChecker.HTTP_SPNEGO_STANDARD_ENTRY)).andThrow(new LoginException()).once(); replayAll(); KerberosChecker.config = config; KerberosChecker.loginContextHelper = loginContextHelper; KerberosChecker.checkJaasConfiguration(); verifyAll(); }