001/**
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *      http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software
013 * distributed under the License is distributed on an "AS IS" BASIS,
014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
015 * See the License for the specific language governing permissions and
016 * limitations under the License.
017 */
018package org.apache.oozie.action.hadoop;
019
020import org.apache.hadoop.hive.conf.HiveConf;
021import org.apache.hadoop.hive.metastore.HiveMetaStoreClient;
022import org.apache.hadoop.hive.metastore.api.MetaException;
023import org.apache.hadoop.io.Text;
024import org.apache.hadoop.mapred.JobConf;
025import org.apache.hadoop.mapreduce.security.token.delegation.DelegationTokenIdentifier;
026import org.apache.hadoop.security.UserGroupInformation;
027import org.apache.hadoop.security.token.Token;
028import org.apache.hadoop.security.SaslRpcServer;
029import org.apache.oozie.util.XLog;
030
031/**
032 * Helper class to handle the HCat credentials
033 * Performs internally the heavy-lifting of fetching delegation tokens from Hive Metastore, abstracted from the user
034 * Token is added to jobConf
035 */
036public class HCatCredentialHelper {
037
038    private static final String USER_NAME = "user.name";
039    // Some Hive Metastore properties
040    private static final String HIVE_METASTORE_SASL_ENABLED = "hive.metastore.sasl.enabled";
041    private static final String HIVE_METASTORE_KERBEROS_PRINCIPAL = "hive.metastore.kerberos.principal";
042    private static final String HIVE_METASTORE_LOCAL = "hive.metastore.local";
043    private static final String HADOOP_RPC_PROTECTION = "hadoop.rpc.protection";
044
045    /**
046     * This Function will set the HCat token to jobconf
047     * @param launcherJobConf - job conf
048     * @param principal - principal for HCat server
049     * @param server - Serevr URI for HCat server
050     * @throws Exception
051     */
052    public void set(JobConf launcherJobConf, String principal, String server) throws Exception {
053        try {
054            HiveMetaStoreClient client = getHCatClient
055                (launcherJobConf, principal, server);
056            XLog.getLog(getClass()).debug(
057                    "HCatCredentialHelper: set: User name for which token will be asked from HCat: "
058                            + launcherJobConf.get(USER_NAME));
059            String tokenStrForm = client.getDelegationToken(launcherJobConf.get(USER_NAME), UserGroupInformation
060                    .getLoginUser().getShortUserName());
061            Token<DelegationTokenIdentifier> hcatToken = new Token<DelegationTokenIdentifier>();
062            hcatToken.decodeFromUrlString(tokenStrForm);
063            launcherJobConf.getCredentials().addToken(new Text("HCat Token"), hcatToken);
064            XLog.getLog(getClass()).debug("Added the HCat token in job conf");
065        }
066        catch (Exception ex) {
067            XLog.getLog(getClass()).debug("set Exception" + ex.getMessage());
068            throw ex;
069        }
070    }
071
072    /**
073     * Getting the HCat client.
074     * @param jobConf
075     * @param principal
076     * @param server
077     * @return HiveMetaStoreClient
078     * @throws MetaException
079     */
080    public HiveMetaStoreClient getHCatClient(JobConf launcherJobConf,
081        String principal, String server) throws MetaException {
082        HiveConf hiveConf = null;
083        HiveMetaStoreClient hiveclient = null;
084        hiveConf = new HiveConf();
085        XLog.getLog(getClass()).debug("getHCatClient: Principal: " + principal + " Server: " + server);
086        // specified a thrift url
087
088        hiveConf.set(HIVE_METASTORE_SASL_ENABLED, "true");
089        hiveConf.set(HIVE_METASTORE_KERBEROS_PRINCIPAL, principal);
090        hiveConf.set(HIVE_METASTORE_LOCAL, "false");
091        hiveConf.set(HiveConf.ConfVars.METASTOREURIS.varname, server);
092        String protection = launcherJobConf.get(HADOOP_RPC_PROTECTION,
093           SaslRpcServer.QualityOfProtection.AUTHENTICATION.name()
094              .toLowerCase());
095        XLog.getLog(getClass()).debug("getHCatClient, setting rpc protection to " + protection);
096        hiveConf.set(HADOOP_RPC_PROTECTION, protection);
097
098        hiveclient = new HiveMetaStoreClient(hiveConf);
099        return hiveclient;
100    }
101}