001/** 002 * Licensed to the Apache Software Foundation (ASF) under one 003 * or more contributor license agreements. See the NOTICE file 004 * distributed with this work for additional information 005 * regarding copyright ownership. The ASF licenses this file 006 * to you under the Apache License, Version 2.0 (the 007 * "License"); you may not use this file except in compliance 008 * with the License. You may obtain a copy of the License at 009 * 010 * http://www.apache.org/licenses/LICENSE-2.0 011 * 012 * Unless required by applicable law or agreed to in writing, software 013 * distributed under the License is distributed on an "AS IS" BASIS, 014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 015 * See the License for the specific language governing permissions and 016 * limitations under the License. 017 */ 018 019package org.apache.oozie.action.hadoop; 020 021import org.apache.hadoop.conf.Configuration; 022import org.apache.hadoop.hive.conf.HiveConf; 023import org.apache.hadoop.mapreduce.security.token.delegation.DelegationTokenIdentifier; 024import org.apache.hadoop.security.Credentials; 025import org.apache.hadoop.security.SaslRpcServer; 026import org.apache.hadoop.security.UserGroupInformation; 027import org.apache.hadoop.security.token.Token; 028import org.apache.hive.hcatalog.api.HCatClient; 029import org.apache.hive.hcatalog.common.HCatException; 030import org.apache.oozie.util.XLog; 031 032/** 033 * Helper class to handle the HCat credentials 034 * Performs internally the heavy-lifting of fetching delegation tokens from Hive Metastore, abstracted from the user 035 * Token is added to the credentials 036 */ 037public class HCatCredentialHelper { 038 039 private static final String USER_NAME = "user.name"; 040 // Some Hive Metastore properties 041 private static final String HIVE_METASTORE_SASL_ENABLED = "hive.metastore.sasl.enabled"; 042 private static final String HIVE_METASTORE_KERBEROS_PRINCIPAL = "hive.metastore.kerberos.principal"; 043 private static final String HIVE_METASTORE_LOCAL = "hive.metastore.local"; 044 private static final String HADOOP_RPC_PROTECTION = "hadoop.rpc.protection"; 045 046 /** 047 * This Function will set the HCat token to the credentials 048 * @param credentials - the credentials 049 * @param launcherConfig - launcher configuration 050 * @param principal - principal for HCat server 051 * @param server - Serevr URI for HCat server 052 * @throws Exception 053 */ 054 public void set(Credentials credentials, Configuration launcherConfig, String principal, String server) throws Exception { 055 HCatClient client = null; 056 try { 057 client = getHCatClient(launcherConfig, principal, server); 058 XLog.getLog(getClass()).debug( 059 "HCatCredentialHelper: set: User name for which token will be asked from HCat: {0}", 060 launcherConfig.get(USER_NAME)); 061 String tokenStrForm = client.getDelegationToken(launcherConfig.get(USER_NAME), UserGroupInformation 062 .getLoginUser().getShortUserName()); 063 Token<DelegationTokenIdentifier> hcatToken = new Token<DelegationTokenIdentifier>(); 064 hcatToken.decodeFromUrlString(tokenStrForm); 065 credentials.addToken(CredentialsProviderFactory.getUniqueAlias(hcatToken), hcatToken); 066 XLog.getLog(getClass()).debug("Added the HCat token to launcher's credentials"); 067 } 068 catch (Exception ex) { 069 XLog.getLog(getClass()).debug("set Exception {0}", ex.getMessage()); 070 throw ex; 071 } 072 finally { 073 if (client != null) { 074 client.close(); 075 } 076 } 077 } 078 079 /** 080 * Getting the HCat client. 081 * @param launcherConfig 082 * @param principal 083 * @param server 084 * @return HCatClient 085 * @throws HCatException 086 */ 087 public HCatClient getHCatClient(Configuration launcherConfig, 088 String principal, String server) throws HCatException { 089 HiveConf hiveConf = null; 090 HCatClient hiveclient = null; 091 hiveConf = new HiveConf(); 092 XLog.getLog(getClass()).debug("getHCatClient: Principal: {0} Server: {1}", principal, server); 093 // specified a thrift url 094 095 hiveConf.set(HIVE_METASTORE_SASL_ENABLED, "true"); 096 hiveConf.set(HIVE_METASTORE_KERBEROS_PRINCIPAL, principal); 097 hiveConf.set(HIVE_METASTORE_LOCAL, "false"); 098 hiveConf.set(HiveConf.ConfVars.METASTOREURIS.varname, server); 099 String protection = launcherConfig.get(HADOOP_RPC_PROTECTION, 100 SaslRpcServer.QualityOfProtection.AUTHENTICATION.name() 101 .toLowerCase()); 102 XLog.getLog(getClass()).debug("getHCatClient, setting rpc protection to {0}", protection); 103 hiveConf.set(HADOOP_RPC_PROTECTION, protection); 104 105 hiveclient = HCatClient.create(hiveConf); 106 return hiveclient; 107 } 108}