/// <summary>Cancel a token by removing it from cache.</summary>
/// <returns>Identifier of the canceled token</returns>
/// <exception cref="Org.Apache.Hadoop.Security.Token.SecretManager.InvalidToken">for invalid token
/// </exception>
/// <exception cref="Org.Apache.Hadoop.Security.AccessControlException">if the user isn't allowed to cancel
/// </exception>
/// <exception cref="System.IO.IOException"/>
public virtual TokenIdent CancelToken(Org.Apache.Hadoop.Security.Token.Token <TokenIdent
> token, string canceller)
{
lock (this)
{
ByteArrayInputStream buf = new ByteArrayInputStream(token.GetIdentifier());
DataInputStream @in = new DataInputStream(buf);
TokenIdent id = CreateIdentifier();
id.ReadFields(@in);
Log.Info("Token cancelation requested for identifier: " + id);
if (id.GetUser() == null)
{
throw new SecretManager.InvalidToken("Token with no owner");
}
string owner = id.GetUser().GetUserName();
Text renewer = id.GetRenewer();
HadoopKerberosName cancelerKrbName = new HadoopKerberosName(canceller);
string cancelerShortName = cancelerKrbName.GetShortName();
if (!canceller.Equals(owner) && (renewer == null || renewer.ToString().IsEmpty() ||
!cancelerShortName.Equals(renewer.ToString())))
{
throw new AccessControlException(canceller + " is not authorized to cancel the token"
);
}
AbstractDelegationTokenSecretManager.DelegationTokenInformation info = Collections.Remove
(currentTokens, id);
if (info == null)
{
throw new SecretManager.InvalidToken("Token not found");
}
RemoveStoredToken(id);
return(id);
}
}
public virtual void TestParseTimelineDelegationTokenIdentifierRenewer()
{
// Server side when generation a timeline DT
Configuration conf = new YarnConfiguration();
conf.Set(CommonConfigurationKeysPublic.HadoopSecurityAuthToLocal, "RULE:[2:$1@$0]([nr]m@.*EXAMPLE.COM)s/.*/yarn/"
);
HadoopKerberosName.SetConfiguration(conf);
Text owner = new Text("owner");
Text renewer = new Text("rm/[email protected]");
Text realUser = new Text("realUser");
TimelineDelegationTokenIdentifier token = new TimelineDelegationTokenIdentifier(owner
, renewer, realUser);
NUnit.Framework.Assert.AreEqual(new Text("yarn"), token.GetRenewer());
}
public virtual void SetRenewer(Text renewer)
{
if (renewer == null)
{
this.renewer = new Text();
}
else
{
HadoopKerberosName renewerKrbName = new HadoopKerberosName(renewer.ToString());
try
{
this.renewer = new Text(renewerKrbName.GetShortName());
}
catch (IOException e)
{
throw new RuntimeException(e);
}
}
}