@Test public void tellsTheUGICacheToCleanItselfOnTheLastCallForASegment() throws Exception { when(mockServletRequest.getHeader("X-GP-LAST-FRAGMENT")).thenReturn("true"); expectScenario(false, false, false); filter.doFilter(mockServletRequest, mockServletResponse, mockFilterChain); verifyScenario("login-user", false); verify(mockUGICache).release(any(SessionId.class), eq(true)); }
@Override public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain) throws IOException, ServletException { final String gpdbUser = getHeaderValue(request, USER_HEADER, true); final String transactionId = getHeaderValue(request, TRANSACTION_ID_HEADER, true); final Integer segmentId = getHeaderValueInt(request, SEGMENT_ID_HEADER, true); final boolean lastCallForSegment = getHeaderValueBoolean(request, LAST_FRAGMENT_HEADER, false); final String serverName = StringUtils.defaultIfBlank(getHeaderValue(request, SERVER_HEADER, false), "default"); final String configDirectory = StringUtils.defaultIfBlank(getHeaderValue(request, CONFIG_HEADER, false), serverName); final Configuration configuration = configurationFactory.initConfiguration(configDirectory, serverName, gpdbUser, null); final boolean isUserImpersonation = secureLogin.isUserImpersonationEnabled(configuration); final boolean isSecurityEnabled = Utilities.isSecurityEnabled(configuration); UserGroupInformation loginUser = secureLogin.getLoginUser(serverName, configDirectory, configuration); String serviceUser = loginUser.getUserName(); if (!isUserImpersonation && isSecurityEnabled) { String pxfServiceUserName = configuration.get(SecureLogin.CONFIG_KEY_SERVICE_USER_NAME); if (StringUtils.isNotBlank(pxfServiceUserName)) { serviceUser = pxfServiceUserName; } } String remoteUser = (isUserImpersonation ? gpdbUser : serviceUser); SessionId session = new SessionId( segmentId, transactionId, remoteUser, serverName, isSecurityEnabled, loginUser); final String serviceUserName = serviceUser; PrivilegedExceptionAction<Boolean> action = () -> { LOG.debug("Performing request for gpdb_user = {} as [remote_user = {} service_user = {} login_user ={}] with{} impersonation", gpdbUser, remoteUser, serviceUserName, loginUser.getUserName(), isUserImpersonation ? "" : "out"); chain.doFilter(request, response); return true; }; boolean exceptionDetected = false; try { UserGroupInformation userGroupInformation = ugiCache .getUserGroupInformation(session, isUserImpersonation); LOG.debug("Retrieved proxy user {} for server {} and session {}", userGroupInformation, serverName, session); userGroupInformation.doAs(action); } catch (UndeclaredThrowableException ute) { exceptionDetected = true; throw new ServletException(ute.getCause()); } catch (InterruptedException ie) { exceptionDetected = true; throw new ServletException(ie); } finally { boolean releaseUgi = lastCallForSegment || exceptionDetected; LOG.debug("Releasing UGI from cache for session: {}. {}", session, exceptionDetected ? " Exception while processing" : (lastCallForSegment ? " Processed last fragment for segment" : "")); try { ugiCache.release(session, releaseUgi); } catch (Throwable t) { LOG.error("Error releasing UGI from cache for session: {}", session, t); } if (releaseUgi) { LOG.info("Finished processing {}", session); } } }
SecurityServletFilter implements Filter { @Override public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain) throws IOException, ServletException { final String gpdbUser = getHeaderValue(request, USER_HEADER, true); final String transactionId = getHeaderValue(request, TRANSACTION_ID_HEADER, true); final Integer segmentId = getHeaderValueInt(request, SEGMENT_ID_HEADER, true); final boolean lastCallForSegment = getHeaderValueBoolean(request, LAST_FRAGMENT_HEADER, false); final String serverName = StringUtils.defaultIfBlank(getHeaderValue(request, SERVER_HEADER, false), "default"); final String configDirectory = StringUtils.defaultIfBlank(getHeaderValue(request, CONFIG_HEADER, false), serverName); final Configuration configuration = configurationFactory.initConfiguration(configDirectory, serverName, gpdbUser, null); final boolean isUserImpersonation = secureLogin.isUserImpersonationEnabled(configuration); final boolean isSecurityEnabled = Utilities.isSecurityEnabled(configuration); UserGroupInformation loginUser = secureLogin.getLoginUser(serverName, configDirectory, configuration); String serviceUser = loginUser.getUserName(); if (!isUserImpersonation && isSecurityEnabled) { String pxfServiceUserName = configuration.get(SecureLogin.CONFIG_KEY_SERVICE_USER_NAME); if (StringUtils.isNotBlank(pxfServiceUserName)) { serviceUser = pxfServiceUserName; } } String remoteUser = (isUserImpersonation ? gpdbUser : serviceUser); SessionId session = new SessionId( segmentId, transactionId, remoteUser, serverName, isSecurityEnabled, loginUser); final String serviceUserName = serviceUser; PrivilegedExceptionAction<Boolean> action = () -> { LOG.debug("Performing request for gpdb_user = {} as [remote_user = {} service_user = {} login_user ={}] with{} impersonation", gpdbUser, remoteUser, serviceUserName, loginUser.getUserName(), isUserImpersonation ? "" : "out"); chain.doFilter(request, response); return true; }; boolean exceptionDetected = false; try { UserGroupInformation userGroupInformation = ugiCache .getUserGroupInformation(session, isUserImpersonation); LOG.debug("Retrieved proxy user {} for server {} and session {}", userGroupInformation, serverName, session); userGroupInformation.doAs(action); } catch (UndeclaredThrowableException ute) { exceptionDetected = true; throw new ServletException(ute.getCause()); } catch (InterruptedException ie) { exceptionDetected = true; throw new ServletException(ie); } finally { boolean releaseUgi = lastCallForSegment || exceptionDetected; LOG.debug("Releasing UGI from cache for session: {}. {}", session, exceptionDetected ? " Exception while processing" : (lastCallForSegment ? " Processed last fragment for segment" : "")); try { ugiCache.release(session, releaseUgi); } catch (Throwable t) { LOG.error("Error releasing UGI from cache for session: {}", session, t); } if (releaseUgi) { LOG.info("Finished processing {}", session); } } } }
SecurityServletFilter implements Filter { @Override public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain) throws IOException, ServletException { final String gpdbUser = getHeaderValue(request, USER_HEADER, true); final String transactionId = getHeaderValue(request, TRANSACTION_ID_HEADER, true); final Integer segmentId = getHeaderValueInt(request, SEGMENT_ID_HEADER, true); final boolean lastCallForSegment = getHeaderValueBoolean(request, LAST_FRAGMENT_HEADER, false); final String serverName = StringUtils.defaultIfBlank(getHeaderValue(request, SERVER_HEADER, false), "default"); final String configDirectory = StringUtils.defaultIfBlank(getHeaderValue(request, CONFIG_HEADER, false), serverName); final Configuration configuration = configurationFactory.initConfiguration(configDirectory, serverName, gpdbUser, null); final boolean isUserImpersonation = secureLogin.isUserImpersonationEnabled(configuration); final boolean isSecurityEnabled = Utilities.isSecurityEnabled(configuration); UserGroupInformation loginUser = secureLogin.getLoginUser(serverName, configDirectory, configuration); String serviceUser = loginUser.getUserName(); if (!isUserImpersonation && isSecurityEnabled) { String pxfServiceUserName = configuration.get(SecureLogin.CONFIG_KEY_SERVICE_USER_NAME); if (StringUtils.isNotBlank(pxfServiceUserName)) { serviceUser = pxfServiceUserName; } } String remoteUser = (isUserImpersonation ? gpdbUser : serviceUser); SessionId session = new SessionId( segmentId, transactionId, remoteUser, serverName, isSecurityEnabled, loginUser); final String serviceUserName = serviceUser; PrivilegedExceptionAction<Boolean> action = () -> { LOG.debug("Performing request for gpdb_user = {} as [remote_user = {} service_user = {} login_user ={}] with{} impersonation", gpdbUser, remoteUser, serviceUserName, loginUser.getUserName(), isUserImpersonation ? "" : "out"); chain.doFilter(request, response); return true; }; boolean exceptionDetected = false; try { UserGroupInformation userGroupInformation = ugiCache .getUserGroupInformation(session, isUserImpersonation); LOG.debug("Retrieved proxy user {} for server {} and session {}", userGroupInformation, serverName, session); userGroupInformation.doAs(action); } catch (UndeclaredThrowableException ute) { exceptionDetected = true; throw new ServletException(ute.getCause()); } catch (InterruptedException ie) { exceptionDetected = true; throw new ServletException(ie); } finally { boolean releaseUgi = lastCallForSegment || exceptionDetected; LOG.debug("Releasing UGI from cache for session: {}. {}", session, exceptionDetected ? " Exception while processing" : (lastCallForSegment ? " Processed last fragment for segment" : "")); try { ugiCache.release(session, releaseUgi); } catch (Throwable t) { LOG.error("Error releasing UGI from cache for session: {}", session, t); } if (releaseUgi) { LOG.info("Finished processing {}", session); } } } SecurityServletFilter();   SecurityServletFilter(ConfigurationFactory configurationFactory, SecureLogin secureLogin, UGICache ugiCache); }
SecurityServletFilter implements Filter { @Override public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain) throws IOException, ServletException { final String gpdbUser = getHeaderValue(request, USER_HEADER, true); final String transactionId = getHeaderValue(request, TRANSACTION_ID_HEADER, true); final Integer segmentId = getHeaderValueInt(request, SEGMENT_ID_HEADER, true); final boolean lastCallForSegment = getHeaderValueBoolean(request, LAST_FRAGMENT_HEADER, false); final String serverName = StringUtils.defaultIfBlank(getHeaderValue(request, SERVER_HEADER, false), "default"); final String configDirectory = StringUtils.defaultIfBlank(getHeaderValue(request, CONFIG_HEADER, false), serverName); final Configuration configuration = configurationFactory.initConfiguration(configDirectory, serverName, gpdbUser, null); final boolean isUserImpersonation = secureLogin.isUserImpersonationEnabled(configuration); final boolean isSecurityEnabled = Utilities.isSecurityEnabled(configuration); UserGroupInformation loginUser = secureLogin.getLoginUser(serverName, configDirectory, configuration); String serviceUser = loginUser.getUserName(); if (!isUserImpersonation && isSecurityEnabled) { String pxfServiceUserName = configuration.get(SecureLogin.CONFIG_KEY_SERVICE_USER_NAME); if (StringUtils.isNotBlank(pxfServiceUserName)) { serviceUser = pxfServiceUserName; } } String remoteUser = (isUserImpersonation ? gpdbUser : serviceUser); SessionId session = new SessionId( segmentId, transactionId, remoteUser, serverName, isSecurityEnabled, loginUser); final String serviceUserName = serviceUser; PrivilegedExceptionAction<Boolean> action = () -> { LOG.debug("Performing request for gpdb_user = {} as [remote_user = {} service_user = {} login_user ={}] with{} impersonation", gpdbUser, remoteUser, serviceUserName, loginUser.getUserName(), isUserImpersonation ? "" : "out"); chain.doFilter(request, response); return true; }; boolean exceptionDetected = false; try { UserGroupInformation userGroupInformation = ugiCache .getUserGroupInformation(session, isUserImpersonation); LOG.debug("Retrieved proxy user {} for server {} and session {}", userGroupInformation, serverName, session); userGroupInformation.doAs(action); } catch (UndeclaredThrowableException ute) { exceptionDetected = true; throw new ServletException(ute.getCause()); } catch (InterruptedException ie) { exceptionDetected = true; throw new ServletException(ie); } finally { boolean releaseUgi = lastCallForSegment || exceptionDetected; LOG.debug("Releasing UGI from cache for session: {}. {}", session, exceptionDetected ? " Exception while processing" : (lastCallForSegment ? " Processed last fragment for segment" : "")); try { ugiCache.release(session, releaseUgi); } catch (Throwable t) { LOG.error("Error releasing UGI from cache for session: {}", session, t); } if (releaseUgi) { LOG.info("Finished processing {}", session); } } } SecurityServletFilter();   SecurityServletFilter(ConfigurationFactory configurationFactory, SecureLogin secureLogin, UGICache ugiCache); @Override void init(FilterConfig filterConfig); @Override void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain); @Override void destroy(); }
SecurityServletFilter implements Filter { @Override public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain) throws IOException, ServletException { final String gpdbUser = getHeaderValue(request, USER_HEADER, true); final String transactionId = getHeaderValue(request, TRANSACTION_ID_HEADER, true); final Integer segmentId = getHeaderValueInt(request, SEGMENT_ID_HEADER, true); final boolean lastCallForSegment = getHeaderValueBoolean(request, LAST_FRAGMENT_HEADER, false); final String serverName = StringUtils.defaultIfBlank(getHeaderValue(request, SERVER_HEADER, false), "default"); final String configDirectory = StringUtils.defaultIfBlank(getHeaderValue(request, CONFIG_HEADER, false), serverName); final Configuration configuration = configurationFactory.initConfiguration(configDirectory, serverName, gpdbUser, null); final boolean isUserImpersonation = secureLogin.isUserImpersonationEnabled(configuration); final boolean isSecurityEnabled = Utilities.isSecurityEnabled(configuration); UserGroupInformation loginUser = secureLogin.getLoginUser(serverName, configDirectory, configuration); String serviceUser = loginUser.getUserName(); if (!isUserImpersonation && isSecurityEnabled) { String pxfServiceUserName = configuration.get(SecureLogin.CONFIG_KEY_SERVICE_USER_NAME); if (StringUtils.isNotBlank(pxfServiceUserName)) { serviceUser = pxfServiceUserName; } } String remoteUser = (isUserImpersonation ? gpdbUser : serviceUser); SessionId session = new SessionId( segmentId, transactionId, remoteUser, serverName, isSecurityEnabled, loginUser); final String serviceUserName = serviceUser; PrivilegedExceptionAction<Boolean> action = () -> { LOG.debug("Performing request for gpdb_user = {} as [remote_user = {} service_user = {} login_user ={}] with{} impersonation", gpdbUser, remoteUser, serviceUserName, loginUser.getUserName(), isUserImpersonation ? "" : "out"); chain.doFilter(request, response); return true; }; boolean exceptionDetected = false; try { UserGroupInformation userGroupInformation = ugiCache .getUserGroupInformation(session, isUserImpersonation); LOG.debug("Retrieved proxy user {} for server {} and session {}", userGroupInformation, serverName, session); userGroupInformation.doAs(action); } catch (UndeclaredThrowableException ute) { exceptionDetected = true; throw new ServletException(ute.getCause()); } catch (InterruptedException ie) { exceptionDetected = true; throw new ServletException(ie); } finally { boolean releaseUgi = lastCallForSegment || exceptionDetected; LOG.debug("Releasing UGI from cache for session: {}. {}", session, exceptionDetected ? " Exception while processing" : (lastCallForSegment ? " Processed last fragment for segment" : "")); try { ugiCache.release(session, releaseUgi); } catch (Throwable t) { LOG.error("Error releasing UGI from cache for session: {}", session, t); } if (releaseUgi) { LOG.info("Finished processing {}", session); } } } SecurityServletFilter();   SecurityServletFilter(ConfigurationFactory configurationFactory, SecureLogin secureLogin, UGICache ugiCache); @Override void init(FilterConfig filterConfig); @Override void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain); @Override void destroy();  }