Example usage for org.apache.hadoop.security.authentication.util KerberosUtil getPrincipalNames

Introduction

In this page you can find the example usage for org.apache.hadoop.security.authentication.util KerberosUtil getPrincipalNames.

Prototype

public static final String[] getPrincipalNames(String keytab, Pattern pattern) throws IOException 

Source Link

Document

Get all the unique principals from keytabfile which matches a pattern.

Usage

From source file:io.druid.security.kerberos.DruidKerberosAuthenticationHandler.java

License:Apache License

@Override
public void init(Properties config) throws ServletException {
    try {/*from   ww w .j a  v  a  2 s .com*/
        String principal = config.getProperty(PRINCIPAL);
        if (principal == null || principal.trim().length() == 0) {
            throw new ServletException("Principal not defined in configuration");
        }
        keytab = config.getProperty(KEYTAB, keytab);
        if (keytab == null || keytab.trim().length() == 0) {
            throw new ServletException("Keytab not defined in configuration");
        }
        if (!new File(keytab).exists()) {
            throw new ServletException("Keytab does not exist: " + keytab);
        }

        // use all SPNEGO principals in the keytab if a principal isn't
        // specifically configured
        final String[] spnegoPrincipals;
        if (principal.equals("*")) {
            spnegoPrincipals = KerberosUtil.getPrincipalNames(keytab, Pattern.compile("HTTP/.*"));
            if (spnegoPrincipals.length == 0) {
                throw new ServletException("Principals do not exist in the keytab");
            }
        } else {
            spnegoPrincipals = new String[] { principal };
        }

        String nameRules = config.getProperty(NAME_RULES, null);
        if (nameRules != null) {
            KerberosName.setRules(nameRules);
        }

        for (String spnegoPrincipal : spnegoPrincipals) {
            log.info("Login using keytab %s, for principal %s", keytab, spnegoPrincipal);
            final KerberosAuthenticator.DruidKerberosConfiguration kerberosConfiguration = new KerberosAuthenticator.DruidKerberosConfiguration(
                    keytab, spnegoPrincipal);
            final LoginContext loginContext = new LoginContext("", serverSubject, null, kerberosConfiguration);
            try {
                loginContext.login();
            } catch (LoginException le) {
                log.warn(le, "Failed to login as [%s]", spnegoPrincipal);
                throw new AuthenticationException(le);
            }
            loginContexts.add(loginContext);
        }
        try {
            gssManager = Subject.doAs(serverSubject, new PrivilegedExceptionAction<GSSManager>() {

                @Override
                public GSSManager run() throws Exception {
                    return GSSManager.getInstance();
                }
            });
        } catch (PrivilegedActionException ex) {
            throw ex.getException();
        }
    } catch (Exception ex) {
        throw new ServletException(ex);
    }
}

---

From source file:org.apache.druid.security.kerberos.DruidKerberosAuthenticationHandler.java

License:Apache License

@Override
public void init(Properties config) throws ServletException {
    try {/*w ww  .  j  a v  a2 s . c o m*/
        String principal = config.getProperty(PRINCIPAL);
        if (principal == null || principal.trim().length() == 0) {
            throw new ServletException("Principal not defined in configuration");
        }
        keytab = config.getProperty(KEYTAB, keytab);
        if (keytab == null || keytab.trim().length() == 0) {
            throw new ServletException("Keytab not defined in configuration");
        }
        if (!new File(keytab).exists()) {
            throw new ServletException("Keytab does not exist: " + keytab);
        }

        // use all SPNEGO principals in the keytab if a principal isn't
        // specifically configured
        final String[] spnegoPrincipals;
        if ("*".equals(principal)) {
            spnegoPrincipals = KerberosUtil.getPrincipalNames(keytab, Pattern.compile("HTTP/.*"));
            if (spnegoPrincipals.length == 0) {
                throw new ServletException("Principals do not exist in the keytab");
            }
        } else {
            spnegoPrincipals = new String[] { principal };
        }

        String nameRules = config.getProperty(NAME_RULES, null);
        if (nameRules != null) {
            KerberosName.setRules(nameRules);
        }

        for (String spnegoPrincipal : spnegoPrincipals) {
            log.info("Login using keytab %s, for principal %s", keytab, spnegoPrincipal);
            final KerberosAuthenticator.DruidKerberosConfiguration kerberosConfiguration = new KerberosAuthenticator.DruidKerberosConfiguration(
                    keytab, spnegoPrincipal);
            final LoginContext loginContext = new LoginContext("", serverSubject, null, kerberosConfiguration);
            try {
                loginContext.login();
            } catch (LoginException le) {
                log.warn(le, "Failed to login as [%s]", spnegoPrincipal);
                throw new AuthenticationException(le);
            }
            loginContexts.add(loginContext);
        }
        try {
            gssManager = Subject.doAs(serverSubject, new PrivilegedExceptionAction<GSSManager>() {

                @Override
                public GSSManager run() {
                    return GSSManager.getInstance();
                }
            });
        } catch (PrivilegedActionException ex) {
            throw ex.getException();
        }
    } catch (Exception ex) {
        throw new ServletException(ex);
    }
}

---

From source file:org.apache.ranger.audit.provider.MiscUtil.java

License:Apache License

public static void authWithKerberos(String keytab, String principal, String nameRules) {

    if (keytab == null || principal == null) {
        return;//from www. ja  v  a 2s.c o  m
    }
    Subject serverSubject = new Subject();
    int successLoginCount = 0;
    String[] spnegoPrincipals = null;
    try {
        if (principal.equals("*")) {
            spnegoPrincipals = KerberosUtil.getPrincipalNames(keytab, Pattern.compile("HTTP/.*"));
            if (spnegoPrincipals.length == 0) {
                logger.error("No principals found in keytab=" + keytab);
            }
        } else {
            spnegoPrincipals = new String[] { principal };
        }

        if (nameRules != null) {
            KerberosName.setRules(nameRules);
        }

        boolean useKeytab = true;
        if (!useKeytab) {
            logger.info("Creating UGI with subject");
            List<LoginContext> loginContexts = new ArrayList<LoginContext>();
            for (String spnegoPrincipal : spnegoPrincipals) {
                try {
                    logger.info("Login using keytab " + keytab + ", for principal " + spnegoPrincipal);
                    final KerberosConfiguration kerberosConfiguration = new KerberosConfiguration(keytab,
                            spnegoPrincipal);
                    final LoginContext loginContext = new LoginContext("", serverSubject, null,
                            kerberosConfiguration);
                    loginContext.login();
                    successLoginCount++;
                    logger.info("Login success keytab " + keytab + ", for principal " + spnegoPrincipal);
                    loginContexts.add(loginContext);
                } catch (Throwable t) {
                    logger.error("Login failed keytab " + keytab + ", for principal " + spnegoPrincipal, t);
                }
                if (successLoginCount > 0) {
                    logger.info("Total login success count=" + successLoginCount);
                    try {
                        UserGroupInformation.loginUserFromSubject(serverSubject);
                        // UserGroupInformation ugi =
                        // createUGIFromSubject(serverSubject);
                        // if (ugi != null) {
                        // setUGILoginUser(ugi, serverSubject);
                        // }
                    } catch (Throwable e) {
                        logger.error("Error creating UGI from subject. subject=" + serverSubject);
                    }
                } else {
                    logger.error(
                            "Total logins were successfull from keytab=" + keytab + ", principal=" + principal);
                }
            }
        } else {
            logger.info("Creating UGI from keytab directly. keytab=" + keytab + ", principal="
                    + spnegoPrincipals[0]);
            UserGroupInformation ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(spnegoPrincipals[0],
                    keytab);
            MiscUtil.setUGILoginUser(ugi, null);
        }

    } catch (Throwable t) {
        logger.error("Failed to login with given keytab and principal", t);
    }

}

---

From source file:org.apache.zeppelin.realm.kerberos.KerberosRealm.java

License:Apache License

/**
 * Initializes the KerberosRealm by 'kinit'ing using principal and keytab.
 * <p>//from www. ja v  a  2 s  .c  o m
 * It creates a Kerberos context using the principal and keytab specified in
 * the Shiro configuration.
 * <p>
 * This method should be called only once.
 *
 * @throws RuntimeException thrown if the handler could not be initialized.
 */
@Override
protected void onInit() {
    super.onInit();
    config = getConfiguration();
    try {
        if (principal == null || principal.trim().length() == 0) {
            throw new RuntimeException("Principal not defined in configuration");
        }

        if (keytab == null || keytab.trim().length() == 0) {
            throw new RuntimeException("Keytab not defined in configuration");
        }

        File keytabFile = new File(keytab);
        if (!keytabFile.exists()) {
            throw new RuntimeException("Keytab file does not exist: " + keytab);
        }

        // use all SPNEGO principals in the keytab if a principal isn't
        // specifically configured
        final String[] spnegoPrincipals;
        if (principal.equals("*")) {
            spnegoPrincipals = KerberosUtil.getPrincipalNames(keytab, Pattern.compile("HTTP/.*"));
            if (spnegoPrincipals.length == 0) {
                throw new RuntimeException("Principals do not exist in the keytab");
            }
        } else {
            spnegoPrincipals = new String[] { principal };
        }
        KeyTab keytabInstance = KeyTab.getInstance(keytabFile);

        serverSubject = new Subject();
        serverSubject.getPrivateCredentials().add(keytabInstance);
        for (String spnegoPrincipal : spnegoPrincipals) {
            Principal krbPrincipal = new KerberosPrincipal(spnegoPrincipal);
            LOG.info("Using keytab {}, for principal {}", keytab, krbPrincipal);
            serverSubject.getPrincipals().add(krbPrincipal);
        }

        if (nameRules == null || nameRules.trim().length() == 0) {
            LOG.warn("No auth_to_local rules defined, DEFAULT will be used.");
            nameRules = "DEFAULT";
        }

        KerberosName.setRules(nameRules);

        if (null == gssManager) {
            try {
                gssManager = Subject.doAs(serverSubject, new PrivilegedExceptionAction<GSSManager>() {
                    @Override
                    public GSSManager run() {
                        return GSSManager.getInstance();
                    }
                });
                LOG.trace("SPNEGO gssManager initialized.");
            } catch (PrivilegedActionException ex) {
                throw ex.getException();
            }
        }

        if (null == signer) {
            initializeSecretProvider();
        }

        Configuration hadoopConfig = new Configuration();
        hadoopGroups = new Groups(hadoopConfig);

    } catch (Exception ex) {
        throw new RuntimeException(ex);
    }
}

---