@Test(timeout = 50000) public void testFilterOverrides() throws Exception { String filterInitializerConfKey = "hadoop.http.filter.initializers"; String[] filterInitializers = { AuthenticationFilterInitializer.class.getName(), RMAuthenticationFilterInitializer.class.getName(), AuthenticationFilterInitializer.class.getName() + "," + RMAuthenticationFilterInitializer.class.getName(), AuthenticationFilterInitializer.class.getName() + ", " + RMAuthenticationFilterInitializer.class.getName(), AuthenticationFilterInitializer.class.getName() + ", " + this.getClass().getName() }; for (String filterInitializer : filterInitializers) { resourceManager = new ResourceManager() { @Override protected void doSecureLogin() throws IOException { } }; Configuration conf = new YarnConfiguration(); conf.set(filterInitializerConfKey, filterInitializer); conf.set("hadoop.security.authentication", "kerberos"); conf.set("hadoop.http.authentication.type", "kerberos"); try { try { UserGroupInformation.setConfiguration(conf); } catch (Exception e) { LOG.info("Got expected exception"); } resourceManager.init(conf); resourceManager.startWepApp(); } catch (RuntimeException e) { String tmp = resourceManager.getConfig().get(filterInitializerConfKey); if (filterInitializer.contains(this.getClass().getName())) { Assert.assertEquals(RMAuthenticationFilterInitializer.class.getName() + "," + this.getClass().getName(), tmp); } else { Assert.assertEquals( RMAuthenticationFilterInitializer.class.getName(), tmp); } resourceManager.stop(); } } String[] simpleFilterInitializers = { "", StaticUserWebFilter.class.getName() }; for (String filterInitializer : simpleFilterInitializers) { resourceManager = new ResourceManager(); Configuration conf = new YarnConfiguration(); conf.set(filterInitializerConfKey, filterInitializer); try { UserGroupInformation.setConfiguration(conf); resourceManager.init(conf); resourceManager.startWepApp(); } catch (RuntimeException e) { String tmp = resourceManager.getConfig().get(filterInitializerConfKey); if (filterInitializer.equals(StaticUserWebFilter.class.getName())) { Assert.assertEquals(RMAuthenticationFilterInitializer.class.getName() + "," + StaticUserWebFilter.class.getName(), tmp); } else { Assert.assertEquals( RMAuthenticationFilterInitializer.class.getName(), tmp); } resourceManager.stop(); } } }
protected void startWepApp() { Configuration conf = getConfig(); boolean useYarnAuthenticationFilter = conf.getBoolean( YarnConfiguration.RM_WEBAPP_DELEGATION_TOKEN_AUTH_FILTER, YarnConfiguration.DEFAULT_RM_WEBAPP_DELEGATION_TOKEN_AUTH_FILTER); String authPrefix = "hadoop.http.authentication."; String authTypeKey = authPrefix + "type"; String filterInitializerConfKey = "hadoop.http.filter.initializers"; String actualInitializers = ""; Class<?>[] initializersClasses = conf.getClasses(filterInitializerConfKey); boolean hasHadoopAuthFilterInitializer = false; boolean hasRMAuthFilterInitializer = false; if (initializersClasses != null) { for (Class<?> initializer : initializersClasses) { if (initializer.getName().equals( AuthenticationFilterInitializer.class.getName())) { hasHadoopAuthFilterInitializer = true; } if (initializer.getName().equals( RMAuthenticationFilterInitializer.class.getName())) { hasRMAuthFilterInitializer = true; } } if (UserGroupInformation.isSecurityEnabled() && useYarnAuthenticationFilter && hasHadoopAuthFilterInitializer && conf.get(authTypeKey, "").equals( KerberosAuthenticationHandler.TYPE)) { ArrayList<String> target = new ArrayList<String>(); for (Class<?> filterInitializer : initializersClasses) { if (filterInitializer.getName().equals( AuthenticationFilterInitializer.class.getName())) { if (hasRMAuthFilterInitializer == false) { target.add(RMAuthenticationFilterInitializer.class.getName()); } continue; } target.add(filterInitializer.getName()); } actualInitializers = StringUtils.join(",", target); LOG.info("Using RM authentication filter(kerberos/delegation-token)" + " for RM webapp authentication"); RMAuthenticationHandler .setSecretManager(getClientRMService().rmDTSecretManager); RMAuthenticationFilter .setDelegationTokenSecretManager(getClientRMService().rmDTSecretManager); String yarnAuthKey = authPrefix + RMAuthenticationFilter.AUTH_HANDLER_PROPERTY; conf.setStrings(yarnAuthKey, RMAuthenticationHandler.class.getName()); conf.set(filterInitializerConfKey, actualInitializers); } } String initializers = conf.get(filterInitializerConfKey); if (!UserGroupInformation.isSecurityEnabled()) { if (initializersClasses == null || initializersClasses.length == 0) { conf.set(filterInitializerConfKey, RMAuthenticationFilterInitializer.class.getName()); conf.set(authTypeKey, "simple"); } else if (initializers.equals(StaticUserWebFilter.class.getName())) { conf.set(filterInitializerConfKey, RMAuthenticationFilterInitializer.class.getName() + "," + initializers); conf.set(authTypeKey, "simple"); } } Builder<ApplicationMasterService> builder = WebApps .$for("cluster", ApplicationMasterService.class, masterService, "ws") .with(conf) .withHttpSpnegoPrincipalKey( YarnConfiguration.RM_WEBAPP_SPNEGO_USER_NAME_KEY) .withHttpSpnegoKeytabKey( YarnConfiguration.RM_WEBAPP_SPNEGO_KEYTAB_FILE_KEY) .at(webAppAddress); String proxyHostAndPort = WebAppUtils.getProxyHostAndPort(conf); if(WebAppUtils.getResolvedRMWebAppURLWithoutScheme(conf). equals(proxyHostAndPort)) { if (HAUtil.isHAEnabled(conf)) { fetcher = new AppReportFetcher(conf); } else { fetcher = new AppReportFetcher(conf, getClientRMService()); } builder.withServlet(ProxyUriUtils.PROXY_SERVLET_NAME, ProxyUriUtils.PROXY_PATH_SPEC, WebAppProxyServlet.class); builder.withAttribute(WebAppProxy.FETCHER_ATTRIBUTE, fetcher); String[] proxyParts = proxyHostAndPort.split(":"); builder.withAttribute(WebAppProxy.PROXY_HOST_ATTRIBUTE, proxyParts[0]); } webApp = builder.start(new RMWebApp(this)); }
ResourceManager extends CompositeService implements Recoverable { protected void startWepApp() { Configuration conf = getConfig(); boolean useYarnAuthenticationFilter = conf.getBoolean( YarnConfiguration.RM_WEBAPP_DELEGATION_TOKEN_AUTH_FILTER, YarnConfiguration.DEFAULT_RM_WEBAPP_DELEGATION_TOKEN_AUTH_FILTER); String authPrefix = "hadoop.http.authentication."; String authTypeKey = authPrefix + "type"; String filterInitializerConfKey = "hadoop.http.filter.initializers"; String actualInitializers = ""; Class<?>[] initializersClasses = conf.getClasses(filterInitializerConfKey); boolean hasHadoopAuthFilterInitializer = false; boolean hasRMAuthFilterInitializer = false; if (initializersClasses != null) { for (Class<?> initializer : initializersClasses) { if (initializer.getName().equals( AuthenticationFilterInitializer.class.getName())) { hasHadoopAuthFilterInitializer = true; } if (initializer.getName().equals( RMAuthenticationFilterInitializer.class.getName())) { hasRMAuthFilterInitializer = true; } } if (UserGroupInformation.isSecurityEnabled() && useYarnAuthenticationFilter && hasHadoopAuthFilterInitializer && conf.get(authTypeKey, "").equals( KerberosAuthenticationHandler.TYPE)) { ArrayList<String> target = new ArrayList<String>(); for (Class<?> filterInitializer : initializersClasses) { if (filterInitializer.getName().equals( AuthenticationFilterInitializer.class.getName())) { if (hasRMAuthFilterInitializer == false) { target.add(RMAuthenticationFilterInitializer.class.getName()); } continue; } target.add(filterInitializer.getName()); } actualInitializers = StringUtils.join(",", target); LOG.info("Using RM authentication filter(kerberos/delegation-token)" + " for RM webapp authentication"); RMAuthenticationHandler .setSecretManager(getClientRMService().rmDTSecretManager); RMAuthenticationFilter .setDelegationTokenSecretManager(getClientRMService().rmDTSecretManager); String yarnAuthKey = authPrefix + RMAuthenticationFilter.AUTH_HANDLER_PROPERTY; conf.setStrings(yarnAuthKey, RMAuthenticationHandler.class.getName()); conf.set(filterInitializerConfKey, actualInitializers); } } String initializers = conf.get(filterInitializerConfKey); if (!UserGroupInformation.isSecurityEnabled()) { if (initializersClasses == null || initializersClasses.length == 0) { conf.set(filterInitializerConfKey, RMAuthenticationFilterInitializer.class.getName()); conf.set(authTypeKey, "simple"); } else if (initializers.equals(StaticUserWebFilter.class.getName())) { conf.set(filterInitializerConfKey, RMAuthenticationFilterInitializer.class.getName() + "," + initializers); conf.set(authTypeKey, "simple"); } } Builder<ApplicationMasterService> builder = WebApps .$for("cluster", ApplicationMasterService.class, masterService, "ws") .with(conf) .withHttpSpnegoPrincipalKey( YarnConfiguration.RM_WEBAPP_SPNEGO_USER_NAME_KEY) .withHttpSpnegoKeytabKey( YarnConfiguration.RM_WEBAPP_SPNEGO_KEYTAB_FILE_KEY) .at(webAppAddress); String proxyHostAndPort = WebAppUtils.getProxyHostAndPort(conf); if(WebAppUtils.getResolvedRMWebAppURLWithoutScheme(conf). equals(proxyHostAndPort)) { if (HAUtil.isHAEnabled(conf)) { fetcher = new AppReportFetcher(conf); } else { fetcher = new AppReportFetcher(conf, getClientRMService()); } builder.withServlet(ProxyUriUtils.PROXY_SERVLET_NAME, ProxyUriUtils.PROXY_PATH_SPEC, WebAppProxyServlet.class); builder.withAttribute(WebAppProxy.FETCHER_ATTRIBUTE, fetcher); String[] proxyParts = proxyHostAndPort.split(":"); builder.withAttribute(WebAppProxy.PROXY_HOST_ATTRIBUTE, proxyParts[0]); } webApp = builder.start(new RMWebApp(this)); } }
ResourceManager extends CompositeService implements Recoverable { protected void startWepApp() { Configuration conf = getConfig(); boolean useYarnAuthenticationFilter = conf.getBoolean( YarnConfiguration.RM_WEBAPP_DELEGATION_TOKEN_AUTH_FILTER, YarnConfiguration.DEFAULT_RM_WEBAPP_DELEGATION_TOKEN_AUTH_FILTER); String authPrefix = "hadoop.http.authentication."; String authTypeKey = authPrefix + "type"; String filterInitializerConfKey = "hadoop.http.filter.initializers"; String actualInitializers = ""; Class<?>[] initializersClasses = conf.getClasses(filterInitializerConfKey); boolean hasHadoopAuthFilterInitializer = false; boolean hasRMAuthFilterInitializer = false; if (initializersClasses != null) { for (Class<?> initializer : initializersClasses) { if (initializer.getName().equals( AuthenticationFilterInitializer.class.getName())) { hasHadoopAuthFilterInitializer = true; } if (initializer.getName().equals( RMAuthenticationFilterInitializer.class.getName())) { hasRMAuthFilterInitializer = true; } } if (UserGroupInformation.isSecurityEnabled() && useYarnAuthenticationFilter && hasHadoopAuthFilterInitializer && conf.get(authTypeKey, "").equals( KerberosAuthenticationHandler.TYPE)) { ArrayList<String> target = new ArrayList<String>(); for (Class<?> filterInitializer : initializersClasses) { if (filterInitializer.getName().equals( AuthenticationFilterInitializer.class.getName())) { if (hasRMAuthFilterInitializer == false) { target.add(RMAuthenticationFilterInitializer.class.getName()); } continue; } target.add(filterInitializer.getName()); } actualInitializers = StringUtils.join(",", target); LOG.info("Using RM authentication filter(kerberos/delegation-token)" + " for RM webapp authentication"); RMAuthenticationHandler .setSecretManager(getClientRMService().rmDTSecretManager); RMAuthenticationFilter .setDelegationTokenSecretManager(getClientRMService().rmDTSecretManager); String yarnAuthKey = authPrefix + RMAuthenticationFilter.AUTH_HANDLER_PROPERTY; conf.setStrings(yarnAuthKey, RMAuthenticationHandler.class.getName()); conf.set(filterInitializerConfKey, actualInitializers); } } String initializers = conf.get(filterInitializerConfKey); if (!UserGroupInformation.isSecurityEnabled()) { if (initializersClasses == null || initializersClasses.length == 0) { conf.set(filterInitializerConfKey, RMAuthenticationFilterInitializer.class.getName()); conf.set(authTypeKey, "simple"); } else if (initializers.equals(StaticUserWebFilter.class.getName())) { conf.set(filterInitializerConfKey, RMAuthenticationFilterInitializer.class.getName() + "," + initializers); conf.set(authTypeKey, "simple"); } } Builder<ApplicationMasterService> builder = WebApps .$for("cluster", ApplicationMasterService.class, masterService, "ws") .with(conf) .withHttpSpnegoPrincipalKey( YarnConfiguration.RM_WEBAPP_SPNEGO_USER_NAME_KEY) .withHttpSpnegoKeytabKey( YarnConfiguration.RM_WEBAPP_SPNEGO_KEYTAB_FILE_KEY) .at(webAppAddress); String proxyHostAndPort = WebAppUtils.getProxyHostAndPort(conf); if(WebAppUtils.getResolvedRMWebAppURLWithoutScheme(conf). equals(proxyHostAndPort)) { if (HAUtil.isHAEnabled(conf)) { fetcher = new AppReportFetcher(conf); } else { fetcher = new AppReportFetcher(conf, getClientRMService()); } builder.withServlet(ProxyUriUtils.PROXY_SERVLET_NAME, ProxyUriUtils.PROXY_PATH_SPEC, WebAppProxyServlet.class); builder.withAttribute(WebAppProxy.FETCHER_ATTRIBUTE, fetcher); String[] proxyParts = proxyHostAndPort.split(":"); builder.withAttribute(WebAppProxy.PROXY_HOST_ATTRIBUTE, proxyParts[0]); } webApp = builder.start(new RMWebApp(this)); } ResourceManager(); }
ResourceManager extends CompositeService implements Recoverable { protected void startWepApp() { Configuration conf = getConfig(); boolean useYarnAuthenticationFilter = conf.getBoolean( YarnConfiguration.RM_WEBAPP_DELEGATION_TOKEN_AUTH_FILTER, YarnConfiguration.DEFAULT_RM_WEBAPP_DELEGATION_TOKEN_AUTH_FILTER); String authPrefix = "hadoop.http.authentication."; String authTypeKey = authPrefix + "type"; String filterInitializerConfKey = "hadoop.http.filter.initializers"; String actualInitializers = ""; Class<?>[] initializersClasses = conf.getClasses(filterInitializerConfKey); boolean hasHadoopAuthFilterInitializer = false; boolean hasRMAuthFilterInitializer = false; if (initializersClasses != null) { for (Class<?> initializer : initializersClasses) { if (initializer.getName().equals( AuthenticationFilterInitializer.class.getName())) { hasHadoopAuthFilterInitializer = true; } if (initializer.getName().equals( RMAuthenticationFilterInitializer.class.getName())) { hasRMAuthFilterInitializer = true; } } if (UserGroupInformation.isSecurityEnabled() && useYarnAuthenticationFilter && hasHadoopAuthFilterInitializer && conf.get(authTypeKey, "").equals( KerberosAuthenticationHandler.TYPE)) { ArrayList<String> target = new ArrayList<String>(); for (Class<?> filterInitializer : initializersClasses) { if (filterInitializer.getName().equals( AuthenticationFilterInitializer.class.getName())) { if (hasRMAuthFilterInitializer == false) { target.add(RMAuthenticationFilterInitializer.class.getName()); } continue; } target.add(filterInitializer.getName()); } actualInitializers = StringUtils.join(",", target); LOG.info("Using RM authentication filter(kerberos/delegation-token)" + " for RM webapp authentication"); RMAuthenticationHandler .setSecretManager(getClientRMService().rmDTSecretManager); RMAuthenticationFilter .setDelegationTokenSecretManager(getClientRMService().rmDTSecretManager); String yarnAuthKey = authPrefix + RMAuthenticationFilter.AUTH_HANDLER_PROPERTY; conf.setStrings(yarnAuthKey, RMAuthenticationHandler.class.getName()); conf.set(filterInitializerConfKey, actualInitializers); } } String initializers = conf.get(filterInitializerConfKey); if (!UserGroupInformation.isSecurityEnabled()) { if (initializersClasses == null || initializersClasses.length == 0) { conf.set(filterInitializerConfKey, RMAuthenticationFilterInitializer.class.getName()); conf.set(authTypeKey, "simple"); } else if (initializers.equals(StaticUserWebFilter.class.getName())) { conf.set(filterInitializerConfKey, RMAuthenticationFilterInitializer.class.getName() + "," + initializers); conf.set(authTypeKey, "simple"); } } Builder<ApplicationMasterService> builder = WebApps .$for("cluster", ApplicationMasterService.class, masterService, "ws") .with(conf) .withHttpSpnegoPrincipalKey( YarnConfiguration.RM_WEBAPP_SPNEGO_USER_NAME_KEY) .withHttpSpnegoKeytabKey( YarnConfiguration.RM_WEBAPP_SPNEGO_KEYTAB_FILE_KEY) .at(webAppAddress); String proxyHostAndPort = WebAppUtils.getProxyHostAndPort(conf); if(WebAppUtils.getResolvedRMWebAppURLWithoutScheme(conf). equals(proxyHostAndPort)) { if (HAUtil.isHAEnabled(conf)) { fetcher = new AppReportFetcher(conf); } else { fetcher = new AppReportFetcher(conf, getClientRMService()); } builder.withServlet(ProxyUriUtils.PROXY_SERVLET_NAME, ProxyUriUtils.PROXY_PATH_SPEC, WebAppProxyServlet.class); builder.withAttribute(WebAppProxy.FETCHER_ATTRIBUTE, fetcher); String[] proxyParts = proxyHostAndPort.split(":"); builder.withAttribute(WebAppProxy.PROXY_HOST_ATTRIBUTE, proxyParts[0]); } webApp = builder.start(new RMWebApp(this)); } ResourceManager(); RMContext getRMContext(); static long getClusterTimeStamp(); void handleTransitionToStandBy(); @Private ClientRMService getClientRMService(); @Private ResourceScheduler getResourceScheduler(); @Private ResourceTrackerService getResourceTrackerService(); @Private ApplicationMasterService getApplicationMasterService(); @Private ApplicationACLsManager getApplicationACLsManager(); @Private QueueACLsManager getQueueACLsManager(); @Override void recover(RMState state); static void main(String argv[]); static InetSocketAddress getBindAddress(Configuration conf); }
ResourceManager extends CompositeService implements Recoverable { protected void startWepApp() { Configuration conf = getConfig(); boolean useYarnAuthenticationFilter = conf.getBoolean( YarnConfiguration.RM_WEBAPP_DELEGATION_TOKEN_AUTH_FILTER, YarnConfiguration.DEFAULT_RM_WEBAPP_DELEGATION_TOKEN_AUTH_FILTER); String authPrefix = "hadoop.http.authentication."; String authTypeKey = authPrefix + "type"; String filterInitializerConfKey = "hadoop.http.filter.initializers"; String actualInitializers = ""; Class<?>[] initializersClasses = conf.getClasses(filterInitializerConfKey); boolean hasHadoopAuthFilterInitializer = false; boolean hasRMAuthFilterInitializer = false; if (initializersClasses != null) { for (Class<?> initializer : initializersClasses) { if (initializer.getName().equals( AuthenticationFilterInitializer.class.getName())) { hasHadoopAuthFilterInitializer = true; } if (initializer.getName().equals( RMAuthenticationFilterInitializer.class.getName())) { hasRMAuthFilterInitializer = true; } } if (UserGroupInformation.isSecurityEnabled() && useYarnAuthenticationFilter && hasHadoopAuthFilterInitializer && conf.get(authTypeKey, "").equals( KerberosAuthenticationHandler.TYPE)) { ArrayList<String> target = new ArrayList<String>(); for (Class<?> filterInitializer : initializersClasses) { if (filterInitializer.getName().equals( AuthenticationFilterInitializer.class.getName())) { if (hasRMAuthFilterInitializer == false) { target.add(RMAuthenticationFilterInitializer.class.getName()); } continue; } target.add(filterInitializer.getName()); } actualInitializers = StringUtils.join(",", target); LOG.info("Using RM authentication filter(kerberos/delegation-token)" + " for RM webapp authentication"); RMAuthenticationHandler .setSecretManager(getClientRMService().rmDTSecretManager); RMAuthenticationFilter .setDelegationTokenSecretManager(getClientRMService().rmDTSecretManager); String yarnAuthKey = authPrefix + RMAuthenticationFilter.AUTH_HANDLER_PROPERTY; conf.setStrings(yarnAuthKey, RMAuthenticationHandler.class.getName()); conf.set(filterInitializerConfKey, actualInitializers); } } String initializers = conf.get(filterInitializerConfKey); if (!UserGroupInformation.isSecurityEnabled()) { if (initializersClasses == null || initializersClasses.length == 0) { conf.set(filterInitializerConfKey, RMAuthenticationFilterInitializer.class.getName()); conf.set(authTypeKey, "simple"); } else if (initializers.equals(StaticUserWebFilter.class.getName())) { conf.set(filterInitializerConfKey, RMAuthenticationFilterInitializer.class.getName() + "," + initializers); conf.set(authTypeKey, "simple"); } } Builder<ApplicationMasterService> builder = WebApps .$for("cluster", ApplicationMasterService.class, masterService, "ws") .with(conf) .withHttpSpnegoPrincipalKey( YarnConfiguration.RM_WEBAPP_SPNEGO_USER_NAME_KEY) .withHttpSpnegoKeytabKey( YarnConfiguration.RM_WEBAPP_SPNEGO_KEYTAB_FILE_KEY) .at(webAppAddress); String proxyHostAndPort = WebAppUtils.getProxyHostAndPort(conf); if(WebAppUtils.getResolvedRMWebAppURLWithoutScheme(conf). equals(proxyHostAndPort)) { if (HAUtil.isHAEnabled(conf)) { fetcher = new AppReportFetcher(conf); } else { fetcher = new AppReportFetcher(conf, getClientRMService()); } builder.withServlet(ProxyUriUtils.PROXY_SERVLET_NAME, ProxyUriUtils.PROXY_PATH_SPEC, WebAppProxyServlet.class); builder.withAttribute(WebAppProxy.FETCHER_ATTRIBUTE, fetcher); String[] proxyParts = proxyHostAndPort.split(":"); builder.withAttribute(WebAppProxy.PROXY_HOST_ATTRIBUTE, proxyParts[0]); } webApp = builder.start(new RMWebApp(this)); } ResourceManager(); RMContext getRMContext(); static long getClusterTimeStamp(); void handleTransitionToStandBy(); @Private ClientRMService getClientRMService(); @Private ResourceScheduler getResourceScheduler(); @Private ResourceTrackerService getResourceTrackerService(); @Private ApplicationMasterService getApplicationMasterService(); @Private ApplicationACLsManager getApplicationACLsManager(); @Private QueueACLsManager getQueueACLsManager(); @Override void recover(RMState state); static void main(String argv[]); static InetSocketAddress getBindAddress(Configuration conf); static final int SHUTDOWN_HOOK_PRIORITY; }