001/** 002 * Licensed to the Apache Software Foundation (ASF) under one or more 003 * contributor license agreements. See the NOTICE file distributed with this 004 * work for additional information regarding copyright ownership. The ASF 005 * licenses this file to you under the Apache License, Version 2.0 (the 006 * "License"); you may not use this file except in compliance with the License. 007 * You may obtain a copy of the License at 008 * 009 * http://www.apache.org/licenses/LICENSE-2.0 010 * 011 * Unless required by applicable law or agreed to in writing, software 012 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 013 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the 014 * License for the specific language governing permissions and limitations under 015 * the License. 016 */ 017package org.apache.hadoop.hdfs.server.namenode; 018 019import java.io.IOException; 020import java.security.PrivilegedExceptionAction; 021 022import javax.servlet.ServletContext; 023import javax.servlet.ServletException; 024import javax.servlet.http.HttpServletRequest; 025import javax.servlet.http.HttpServletResponse; 026 027import org.apache.commons.logging.Log; 028import org.apache.commons.logging.LogFactory; 029import org.apache.hadoop.conf.Configuration; 030import org.apache.hadoop.hdfs.security.token.delegation.DelegationTokenIdentifier; 031import org.apache.hadoop.security.UserGroupInformation; 032import org.apache.hadoop.security.token.Token; 033 034/** 035 * Cancel delegation tokens over http for use in hftp. 036 */ 037@SuppressWarnings("serial") 038public class CancelDelegationTokenServlet extends DfsServlet { 039 private static final Log LOG = LogFactory.getLog(CancelDelegationTokenServlet.class); 040 public static final String PATH_SPEC = "/cancelDelegationToken"; 041 public static final String TOKEN = "token"; 042 043 @Override 044 protected void doGet(final HttpServletRequest req, final HttpServletResponse resp) 045 throws ServletException, IOException { 046 final UserGroupInformation ugi; 047 final ServletContext context = getServletContext(); 048 final Configuration conf = NameNodeHttpServer.getConfFromContext(context); 049 try { 050 ugi = getUGI(req, conf); 051 } catch(IOException ioe) { 052 LOG.info("Request for token received with no authentication from " 053 + req.getRemoteAddr(), ioe); 054 resp.sendError(HttpServletResponse.SC_FORBIDDEN, 055 "Unable to identify or authenticate user"); 056 return; 057 } 058 final NameNode nn = NameNodeHttpServer.getNameNodeFromContext( 059 context); 060 String tokenString = req.getParameter(TOKEN); 061 if (tokenString == null) { 062 resp.sendError(HttpServletResponse.SC_MULTIPLE_CHOICES, 063 "Token to renew not specified"); 064 } 065 final Token<DelegationTokenIdentifier> token = 066 new Token<DelegationTokenIdentifier>(); 067 token.decodeFromUrlString(tokenString); 068 069 try { 070 ugi.doAs(new PrivilegedExceptionAction<Void>() { 071 @Override 072 public Void run() throws Exception { 073 nn.getRpcServer().cancelDelegationToken(token); 074 return null; 075 } 076 }); 077 } catch(Exception e) { 078 LOG.info("Exception while cancelling token. Re-throwing. ", e); 079 resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, 080 e.getMessage()); 081 } 082 } 083}