001/** 002 * Licensed to the Apache Software Foundation (ASF) under one 003 * or more contributor license agreements. See the NOTICE file 004 * distributed with this work for additional information 005 * regarding copyright ownership. The ASF licenses this file 006 * to you under the Apache License, Version 2.0 (the 007 * "License"); you may not use this file except in compliance 008 * with the License. You may obtain a copy of the License at 009 * 010 * http://www.apache.org/licenses/LICENSE-2.0 011 * 012 * Unless required by applicable law or agreed to in writing, software 013 * distributed under the License is distributed on an "AS IS" BASIS, 014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 015 * See the License for the specific language governing permissions and 016 * limitations under the License. 017 */ 018package org.apache.oozie.action.hadoop; 019 020import org.apache.hadoop.hive.conf.HiveConf; 021import org.apache.hadoop.hive.metastore.HiveMetaStoreClient; 022import org.apache.hadoop.hive.metastore.api.MetaException; 023import org.apache.hadoop.io.Text; 024import org.apache.hadoop.mapred.JobConf; 025import org.apache.hadoop.mapreduce.security.token.delegation.DelegationTokenIdentifier; 026import org.apache.hadoop.security.UserGroupInformation; 027import org.apache.hadoop.security.token.Token; 028import org.apache.hadoop.security.SaslRpcServer; 029import org.apache.oozie.util.XLog; 030 031/** 032 * Helper class to handle the HCat credentials 033 * Performs internally the heavy-lifting of fetching delegation tokens from Hive Metastore, abstracted from the user 034 * Token is added to jobConf 035 */ 036public class HCatCredentialHelper { 037 038 private static final String USER_NAME = "user.name"; 039 // Some Hive Metastore properties 040 private static final String HIVE_METASTORE_SASL_ENABLED = "hive.metastore.sasl.enabled"; 041 private static final String HIVE_METASTORE_KERBEROS_PRINCIPAL = "hive.metastore.kerberos.principal"; 042 private static final String HIVE_METASTORE_LOCAL = "hive.metastore.local"; 043 private static final String HADOOP_RPC_PROTECTION = "hadoop.rpc.protection"; 044 045 /** 046 * This Function will set the HCat token to jobconf 047 * @param launcherJobConf - job conf 048 * @param principal - principal for HCat server 049 * @param server - Serevr URI for HCat server 050 * @throws Exception 051 */ 052 public void set(JobConf launcherJobConf, String principal, String server) throws Exception { 053 try { 054 HiveMetaStoreClient client = getHCatClient 055 (launcherJobConf, principal, server); 056 XLog.getLog(getClass()).debug( 057 "HCatCredentialHelper: set: User name for which token will be asked from HCat: " 058 + launcherJobConf.get(USER_NAME)); 059 String tokenStrForm = client.getDelegationToken(launcherJobConf.get(USER_NAME), UserGroupInformation 060 .getLoginUser().getShortUserName()); 061 Token<DelegationTokenIdentifier> hcatToken = new Token<DelegationTokenIdentifier>(); 062 hcatToken.decodeFromUrlString(tokenStrForm); 063 launcherJobConf.getCredentials().addToken(new Text("HCat Token"), hcatToken); 064 XLog.getLog(getClass()).debug("Added the HCat token in job conf"); 065 } 066 catch (Exception ex) { 067 XLog.getLog(getClass()).debug("set Exception" + ex.getMessage()); 068 throw ex; 069 } 070 } 071 072 /** 073 * Getting the HCat client. 074 * @param jobConf 075 * @param principal 076 * @param server 077 * @return HiveMetaStoreClient 078 * @throws MetaException 079 */ 080 public HiveMetaStoreClient getHCatClient(JobConf launcherJobConf, 081 String principal, String server) throws MetaException { 082 HiveConf hiveConf = null; 083 HiveMetaStoreClient hiveclient = null; 084 hiveConf = new HiveConf(); 085 XLog.getLog(getClass()).debug("getHCatClient: Principal: " + principal + " Server: " + server); 086 // specified a thrift url 087 088 hiveConf.set(HIVE_METASTORE_SASL_ENABLED, "true"); 089 hiveConf.set(HIVE_METASTORE_KERBEROS_PRINCIPAL, principal); 090 hiveConf.set(HIVE_METASTORE_LOCAL, "false"); 091 hiveConf.set(HiveConf.ConfVars.METASTOREURIS.varname, server); 092 String protection = launcherJobConf.get(HADOOP_RPC_PROTECTION, 093 SaslRpcServer.QualityOfProtection.AUTHENTICATION.name() 094 .toLowerCase()); 095 XLog.getLog(getClass()).debug("getHCatClient, setting rpc protection to " + protection); 096 hiveConf.set(HADOOP_RPC_PROTECTION, protection); 097 098 hiveclient = new HiveMetaStoreClient(hiveConf); 099 return hiveclient; 100 } 101}