001/** 002 * Licensed to the Apache Software Foundation (ASF) under one or more 003 * contributor license agreements. See the NOTICE file distributed with this 004 * work for additional information regarding copyright ownership. The ASF 005 * licenses this file to you under the Apache License, Version 2.0 (the 006 * "License"); you may not use this file except in compliance with the License. 007 * You may obtain a copy of the License at 008 * 009 * http://www.apache.org/licenses/LICENSE-2.0 010 * 011 * Unless required by applicable law or agreed to in writing, software 012 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 013 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the 014 * License for the specific language governing permissions and limitations under 015 * the License. 016 */ 017package org.apache.hadoop.hdfs.server.namenode; 018 019import java.io.IOException; 020import java.io.OutputStreamWriter; 021import java.io.PrintWriter; 022import java.security.PrivilegedExceptionAction; 023 024import javax.servlet.ServletContext; 025import javax.servlet.ServletException; 026import javax.servlet.http.HttpServletRequest; 027import javax.servlet.http.HttpServletResponse; 028 029import org.apache.commons.logging.Log; 030import org.apache.commons.logging.LogFactory; 031import org.apache.hadoop.conf.Configuration; 032import org.apache.hadoop.hdfs.security.token.delegation.DelegationTokenIdentifier; 033import org.apache.hadoop.security.UserGroupInformation; 034import org.apache.hadoop.security.token.Token; 035 036import com.google.common.base.Charsets; 037 038/** 039 * Renew delegation tokens over http for use in hftp. 040 */ 041@SuppressWarnings("serial") 042public class RenewDelegationTokenServlet extends DfsServlet { 043 private static final Log LOG = LogFactory.getLog(RenewDelegationTokenServlet.class); 044 public static final String PATH_SPEC = "/renewDelegationToken"; 045 public static final String TOKEN = "token"; 046 047 @Override 048 protected void doGet(final HttpServletRequest req, final HttpServletResponse resp) 049 throws ServletException, IOException { 050 final UserGroupInformation ugi; 051 final ServletContext context = getServletContext(); 052 final Configuration conf = NameNodeHttpServer.getConfFromContext(context); 053 try { 054 ugi = getUGI(req, conf); 055 } catch(IOException ioe) { 056 LOG.info("Request for token received with no authentication from " 057 + req.getRemoteAddr(), ioe); 058 resp.sendError(HttpServletResponse.SC_FORBIDDEN, 059 "Unable to identify or authenticate user"); 060 return; 061 } 062 final NameNode nn = NameNodeHttpServer.getNameNodeFromContext(context); 063 String tokenString = req.getParameter(TOKEN); 064 if (tokenString == null) { 065 resp.sendError(HttpServletResponse.SC_MULTIPLE_CHOICES, 066 "Token to renew not specified"); 067 } 068 final Token<DelegationTokenIdentifier> token = 069 new Token<DelegationTokenIdentifier>(); 070 token.decodeFromUrlString(tokenString); 071 072 try { 073 long result = ugi.doAs(new PrivilegedExceptionAction<Long>() { 074 @Override 075 public Long run() throws Exception { 076 return nn.getRpcServer().renewDelegationToken(token); 077 } 078 }); 079 final PrintWriter os = new PrintWriter(new OutputStreamWriter( 080 resp.getOutputStream(), Charsets.UTF_8)); 081 os.println(result); 082 os.close(); 083 } catch(Exception e) { 084 // transfer exception over the http 085 String exceptionClass = e.getClass().getName(); 086 String exceptionMsg = e.getLocalizedMessage(); 087 String strException = exceptionClass + ";" + exceptionMsg; 088 LOG.info("Exception while renewing token. Re-throwing. s=" + strException, e); 089 resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, strException); 090 } 091 } 092}