Java 类org.apache.hadoop.hbase.security.AuthMethod 实例源码

项目：ditb 文件：RpcServer.java

private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws IOException {
  UserGroupInformation authorizedUgi;
  if (authMethod == AuthMethod.DIGEST) {
    TokenIdentifier tokenId = HBaseSaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    authorizedUgi = tokenId.getUser();
    if (authorizedUgi == null) {
      throw new AccessDeniedException(
          "Can't retrieve username from tokenIdentifier.");
    }
    authorizedUgi.addTokenIdentifier(tokenId);
  } else {
    authorizedUgi = UserGroupInformation.createRemoteUser(authorizedId);
  }
  authorizedUgi.setAuthenticationMethod(authMethod.authenticationMethod.getAuthMethod());
  return authorizedUgi;
}

项目：ditb 文件：RpcServer.java

private boolean authorizeConnection() throws IOException {
  try {
    // If auth method is DIGEST, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (ugi != null && ugi.getRealUser() != null
        && (authMethod != AuthMethod.DIGEST)) {
      ProxyUsers.authorize(ugi, this.getHostAddress(), conf);
    }
    authorize(ugi, connectionHeader, getHostInetAddress());
    metrics.authorizationSuccess();
  } catch (AuthorizationException ae) {
    if (LOG.isDebugEnabled()) {
      LOG.debug("Connection authorization failed: " + ae.getMessage(), ae);
    }
    metrics.authorizationFailure();
    setupResponse(authFailedResponse, authFailedCall,
      new AccessDeniedException(ae), ae.getMessage());
    responder.doRespond(authFailedCall);
    return false;
  }
  return true;
}

项目：ditb 文件：RpcClientImpl.java

private synchronized UserInformation getUserInfo(UserGroupInformation ugi) {
  if (ugi == null || authMethod == AuthMethod.DIGEST) {
    // Don't send user for token auth
    return null;
  }
  UserInformation.Builder userInfoPB = UserInformation.newBuilder();
  if (authMethod == AuthMethod.KERBEROS) {
    // Send effective user for Kerberos auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
  } else if (authMethod == AuthMethod.SIMPLE) {
    //Send both effective user and real user for simple auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
    if (ugi.getRealUser() != null) {
      userInfoPB.setRealUser(ugi.getRealUser().getUserName());
    }
  }
  return userInfoPB.build();
}

项目：ditb 文件：AsyncRpcChannel.java

/**
 * Build the user information
 *
 * @param ugi        User Group Information
 * @param authMethod Authorization method
 * @return UserInformation protobuf
 */
private RPCProtos.UserInformation buildUserInfo(UserGroupInformation ugi, AuthMethod authMethod) {
  if (ugi == null || authMethod == AuthMethod.DIGEST) {
    // Don't send user for token auth
    return null;
  }
  RPCProtos.UserInformation.Builder userInfoPB = RPCProtos.UserInformation.newBuilder();
  if (authMethod == AuthMethod.KERBEROS) {
    // Send effective user for Kerberos auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
  } else if (authMethod == AuthMethod.SIMPLE) {
    //Send both effective user and real user for simple auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
    if (ugi.getRealUser() != null) {
      userInfoPB.setRealUser(ugi.getRealUser().getUserName());
    }
  }
  return userInfoPB.build();
}

项目：pbase 文件：RpcServer.java

private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws IOException {
  if (authMethod == AuthMethod.DIGEST) {
    TokenIdentifier tokenId = HBaseSaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    UserGroupInformation ugi = tokenId.getUser();
    if (ugi == null) {
      throw new AccessDeniedException(
          "Can't retrieve username from tokenIdentifier.");
    }
    ugi.addTokenIdentifier(tokenId);
    return ugi;
  } else {
    return UserGroupInformation.createRemoteUser(authorizedId);
  }
}

项目：pbase 文件：RpcServer.java

private boolean authorizeConnection() throws IOException {
  try {
    // If auth method is DIGEST, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (user != null && user.getRealUser() != null
        && (authMethod != AuthMethod.DIGEST)) {
      ProxyUsers.authorize(user, this.getHostAddress(), conf);
    }
    authorize(user, connectionHeader, getHostInetAddress());
    metrics.authorizationSuccess();
  } catch (AuthorizationException ae) {
    if (LOG.isDebugEnabled()) {
      LOG.debug("Connection authorization failed: " + ae.getMessage(), ae);
    }
    metrics.authorizationFailure();
    setupResponse(authFailedResponse, authFailedCall,
      new AccessDeniedException(ae), ae.getMessage());
    responder.doRespond(authFailedCall);
    return false;
  }
  return true;
}

项目：pbase 文件：RpcClientImpl.java

private UserInformation getUserInfo(UserGroupInformation ugi) {
  if (ugi == null || authMethod == AuthMethod.DIGEST) {
    // Don't send user for token auth
    return null;
  }
  UserInformation.Builder userInfoPB = UserInformation.newBuilder();
  if (authMethod == AuthMethod.KERBEROS) {
    // Send effective user for Kerberos auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
  } else if (authMethod == AuthMethod.SIMPLE) {
    //Send both effective user and real user for simple auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
    if (ugi.getRealUser() != null) {
      userInfoPB.setRealUser(ugi.getRealUser().getUserName());
    }
  }
  return userInfoPB.build();
}

项目：HIndex 文件：RpcServer.java

private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws IOException {
  if (authMethod == AuthMethod.DIGEST) {
    TokenIdentifier tokenId = HBaseSaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    UserGroupInformation ugi = tokenId.getUser();
    if (ugi == null) {
      throw new AccessControlException(
          "Can't retrieve username from tokenIdentifier.");
    }
    ugi.addTokenIdentifier(tokenId);
    return ugi;
  } else {
    return UserGroupInformation.createRemoteUser(authorizedId);
  }
}

项目：HIndex 文件：RpcServer.java

private boolean authorizeConnection() throws IOException {
  try {
    // If auth method is DIGEST, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (user != null && user.getRealUser() != null
        && (authMethod != AuthMethod.DIGEST)) {
      ProxyUsers.authorize(user, this.getHostAddress(), conf);
    }
    authorize(user, connectionHeader, getHostInetAddress());
    if (LOG.isDebugEnabled()) {
      LOG.debug("Authorized " + TextFormat.shortDebugString(connectionHeader));
    }
    metrics.authorizationSuccess();
  } catch (AuthorizationException ae) {
    LOG.debug("Connection authorization failed: " + ae.getMessage(), ae);
    metrics.authorizationFailure();
    setupResponse(authFailedResponse, authFailedCall, ae, ae.getMessage());
    responder.doRespond(authFailedCall);
    return false;
  }
  return true;
}

项目：HIndex 文件：RpcClient.java

private UserInformation getUserInfo(UserGroupInformation ugi) {
  if (ugi == null || authMethod == AuthMethod.DIGEST) {
    // Don't send user for token auth
    return null;
  }
  UserInformation.Builder userInfoPB = UserInformation.newBuilder();
  if (authMethod == AuthMethod.KERBEROS) {
    // Send effective user for Kerberos auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
  } else if (authMethod == AuthMethod.SIMPLE) {
    //Send both effective user and real user for simple auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
    if (ugi.getRealUser() != null) {
      userInfoPB.setRealUser(ugi.getRealUser().getUserName());
    }
  }
  return userInfoPB.build();
}

项目：hbase 文件：ServerRpcConnection.java

private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws IOException {
  UserGroupInformation authorizedUgi;
  if (authMethod == AuthMethod.DIGEST) {
    TokenIdentifier tokenId = HBaseSaslRpcServer.getIdentifier(authorizedId,
        this.rpcServer.secretManager);
    authorizedUgi = tokenId.getUser();
    if (authorizedUgi == null) {
      throw new AccessDeniedException(
          "Can't retrieve username from tokenIdentifier.");
    }
    authorizedUgi.addTokenIdentifier(tokenId);
  } else {
    authorizedUgi = UserGroupInformation.createRemoteUser(authorizedId);
  }
  authorizedUgi.setAuthenticationMethod(authMethod.authenticationMethod.getAuthMethod());
  return authorizedUgi;
}

项目：hbase 文件：ServerRpcConnection.java

private boolean authorizeConnection() throws IOException {
  try {
    // If auth method is DIGEST, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (ugi != null && ugi.getRealUser() != null
        && (authMethod != AuthMethod.DIGEST)) {
      ProxyUsers.authorize(ugi, this.getHostAddress(), this.rpcServer.conf);
    }
    this.rpcServer.authorize(ugi, connectionHeader, getHostInetAddress());
    this.rpcServer.metrics.authorizationSuccess();
  } catch (AuthorizationException ae) {
    if (RpcServer.LOG.isDebugEnabled()) {
      RpcServer.LOG.debug("Connection authorization failed: " + ae.getMessage(), ae);
    }
    this.rpcServer.metrics.authorizationFailure();
    doRespond(getErrorResponse(ae.getMessage(), new AccessDeniedException(ae)));
    return false;
  }
  return true;
}

项目：hbase 文件：RpcConnection.java

private UserInformation getUserInfo(UserGroupInformation ugi) {
  if (ugi == null || authMethod == AuthMethod.DIGEST) {
    // Don't send user for token auth
    return null;
  }
  UserInformation.Builder userInfoPB = UserInformation.newBuilder();
  if (authMethod == AuthMethod.KERBEROS) {
    // Send effective user for Kerberos auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
  } else if (authMethod == AuthMethod.SIMPLE) {
    // Send both effective user and real user for simple auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
    if (ugi.getRealUser() != null) {
      userInfoPB.setRealUser(ugi.getRealUser().getUserName());
    }
  }
  return userInfoPB.build();
}

项目：PyroDB 文件：RpcServer.java

private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws IOException {
  if (authMethod == AuthMethod.DIGEST) {
    TokenIdentifier tokenId = HBaseSaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    UserGroupInformation ugi = tokenId.getUser();
    if (ugi == null) {
      throw new AccessControlException(
          "Can't retrieve username from tokenIdentifier.");
    }
    ugi.addTokenIdentifier(tokenId);
    return ugi;
  } else {
    return UserGroupInformation.createRemoteUser(authorizedId);
  }
}

项目：PyroDB 文件：RpcServer.java

private boolean authorizeConnection() throws IOException {
  try {
    // If auth method is DIGEST, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (user != null && user.getRealUser() != null
        && (authMethod != AuthMethod.DIGEST)) {
      ProxyUsers.authorize(user, this.getHostAddress(), conf);
    }
    authorize(user, connectionHeader, getHostInetAddress());
    if (LOG.isDebugEnabled()) {
      LOG.debug("Authorized " + TextFormat.shortDebugString(connectionHeader));
    }
    metrics.authorizationSuccess();
  } catch (AuthorizationException ae) {
    LOG.debug("Connection authorization failed: " + ae.getMessage(), ae);
    metrics.authorizationFailure();
    setupResponse(authFailedResponse, authFailedCall, ae, ae.getMessage());
    responder.doRespond(authFailedCall);
    return false;
  }
  return true;
}

项目：PyroDB 文件：RpcClient.java

private UserInformation getUserInfo(UserGroupInformation ugi) {
  if (ugi == null || authMethod == AuthMethod.DIGEST) {
    // Don't send user for token auth
    return null;
  }
  UserInformation.Builder userInfoPB = UserInformation.newBuilder();
  if (authMethod == AuthMethod.KERBEROS) {
    // Send effective user for Kerberos auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
  } else if (authMethod == AuthMethod.SIMPLE) {
    //Send both effective user and real user for simple auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
    if (ugi.getRealUser() != null) {
      userInfoPB.setRealUser(ugi.getRealUser().getUserName());
    }
  }
  return userInfoPB.build();
}

项目：c5 文件：RpcServer.java

private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws IOException {
  if (authMethod == AuthMethod.DIGEST) {
    TokenIdentifier tokenId = HBaseSaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    UserGroupInformation ugi = tokenId.getUser();
    if (ugi == null) {
      throw new AccessControlException(
          "Can't retrieve username from tokenIdentifier.");
    }
    ugi.addTokenIdentifier(tokenId);
    return ugi;
  } else {
    return UserGroupInformation.createRemoteUser(authorizedId);
  }
}

项目：c5 文件：RpcServer.java

private boolean authorizeConnection() throws IOException {
  try {
    // If auth method is DIGEST, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (user != null && user.getRealUser() != null
        && (authMethod != AuthMethod.DIGEST)) {
      ProxyUsers.authorize(user, this.getHostAddress(), conf);
    }
    authorize(user, connectionHeader, getHostInetAddress());
    if (LOG.isDebugEnabled()) {
      LOG.debug("Authorized " + TextFormat.shortDebugString(connectionHeader));
    }
    metrics.authorizationSuccess();
  } catch (AuthorizationException ae) {
    LOG.debug("Connection authorization failed: " + ae.getMessage(), ae);
    metrics.authorizationFailure();
    setupResponse(authFailedResponse, authFailedCall, ae, ae.getMessage());
    responder.doRespond(authFailedCall);
    return false;
  }
  return true;
}

项目：c5 文件：RpcClient.java

private UserInformation getUserInfo(UserGroupInformation ugi) {
  if (ugi == null || authMethod == AuthMethod.DIGEST) {
    // Don't send user for token auth
    return null;
  }
  UserInformation.Builder userInfoPB = UserInformation.newBuilder();
  if (authMethod == AuthMethod.KERBEROS) {
    // Send effective user for Kerberos auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
  } else if (authMethod == AuthMethod.SIMPLE) {
    //Send both effective user and real user for simple auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
    if (ugi.getRealUser() != null) {
      userInfoPB.setRealUser(ugi.getRealUser().getUserName());
    }
  }
  return userInfoPB.build();
}

项目：async-hbase-client 文件：AsyncRpcChannel.java

/**
 * Build the user information
 *
 * @param ugi        User Group Information
 * @param authMethod Authorization method
 * @return UserInformation protobuf
 */
private RPCProtos.UserInformation buildUserInfo(UserGroupInformation ugi, AuthMethod authMethod) {
  if (ugi == null || authMethod == AuthMethod.DIGEST) {
    // Don't send user for token auth
    return null;
  }
  RPCProtos.UserInformation.Builder userInfoPB = RPCProtos.UserInformation.newBuilder();
  if (authMethod == AuthMethod.KERBEROS) {
    // Send effective user for Kerberos auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
  } else if (authMethod == AuthMethod.SIMPLE) {
    //Send both effective user and real user for simple auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
    if (ugi.getRealUser() != null) {
      userInfoPB.setRealUser(ugi.getRealUser().getUserName());
    }
  }
  return userInfoPB.build();
}

项目：ditb 文件：RpcClientImpl.java

private synchronized boolean shouldAuthenticateOverKrb() throws IOException {
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  UserGroupInformation currentUser =
    UserGroupInformation.getCurrentUser();
  UserGroupInformation realUser = currentUser.getRealUser();
  return authMethod == AuthMethod.KERBEROS &&
      loginUser != null &&
      //Make sure user logged in using Kerberos either keytab or TGT
      loginUser.hasKerberosCredentials() &&
      // relogin only in case it is the login user (e.g. JT)
      // or superuser (like oozie).
      (loginUser.equals(currentUser) || loginUser.equals(realUser));
}

项目：ditb 文件：AsyncRpcChannel.java

/**
 * Check if user should authenticate over Kerberos
 *
 * @return true if should be authenticated over Kerberos
 * @throws java.io.IOException on failure of check
 */
private synchronized boolean shouldAuthenticateOverKrb() throws IOException {
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  UserGroupInformation currentUser = UserGroupInformation.getCurrentUser();
  UserGroupInformation realUser = currentUser.getRealUser();
  return authMethod == AuthMethod.KERBEROS &&
      loginUser != null &&
      //Make sure user logged in using Kerberos either keytab or TGT
      loginUser.hasKerberosCredentials() &&
      // relogin only in case it is the login user (e.g. JT)
      // or superuser (like oozie).
      (loginUser.equals(currentUser) || loginUser.equals(realUser));
}

项目：pbase 文件：RpcServer.java

private void processConnectionHeader(byte[] buf) throws IOException {
  this.connectionHeader = ConnectionHeader.parseFrom(buf);
  String serviceName = connectionHeader.getServiceName();
  if (serviceName == null) throw new EmptyServiceNameException();
  this.service = getService(services, serviceName);
  if (this.service == null) throw new UnknownServiceException(serviceName);
  setupCellBlockCodecs(this.connectionHeader);
  UserGroupInformation protocolUser = createUser(connectionHeader);
  if (!useSasl) {
    user = protocolUser;
    if (user != null) {
      user.setAuthenticationMethod(AuthMethod.SIMPLE.authenticationMethod);
    }
  } else {
    // user is authenticated
    user.setAuthenticationMethod(authMethod.authenticationMethod);
    //Now we check if this is a proxy user case. If the protocol user is
    //different from the 'user', it is a proxy user scenario. However,
    //this is not allowed if user authenticated with DIGEST.
    if ((protocolUser != null)
        && (!protocolUser.getUserName().equals(user.getUserName()))) {
      if (authMethod == AuthMethod.DIGEST) {
        // Not allowed to doAs if token authentication is used
        throw new AccessDeniedException("Authenticated user (" + user
            + ") doesn't match what the client claims to be ("
            + protocolUser + ")");
      } else {
        // Effective user can be different from authenticated user
        // for simple auth or kerberos auth
        // The user is the real user. Now we create a proxy user
        UserGroupInformation realUser = user;
        user = UserGroupInformation.createProxyUser(protocolUser
            .getUserName(), realUser);
        // Now the user is a proxy user, set Authentication method Proxy.
        user.setAuthenticationMethod(AuthenticationMethod.PROXY);
      }
    }
  }
}

项目：pbase 文件：RpcClientImpl.java

private synchronized boolean shouldAuthenticateOverKrb() throws IOException {
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  UserGroupInformation currentUser =
    UserGroupInformation.getCurrentUser();
  UserGroupInformation realUser = currentUser.getRealUser();
  return authMethod == AuthMethod.KERBEROS &&
      loginUser != null &&
      //Make sure user logged in using Kerberos either keytab or TGT
      loginUser.hasKerberosCredentials() &&
      // relogin only in case it is the login user (e.g. JT)
      // or superuser (like oozie).
      (loginUser.equals(currentUser) || loginUser.equals(realUser));
}

项目：HIndex 文件：RpcServer.java

private void processConnectionHeader(byte[] buf) throws IOException {
  this.connectionHeader = ConnectionHeader.parseFrom(buf);
  String serviceName = connectionHeader.getServiceName();
  if (serviceName == null) throw new EmptyServiceNameException();
  this.service = getService(services, serviceName);
  if (this.service == null) throw new UnknownServiceException(serviceName);
  setupCellBlockCodecs(this.connectionHeader);
  UserGroupInformation protocolUser = createUser(connectionHeader);
  if (!useSasl) {
    user = protocolUser;
    if (user != null) {
      user.setAuthenticationMethod(AuthMethod.SIMPLE.authenticationMethod);
    }
  } else {
    // user is authenticated
    user.setAuthenticationMethod(authMethod.authenticationMethod);
    //Now we check if this is a proxy user case. If the protocol user is
    //different from the 'user', it is a proxy user scenario. However,
    //this is not allowed if user authenticated with DIGEST.
    if ((protocolUser != null)
        && (!protocolUser.getUserName().equals(user.getUserName()))) {
      if (authMethod == AuthMethod.DIGEST) {
        // Not allowed to doAs if token authentication is used
        throw new AccessControlException("Authenticated user (" + user
            + ") doesn't match what the client claims to be ("
            + protocolUser + ")");
      } else {
        // Effective user can be different from authenticated user
        // for simple auth or kerberos auth
        // The user is the real user. Now we create a proxy user
        UserGroupInformation realUser = user;
        user = UserGroupInformation.createProxyUser(protocolUser
            .getUserName(), realUser);
        // Now the user is a proxy user, set Authentication method Proxy.
        user.setAuthenticationMethod(AuthenticationMethod.PROXY);
      }
    }
  }
}

项目：HIndex 文件：RpcClient.java

private synchronized boolean shouldAuthenticateOverKrb() throws IOException {
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  UserGroupInformation currentUser =
    UserGroupInformation.getCurrentUser();
  UserGroupInformation realUser = currentUser.getRealUser();
  return authMethod == AuthMethod.KERBEROS &&
      loginUser != null &&
      //Make sure user logged in using Kerberos either keytab or TGT
      loginUser.hasKerberosCredentials() &&
      // relogin only in case it is the login user (e.g. JT)
      // or superuser (like oozie).
      (loginUser.equals(currentUser) || loginUser.equals(realUser));
}

项目：hbase 文件：TestRpcServerSlowConnectionSetup.java

@Test
public void test() throws IOException, InterruptedException {
  int rpcHeaderLen = HConstants.RPC_HEADER.length;
  byte[] preamble = new byte[rpcHeaderLen + 2];
  System.arraycopy(HConstants.RPC_HEADER, 0, preamble, 0, rpcHeaderLen);
  preamble[rpcHeaderLen] = HConstants.RPC_CURRENT_VERSION;
  preamble[rpcHeaderLen + 1] = AuthMethod.SIMPLE.code;
  socket.getOutputStream().write(preamble, 0, rpcHeaderLen + 1);
  socket.getOutputStream().flush();
  Thread.sleep(5000);
  socket.getOutputStream().write(preamble, rpcHeaderLen + 1, 1);
  socket.getOutputStream().flush();

  ConnectionHeader header = ConnectionHeader.newBuilder()
      .setServiceName(TestRpcServiceProtos.TestProtobufRpcProto.getDescriptor().getFullName())
      .setVersionInfo(ProtobufUtil.getVersionInfo()).build();
  DataOutputStream dos = new DataOutputStream(socket.getOutputStream());
  dos.writeInt(header.getSerializedSize());
  header.writeTo(dos);
  dos.flush();

  int callId = 10;
  Call call = new Call(callId, TestProtobufRpcProto.getDescriptor().findMethodByName("ping"),
      EmptyRequestProto.getDefaultInstance(), null, EmptyResponseProto.getDefaultInstance(), 1000,
      HConstants.NORMAL_QOS, null, MetricsConnection.newCallStats());
  RequestHeader requestHeader = IPCUtil.buildRequestHeader(call, null);
  dos.writeInt(IPCUtil.getTotalSizeWhenWrittenDelimited(requestHeader, call.param));
  requestHeader.writeDelimitedTo(dos);
  call.param.writeDelimitedTo(dos);
  dos.flush();

  DataInputStream dis = new DataInputStream(new BufferedInputStream(socket.getInputStream()));
  int size = dis.readInt();
  ResponseHeader responseHeader = ResponseHeader.parseDelimitedFrom(dis);
  assertEquals(callId, responseHeader.getCallId());
  EmptyResponseProto.Builder builder = EmptyResponseProto.newBuilder();
  builder.mergeDelimitedFrom(dis);
  assertEquals(size, IPCUtil.getTotalSizeWhenWrittenDelimited(responseHeader, builder.build()));
}

项目：hbase 文件：RpcConnection.java

protected UserGroupInformation getUGI() {
  UserGroupInformation ticket = remoteId.getTicket().getUGI();
  if (authMethod == AuthMethod.KERBEROS) {
    if (ticket != null && ticket.getRealUser() != null) {
      ticket = ticket.getRealUser();
    }
  }
  return ticket;
}

项目：hbase 文件：RpcConnection.java

protected boolean shouldAuthenticateOverKrb() throws IOException {
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  UserGroupInformation currentUser = UserGroupInformation.getCurrentUser();
  UserGroupInformation realUser = currentUser.getRealUser();
  return authMethod == AuthMethod.KERBEROS && loginUser != null &&
  // Make sure user logged in using Kerberos either keytab or TGT
      loginUser.hasKerberosCredentials() &&
      // relogin only in case it is the login user (e.g. JT)
      // or superuser (like oozie).
      (loginUser.equals(currentUser) || loginUser.equals(realUser));
}

项目：PyroDB 文件：RpcServer.java

private void processConnectionHeader(byte[] buf) throws IOException {
  this.connectionHeader = ConnectionHeader.parseFrom(buf);
  String serviceName = connectionHeader.getServiceName();
  if (serviceName == null) throw new EmptyServiceNameException();
  this.service = getService(services, serviceName);
  if (this.service == null) throw new UnknownServiceException(serviceName);
  setupCellBlockCodecs(this.connectionHeader);
  UserGroupInformation protocolUser = createUser(connectionHeader);
  if (!useSasl) {
    user = protocolUser;
    if (user != null) {
      user.setAuthenticationMethod(AuthMethod.SIMPLE.authenticationMethod);
    }
  } else {
    // user is authenticated
    user.setAuthenticationMethod(authMethod.authenticationMethod);
    //Now we check if this is a proxy user case. If the protocol user is
    //different from the 'user', it is a proxy user scenario. However,
    //this is not allowed if user authenticated with DIGEST.
    if ((protocolUser != null)
        && (!protocolUser.getUserName().equals(user.getUserName()))) {
      if (authMethod == AuthMethod.DIGEST) {
        // Not allowed to doAs if token authentication is used
        throw new AccessControlException("Authenticated user (" + user
            + ") doesn't match what the client claims to be ("
            + protocolUser + ")");
      } else {
        // Effective user can be different from authenticated user
        // for simple auth or kerberos auth
        // The user is the real user. Now we create a proxy user
        UserGroupInformation realUser = user;
        user = UserGroupInformation.createProxyUser(protocolUser
            .getUserName(), realUser);
        // Now the user is a proxy user, set Authentication method Proxy.
        user.setAuthenticationMethod(AuthenticationMethod.PROXY);
      }
    }
  }
}

项目：PyroDB 文件：RpcClient.java

private synchronized boolean shouldAuthenticateOverKrb() throws IOException {
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  UserGroupInformation currentUser =
    UserGroupInformation.getCurrentUser();
  UserGroupInformation realUser = currentUser.getRealUser();
  return authMethod == AuthMethod.KERBEROS &&
      loginUser != null &&
      //Make sure user logged in using Kerberos either keytab or TGT
      loginUser.hasKerberosCredentials() &&
      // relogin only in case it is the login user (e.g. JT)
      // or superuser (like oozie).
      (loginUser.equals(currentUser) || loginUser.equals(realUser));
}

项目：c5 文件：RpcServer.java

private void processConnectionHeader(byte[] buf) throws IOException {
  this.connectionHeader = ConnectionHeader.parseFrom(buf);
  String serviceName = connectionHeader.getServiceName();
  if (serviceName == null) throw new EmptyServiceNameException();
  this.service = getService(services, serviceName);
  if (this.service == null) throw new UnknownServiceException(serviceName);
  setupCellBlockCodecs(this.connectionHeader);
  UserGroupInformation protocolUser = createUser(connectionHeader);
  if (!useSasl) {
    user = protocolUser;
    if (user != null) {
      user.setAuthenticationMethod(AuthMethod.SIMPLE.authenticationMethod);
    }
  } else {
    // user is authenticated
    user.setAuthenticationMethod(authMethod.authenticationMethod);
    //Now we check if this is a proxy user case. If the protocol user is
    //different from the 'user', it is a proxy user scenario. However,
    //this is not allowed if user authenticated with DIGEST.
    if ((protocolUser != null)
        && (!protocolUser.getUserName().equals(user.getUserName()))) {
      if (authMethod == AuthMethod.DIGEST) {
        // Not allowed to doAs if token authentication is used
        throw new AccessControlException("Authenticated user (" + user
            + ") doesn't match what the client claims to be ("
            + protocolUser + ")");
      } else {
        // Effective user can be different from authenticated user
        // for simple auth or kerberos auth
        // The user is the real user. Now we create a proxy user
        UserGroupInformation realUser = user;
        user = UserGroupInformation.createProxyUser(protocolUser
            .getUserName(), realUser);
        // Now the user is a proxy user, set Authentication method Proxy.
        user.setAuthenticationMethod(AuthenticationMethod.PROXY);
      }
    }
  }
}

项目：c5 文件：RpcClient.java

private synchronized boolean shouldAuthenticateOverKrb() throws IOException {
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  UserGroupInformation currentUser =
    UserGroupInformation.getCurrentUser();
  UserGroupInformation realUser = currentUser.getRealUser();
  return authMethod == AuthMethod.KERBEROS &&
      loginUser != null &&
      //Make sure user logged in using Kerberos either keytab or TGT
      loginUser.hasKerberosCredentials() &&
      // relogin only in case it is the login user (e.g. JT)
      // or superuser (like oozie).
      (loginUser.equals(currentUser) || loginUser.equals(realUser));
}

项目：async-hbase-client 文件：AsyncRpcChannel.java

/**
 * Check if user should authenticate over Kerberos
 *
 * @return true if should be authenticated over Kerberos
 * @throws java.io.IOException on failure of check
 */
private synchronized boolean shouldAuthenticateOverKrb() throws IOException {
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  UserGroupInformation currentUser = UserGroupInformation.getCurrentUser();
  UserGroupInformation realUser = currentUser.getRealUser();
  return authMethod == AuthMethod.KERBEROS &&
      loginUser != null &&
      //Make sure user logged in using Kerberos either keytab or TGT
      loginUser.hasKerberosCredentials() &&
      // relogin only in case it is the login user (e.g. JT)
      // or superuser (like oozie).
      (loginUser.equals(currentUser) || loginUser.equals(realUser));
}

项目：ditb 文件：RpcServer.java

private void processConnectionHeader(byte[] buf) throws IOException {
  this.connectionHeader = ConnectionHeader.parseFrom(buf);
  String serviceName = connectionHeader.getServiceName();
  if (serviceName == null) throw new EmptyServiceNameException();
  this.service = getService(services, serviceName);
  if (this.service == null) throw new UnknownServiceException(serviceName);
  setupCellBlockCodecs(this.connectionHeader);
  UserGroupInformation protocolUser = createUser(connectionHeader);
  if (!useSasl) {
    ugi = protocolUser;
    if (ugi != null) {
      ugi.setAuthenticationMethod(AuthMethod.SIMPLE.authenticationMethod);
    }
    // audit logging for SASL authenticated users happens in saslReadAndProcess()
    if (authenticatedWithFallback) {
      LOG.warn("Allowed fallback to SIMPLE auth for " + ugi
          + " connecting from " + getHostAddress());
    }
    AUDITLOG.info(AUTH_SUCCESSFUL_FOR + ugi);
  } else {
    // user is authenticated
    ugi.setAuthenticationMethod(authMethod.authenticationMethod);
    //Now we check if this is a proxy user case. If the protocol user is
    //different from the 'user', it is a proxy user scenario. However,
    //this is not allowed if user authenticated with DIGEST.
    if ((protocolUser != null)
        && (!protocolUser.getUserName().equals(ugi.getUserName()))) {
      if (authMethod == AuthMethod.DIGEST) {
        // Not allowed to doAs if token authentication is used
        throw new AccessDeniedException("Authenticated user (" + ugi
            + ") doesn't match what the client claims to be ("
            + protocolUser + ")");
      } else {
        // Effective user can be different from authenticated user
        // for simple auth or kerberos auth
        // The user is the real user. Now we create a proxy user
        UserGroupInformation realUser = ugi;
        ugi = UserGroupInformation.createProxyUser(protocolUser
            .getUserName(), realUser);
        // Now the user is a proxy user, set Authentication method Proxy.
        ugi.setAuthenticationMethod(AuthenticationMethod.PROXY);
      }
    }
  }
  if (connectionHeader.hasVersionInfo()) {
    // see if this connection will support RetryImmediatelyException
    retryImmediatelySupported = VersionInfoUtil.hasMinimumVersion(getVersionInfo(), 1, 2);

    AUDITLOG.info("Connection from " + this.hostAddress + " port: " + this.remotePort
        + " with version info: "
        + TextFormat.shortDebugString(connectionHeader.getVersionInfo()));
  } else {
    AUDITLOG.info("Connection from " + this.hostAddress + " port: " + this.remotePort
        + " with unknown version info");
  }


}

项目：ditb 文件：RpcClientImpl.java

Connection(ConnectionId remoteId, final Codec codec, final CompressionCodec compressor)
throws IOException {
  if (remoteId.getAddress().isUnresolved()) {
    throw new UnknownHostException("unknown host: " + remoteId.getAddress().getHostName());
  }
  this.server = remoteId.getAddress();
  this.codec = codec;
  this.compressor = compressor;

  UserGroupInformation ticket = remoteId.getTicket().getUGI();
  SecurityInfo securityInfo = SecurityInfo.getInfo(remoteId.getServiceName());
  this.useSasl = userProvider.isHBaseSecurityEnabled();
  if (useSasl && securityInfo != null) {
    AuthenticationProtos.TokenIdentifier.Kind tokenKind = securityInfo.getTokenKind();
    if (tokenKind != null) {
      TokenSelector<? extends TokenIdentifier> tokenSelector =
          tokenHandlers.get(tokenKind);
      if (tokenSelector != null) {
        token = tokenSelector.selectToken(new Text(clusterId),
            ticket.getTokens());
      } else if (LOG.isDebugEnabled()) {
        LOG.debug("No token selector found for type "+tokenKind);
      }
    }
    String serverKey = securityInfo.getServerPrincipal();
    if (serverKey == null) {
      throw new IOException(
          "Can't obtain server Kerberos config key from SecurityInfo");
    }
    serverPrincipal = SecurityUtil.getServerPrincipal(
        conf.get(serverKey), server.getAddress().getCanonicalHostName().toLowerCase());
    if (LOG.isDebugEnabled()) {
      LOG.debug("RPC Server Kerberos principal name for service="
          + remoteId.getServiceName() + " is " + serverPrincipal);
    }
  }

  if (!useSasl) {
    authMethod = AuthMethod.SIMPLE;
  } else if (token != null) {
    authMethod = AuthMethod.DIGEST;
  } else {
    authMethod = AuthMethod.KERBEROS;
  }

  if (LOG.isDebugEnabled()) {
    LOG.debug("Use " + authMethod + " authentication for service " + remoteId.serviceName +
      ", sasl=" + useSasl);
  }
  reloginMaxBackoff = conf.getInt("hbase.security.relogin.maxbackoff", 5000);
  this.remoteId = remoteId;

  ConnectionHeader.Builder builder = ConnectionHeader.newBuilder();
  builder.setServiceName(remoteId.getServiceName());
  UserInformation userInfoPB = getUserInfo(ticket);
  if (userInfoPB != null) {
    builder.setUserInfo(userInfoPB);
  }
  if (this.codec != null) {
    builder.setCellBlockCodecClass(this.codec.getClass().getCanonicalName());
  }
  if (this.compressor != null) {
    builder.setCellBlockCompressorClass(this.compressor.getClass().getCanonicalName());
  }
  builder.setVersionInfo(ProtobufUtil.getVersionInfo());
  this.header = builder.build();

  this.setName("IPC Client (" + socketFactory.hashCode() +") connection to " +
    remoteId.getAddress().toString() +
    ((ticket==null)?" from an unknown user": (" from "
    + ticket.getUserName())));
  this.setDaemon(true);

  if (conf.getBoolean(SPECIFIC_WRITE_THREAD, false)) {
    callSender = new CallSender(getName(), conf);
    callSender.start();
  } else {
    callSender = null;
  }
}

项目：ditb 文件：AsyncRpcChannel.java

/**
 * Connect to channel
 *
 * @param bootstrap to connect to
 * @return future of connection
 */
private ChannelFuture connect(final Bootstrap bootstrap) {
  return bootstrap.remoteAddress(address).connect()
      .addListener(new GenericFutureListener<ChannelFuture>() {
        @Override
        public void operationComplete(final ChannelFuture f) throws Exception {
          if (!f.isSuccess()) {
            if (f.cause() instanceof SocketException) {
              retryOrClose(bootstrap, connectFailureCounter++, f.cause());
            } else {
              retryOrClose(bootstrap, ioFailureCounter++, f.cause());
            }
            return;
          }
          channel = f.channel();

          setupAuthorization();

          ByteBuf b = channel.alloc().directBuffer(6);
          createPreamble(b, authMethod);
          channel.writeAndFlush(b).addListener(ChannelFutureListener.CLOSE_ON_FAILURE);
          if (useSasl) {
            UserGroupInformation ticket = AsyncRpcChannel.this.ticket.getUGI();
            if (authMethod == AuthMethod.KERBEROS) {
              if (ticket != null && ticket.getRealUser() != null) {
                ticket = ticket.getRealUser();
              }
            }
            SaslClientHandler saslHandler;
            if (ticket == null) {
              throw new FatalConnectionException("ticket/user is null");
            }
            final UserGroupInformation realTicket = ticket;
            saslHandler = ticket.doAs(new PrivilegedExceptionAction<SaslClientHandler>() {
              @Override
              public SaslClientHandler run() throws IOException {
                return getSaslHandler(realTicket, bootstrap);
              }
            });
            if (saslHandler != null) {
              // Sasl connect is successful. Let's set up Sasl channel handler
              channel.pipeline().addFirst(saslHandler);
            } else {
              // fall back to simple auth because server told us so.
              authMethod = AuthMethod.SIMPLE;
              useSasl = false;
            }
          } else {
            startHBaseConnection(f.channel());
          }
        }
      });
}

项目：ditb 文件：AsyncRpcChannel.java

/**
 * Set up server authorization
 *
 * @throws java.io.IOException if auth setup failed
 */
private void setupAuthorization() throws IOException {
  SecurityInfo securityInfo = SecurityInfo.getInfo(serviceName);
  this.useSasl = client.userProvider.isHBaseSecurityEnabled();

  this.token = null;
  if (useSasl && securityInfo != null) {
    AuthenticationProtos.TokenIdentifier.Kind tokenKind = securityInfo.getTokenKind();
    if (tokenKind != null) {
      TokenSelector<? extends TokenIdentifier> tokenSelector = tokenHandlers.get(tokenKind);
      if (tokenSelector != null) {
        token = tokenSelector
            .selectToken(new Text(client.clusterId), ticket.getUGI().getTokens());
      } else if (LOG.isDebugEnabled()) {
        LOG.debug("No token selector found for type " + tokenKind);
      }
    }
    String serverKey = securityInfo.getServerPrincipal();
    if (serverKey == null) {
      throw new IOException("Can't obtain server Kerberos config key from SecurityInfo");
    }
    this.serverPrincipal = SecurityUtil.getServerPrincipal(client.conf.get(serverKey),
        address.getAddress().getCanonicalHostName().toLowerCase());
    if (LOG.isDebugEnabled()) {
      LOG.debug("RPC Server Kerberos principal name for service=" + serviceName + " is "
          + serverPrincipal);
    }
  }

  if (!useSasl) {
    authMethod = AuthMethod.SIMPLE;
  } else if (token != null) {
    authMethod = AuthMethod.DIGEST;
  } else {
    authMethod = AuthMethod.KERBEROS;
  }

  if (LOG.isDebugEnabled()) {
    LOG.debug("Use " + authMethod + " authentication for service " + serviceName +
        ", sasl=" + useSasl);
  }
  reloginMaxBackoff = client.conf.getInt("hbase.security.relogin.maxbackoff", 5000);
}

项目：pbase 文件：RpcClientImpl.java

Connection(ConnectionId remoteId, final Codec codec, final CompressionCodec compressor)
throws IOException {
  if (remoteId.getAddress().isUnresolved()) {
    throw new UnknownHostException("unknown host: " + remoteId.getAddress().getHostName());
  }
  this.server = remoteId.getAddress();
  this.codec = codec;
  this.compressor = compressor;

  UserGroupInformation ticket = remoteId.getTicket().getUGI();
  SecurityInfo securityInfo = SecurityInfo.getInfo(remoteId.getServiceName());
  this.useSasl = userProvider.isHBaseSecurityEnabled();
  if (useSasl && securityInfo != null) {
    AuthenticationProtos.TokenIdentifier.Kind tokenKind = securityInfo.getTokenKind();
    if (tokenKind != null) {
      TokenSelector<? extends TokenIdentifier> tokenSelector =
          tokenHandlers.get(tokenKind);
      if (tokenSelector != null) {
        token = tokenSelector.selectToken(new Text(clusterId),
            ticket.getTokens());
      } else if (LOG.isDebugEnabled()) {
        LOG.debug("No token selector found for type "+tokenKind);
      }
    }
    String serverKey = securityInfo.getServerPrincipal();
    if (serverKey == null) {
      throw new IOException(
          "Can't obtain server Kerberos config key from SecurityInfo");
    }
    serverPrincipal = SecurityUtil.getServerPrincipal(
        conf.get(serverKey), server.getAddress().getCanonicalHostName().toLowerCase());
    if (LOG.isDebugEnabled()) {
      LOG.debug("RPC Server Kerberos principal name for service="
          + remoteId.getServiceName() + " is " + serverPrincipal);
    }
  }

  if (!useSasl) {
    authMethod = AuthMethod.SIMPLE;
  } else if (token != null) {
    authMethod = AuthMethod.DIGEST;
  } else {
    authMethod = AuthMethod.KERBEROS;
  }

  if (LOG.isDebugEnabled()) {
    LOG.debug("Use " + authMethod + " authentication for service " + remoteId.serviceName +
      ", sasl=" + useSasl);
  }
  reloginMaxBackoff = conf.getInt("hbase.security.relogin.maxbackoff", 5000);
  this.remoteId = remoteId;

  ConnectionHeader.Builder builder = ConnectionHeader.newBuilder();
  builder.setServiceName(remoteId.getServiceName());
  UserInformation userInfoPB = getUserInfo(ticket);
  if (userInfoPB != null) {
    builder.setUserInfo(userInfoPB);
  }
  if (this.codec != null) {
    builder.setCellBlockCodecClass(this.codec.getClass().getCanonicalName());
  }
  if (this.compressor != null) {
    builder.setCellBlockCompressorClass(this.compressor.getClass().getCanonicalName());
  }
  this.header = builder.build();

  this.setName("IPC Client (" + socketFactory.hashCode() +") connection to " +
    remoteId.getAddress().toString() +
    ((ticket==null)?" from an unknown user": (" from "
    + ticket.getUserName())));
  this.setDaemon(true);

  if (conf.getBoolean(SPECIFIC_WRITE_THREAD, false)) {
    callSender = new CallSender(getName(), conf);
    callSender.start();
  } else {
    callSender = null;
  }
}

项目：HIndex 文件：RpcClient.java

Connection(ConnectionId remoteId, final Codec codec, final CompressionCodec compressor)
throws IOException {
  if (remoteId.getAddress().isUnresolved()) {
    throw new UnknownHostException("unknown host: " + remoteId.getAddress().getHostName());
  }
  this.server = remoteId.getAddress();
  this.codec = codec;
  this.compressor = compressor;

  UserGroupInformation ticket = remoteId.getTicket().getUGI();
  SecurityInfo securityInfo = SecurityInfo.getInfo(remoteId.getServiceName());
  this.useSasl = userProvider.isHBaseSecurityEnabled();
  if (useSasl && securityInfo != null) {
    AuthenticationProtos.TokenIdentifier.Kind tokenKind = securityInfo.getTokenKind();
    if (tokenKind != null) {
      TokenSelector<? extends TokenIdentifier> tokenSelector =
          tokenHandlers.get(tokenKind);
      if (tokenSelector != null) {
        token = tokenSelector.selectToken(new Text(clusterId),
            ticket.getTokens());
      } else if (LOG.isDebugEnabled()) {
        LOG.debug("No token selector found for type "+tokenKind);
      }
    }
    String serverKey = securityInfo.getServerPrincipal();
    if (serverKey == null) {
      throw new IOException(
          "Can't obtain server Kerberos config key from SecurityInfo");
    }
    serverPrincipal = SecurityUtil.getServerPrincipal(
        conf.get(serverKey), server.getAddress().getCanonicalHostName().toLowerCase());
    if (LOG.isDebugEnabled()) {
      LOG.debug("RPC Server Kerberos principal name for service="
          + remoteId.getServiceName() + " is " + serverPrincipal);
    }
  }

  if (!useSasl) {
    authMethod = AuthMethod.SIMPLE;
  } else if (token != null) {
    authMethod = AuthMethod.DIGEST;
  } else {
    authMethod = AuthMethod.KERBEROS;
  }

  if (LOG.isDebugEnabled()) {
    LOG.debug("Use " + authMethod + " authentication for service " + remoteId.serviceName +
      ", sasl=" + useSasl);
  }
  reloginMaxBackoff = conf.getInt("hbase.security.relogin.maxbackoff", 5000);
  this.remoteId = remoteId;

  ConnectionHeader.Builder builder = ConnectionHeader.newBuilder();
  builder.setServiceName(remoteId.getServiceName());
  UserInformation userInfoPB;
  if ((userInfoPB = getUserInfo(ticket)) != null) {
    builder.setUserInfo(userInfoPB);
  }
  if (this.codec != null) {
    builder.setCellBlockCodecClass(this.codec.getClass().getCanonicalName());
  }
  if (this.compressor != null) {
    builder.setCellBlockCompressorClass(this.compressor.getClass().getCanonicalName());
  }
  this.header = builder.build();

  this.setName("IPC Client (" + socketFactory.hashCode() +") connection to " +
    remoteId.getAddress().toString() +
    ((ticket==null)?" from an unknown user": (" from "
    + ticket.getUserName())));
  this.setDaemon(true);
}