org.apache.nifi.hadoop

Class SecurityUtil

java.lang.Object

org.apache.nifi.hadoop.SecurityUtil

public class SecurityUtil
extends Object

Provides synchronized access to UserGroupInformation to avoid multiple processors/services from interfering with each other.

Constructor Summary

Constructors

Constructor and Description
SecurityUtil()

Method Summary

Methods

Modifier and Type	Method and Description
static boolean	isSecurityEnabled(org.apache.hadoop.conf.Configuration config) Initializes UserGroupInformation with the given Configuration and returns UserGroupInformation.isSecurityEnabled().
static org.apache.hadoop.security.UserGroupInformation	loginKerberos(org.apache.hadoop.conf.Configuration config, String principal, String keyTab) Initializes UserGroupInformation with the given Configuration and performs the login for the given principal and keytab.
static org.apache.hadoop.security.UserGroupInformation	loginSimple(org.apache.hadoop.conf.Configuration config) Initializes UserGroupInformation with the given Configuration and returns UserGroupInformation.getLoginUser().
static KerberosTicketRenewer	startTicketRenewalThread(String id, org.apache.hadoop.security.UserGroupInformation ugi, long renewalPeriod, ComponentLog logger) Start a thread that periodically attempts to renew the current Kerberos user's ticket.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SecurityUtil

public SecurityUtil()

Method Detail

loginKerberos

public static org.apache.hadoop.security.UserGroupInformation loginKerberos(org.apache.hadoop.conf.Configuration config,
                                                            String principal,
                                                            String keyTab)
                                                                     throws IOException

Initializes UserGroupInformation with the given Configuration and performs the login for the given principal and keytab. All logins should happen through this class to ensure other threads are not concurrently modifying UserGroupInformation.

Parameters:

config - the configuration instance

principal - the principal to authenticate as

keyTab - the keytab to authenticate with

Returns:

the UGI for the given principal

Throws:

IOException - if login failed

loginSimple

public static org.apache.hadoop.security.UserGroupInformation loginSimple(org.apache.hadoop.conf.Configuration config)
                                                                   throws IOException

Initializes UserGroupInformation with the given Configuration and returns UserGroupInformation.getLoginUser(). All logins should happen through this class to ensure other threads are not concurrently modifying UserGroupInformation.

Parameters:

config - the configuration instance

Returns:

the UGI for the given principal

Throws:

IOException - if login failed

isSecurityEnabled

public static boolean isSecurityEnabled(org.apache.hadoop.conf.Configuration config)

Initializes UserGroupInformation with the given Configuration and returns UserGroupInformation.isSecurityEnabled(). All checks for isSecurityEnabled() should happen through this method.

Parameters:

config - the given configuration

Returns:

true if kerberos is enabled on the given configuration, false otherwise

startTicketRenewalThread

public static KerberosTicketRenewer startTicketRenewalThread(String id,
                                             org.apache.hadoop.security.UserGroupInformation ugi,
                                             long renewalPeriod,
                                             ComponentLog logger)

Start a thread that periodically attempts to renew the current Kerberos user's ticket. Callers of this method should store the reference to the KerberosTicketRenewer and call stop() to stop the thread.

Parameters:

id - The unique identifier to use for the thread, can be the class name that started the thread (i.e. PutHDFS, etc)

ugi - The current Kerberos user.

renewalPeriod - The amount of time between attempting renewals.

logger - The logger to use with in the renewer

Returns:

the KerberosTicketRenewer Runnable