001/** 002 * Licensed to the Apache Software Foundation (ASF) under one or more 003 * contributor license agreements. See the NOTICE file distributed with this 004 * work for additional information regarding copyright ownership. The ASF 005 * licenses this file to you under the Apache License, Version 2.0 (the 006 * "License"); you may not use this file except in compliance with the License. 007 * You may obtain a copy of the License at 008 * 009 * http://www.apache.org/licenses/LICENSE-2.0 010 * 011 * Unless required by applicable law or agreed to in writing, software 012 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 013 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the 014 * License for the specific language governing permissions and limitations under 015 * the License. 016 */ 017package org.apache.hadoop.hdfs.server.namenode; 018 019import java.io.DataOutputStream; 020import java.io.IOException; 021import java.security.PrivilegedExceptionAction; 022 023import javax.servlet.ServletContext; 024import javax.servlet.ServletException; 025import javax.servlet.http.HttpServletRequest; 026import javax.servlet.http.HttpServletResponse; 027 028import org.apache.commons.logging.Log; 029import org.apache.commons.logging.LogFactory; 030import org.apache.hadoop.conf.Configuration; 031import org.apache.hadoop.hdfs.security.token.delegation.DelegationTokenSecretManager; 032import org.apache.hadoop.security.Credentials; 033import org.apache.hadoop.security.UserGroupInformation; 034 035/** 036 * Serve delegation tokens over http for use in hftp. 037 */ 038@SuppressWarnings("serial") 039public class GetDelegationTokenServlet extends DfsServlet { 040 private static final Log LOG = LogFactory.getLog(GetDelegationTokenServlet.class); 041 public static final String PATH_SPEC = "/getDelegationToken"; 042 public static final String RENEWER = "renewer"; 043 044 @Override 045 protected void doGet(final HttpServletRequest req, final HttpServletResponse resp) 046 throws ServletException, IOException { 047 final UserGroupInformation ugi; 048 final ServletContext context = getServletContext(); 049 final Configuration conf = NameNodeHttpServer.getConfFromContext(context); 050 try { 051 ugi = getUGI(req, conf); 052 } catch(IOException ioe) { 053 LOG.info("Request for token received with no authentication from " 054 + req.getRemoteAddr(), ioe); 055 resp.sendError(HttpServletResponse.SC_FORBIDDEN, 056 "Unable to identify or authenticate user"); 057 return; 058 } 059 LOG.info("Sending token: {" + ugi.getUserName() + "," + req.getRemoteAddr() +"}"); 060 final NameNode nn = NameNodeHttpServer.getNameNodeFromContext(context); 061 String renewer = req.getParameter(RENEWER); 062 final String renewerFinal = (renewer == null) ? 063 req.getUserPrincipal().getName() : renewer; 064 065 DataOutputStream dos = null; 066 try { 067 dos = new DataOutputStream(resp.getOutputStream()); 068 final DataOutputStream dosFinal = dos; // for doAs block 069 ugi.doAs(new PrivilegedExceptionAction<Void>() { 070 @Override 071 public Void run() throws IOException { 072 final Credentials ts = DelegationTokenSecretManager.createCredentials( 073 nn, ugi, renewerFinal); 074 ts.write(dosFinal); 075 return null; 076 } 077 }); 078 079 } catch(Exception e) { 080 LOG.info("Exception while sending token. Re-throwing ", e); 081 resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR); 082 } finally { 083 if(dos != null) dos.close(); 084 } 085 } 086}