org.apache.ambari.server.serveraction.kerberos

Class CreateKeytabFilesServerAction

java.lang.Object

org.apache.ambari.server.serveraction.AbstractServerAction

org.apache.ambari.server.serveraction.kerberos.KerberosServerAction

org.apache.ambari.server.serveraction.kerberos.CreateKeytabFilesServerAction

All Implemented Interfaces:

ServerAction

public class CreateKeytabFilesServerAction
extends KerberosServerAction

CreateKeytabFilesServerAction is a ServerAction implementation that creates keytab files as instructed.

This class mainly relies on the KerberosServerAction to iterate through metadata identifying the Kerberos keytab files that need to be created. For each identity in the metadata, this implementation's KerberosServerAction.processIdentity(ResolvedKerberosPrincipal, KerberosOperationHandler, Map, boolean, Map) is invoked attempting the creation of the relevant keytab file.

Nested Class Summary

Nested classes/interfaces inherited from class org.apache.ambari.server.serveraction.kerberos.KerberosServerAction

KerberosServerAction.KerberosCommandParameters, KerberosServerAction.OperationType

Field Summary

Fields inherited from class org.apache.ambari.server.serveraction.kerberos.KerberosServerAction

AUTHENTICATED_USER_NAME, DATA_DIRECTORY, DATA_DIRECTORY_PREFIX, DEFAULT_REALM, HOST_FILTER, IDENTITY_FILTER, INCLUDE_AMBARI_IDENTITY, KDC_TYPE, KEYTAB_CONTENT_BASE64, OPERATION_TYPE, PRECONFIGURE_SERVICES, SERVICE_COMPONENT_FILTER, UPDATE_CONFIGURATION_NOTE, UPDATE_CONFIGURATION_POLICY

Fields inherited from class org.apache.ambari.server.serveraction.AbstractServerAction

actionLog, gson

Fields inherited from interface org.apache.ambari.server.serveraction.ServerAction

ACTION_NAME, ACTION_USER_NAME, DEFAULT_LONG_RUNNING_TASK_TIMEOUT_SECONDS, WRAPPED_CLASS_NAME

Constructor Summary

Constructors

Constructor and Description
CreateKeytabFilesServerAction()

Method Summary

Modifier and Type	Method and Description
org.apache.directory.server.kerberos.shared.keytab.Keytab	createKeytab(String principal, String password, Integer keyNumber, KerberosOperationHandler operationHandler, boolean checkCache, boolean canCache, ActionLog actionLog) Creates the keytab or gets one from the cache for a principal.
protected void	ensureAmbariOnlyAccess(File file) Ensures that the owner of the Ambari server process is the only local user account able to read and write to the specified file or read, write to, and execute the specified directory.
CommandReport	execute(ConcurrentMap<String,Object> requestSharedDataContext) Called to execute this action.
protected CommandReport	processIdentity(ResolvedKerberosPrincipal resolvedPrincipal, KerberosOperationHandler operationHandler, Map<String,String> kerberosConfiguration, boolean includedInFilter, Map<String,Object> requestSharedDataContext) For each identity, create a keytab and append to a new or existing keytab file.

Methods inherited from class org.apache.ambari.server.serveraction.kerberos.KerberosServerAction

ambariServerHostID, deleteDataDirectory, getCluster, getClusterName, getClusters, getCommandParameterValue, getCommandPreconfigureType, getConfigurationProperties, getDataDirectoryPath, getDataDirectoryPath, getDefaultRealm, getHostFilter, getIdentityFilter, getKDCType, getOperationType, getPrincipalKeyNumberMap, getPrincipalPasswordMap, getServiceComponentFilter, getUpdateConfigurationPolicy, hasHostFilters, processIdentities, pruneServiceFilter, setPrincipalPasswordMap

Methods inherited from class org.apache.ambari.server.serveraction.AbstractServerAction

auditLog, createCommandReport, createCompletedCommandReport, getCommandParameters, getCommandParameterValue, getExecutionCommand, getHostRoleCommand, setExecutionCommand, setHostRoleCommand

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CreateKeytabFilesServerAction

public CreateKeytabFilesServerAction()

Method Detail

execute

public CommandReport execute(ConcurrentMap<String,Object> requestSharedDataContext)
                      throws org.apache.ambari.server.AmbariException,
                             InterruptedException

Called to execute this action. Upon invocation, calls KerberosServerAction.processIdentities(java.util.Map) )} to iterate through the Kerberos identity metadata and call KerberosServerAction.processIdentities(java.util.Map) for each identity to process.

Parameters:

requestSharedDataContext - a Map to be used a shared data among all ServerActions related to a given request

Returns:

a CommandReport indicating the result of this action

Throws:

org.apache.ambari.server.AmbariException

InterruptedException

processIdentity

protected CommandReport processIdentity(ResolvedKerberosPrincipal resolvedPrincipal,
                                        KerberosOperationHandler operationHandler,
                                        Map<String,String> kerberosConfiguration,
                                        boolean includedInFilter,
                                        Map<String,Object> requestSharedDataContext)
                                 throws org.apache.ambari.server.AmbariException

For each identity, create a keytab and append to a new or existing keytab file.

It is expected that the CreatePrincipalsServerAction (or similar) has executed before this action and a set of passwords has been created, map to their relevant (evaluated) principals and stored in the requestSharedDataContext.

If a password exists for the current evaluatedPrincipal, use a KerberosOperationHandler to generate the keytab file. To help avoid filename collisions and to build a structure that is easy to discover, each keytab file is stored in host-specific directory using the SHA1 hash of its destination file path.

   data_directory
   |- host1
   |  |- 16a054404c8826cd604a27ac970e8cc4b9c7a3fa   (keytab file)
   |  |- ...                                        (keytab files)
   |  |- a3c09cae73406912e8c55296d1c85b674d24f576   (keytab file)
   |- host2
   |  |- ...
 

Specified by:

processIdentity in class KerberosServerAction

Parameters:

resolvedPrincipal - a ResolvedKerberosPrincipal object to process

operationHandler - a KerberosOperationHandler used to perform Kerberos-related tasks for specific Kerberos implementations (MIT, Active Directory, etc...)

kerberosConfiguration - a Map of configuration properties from kerberos-env

includedInFilter - a Boolean value indicating whather the principal is included in the current filter or not

requestSharedDataContext - a Map to be used a shared data among all ServerActions related to a given request @return a CommandReport, indicating an error condition; or null, indicating a success condition

Throws:

org.apache.ambari.server.AmbariException - if an error occurs while processing the identity record

createKeytab

public org.apache.directory.server.kerberos.shared.keytab.Keytab createKeytab(String principal,
                                                                              String password,
                                                                              Integer keyNumber,
                                                                              KerberosOperationHandler operationHandler,
                                                                              boolean checkCache,
                                                                              boolean canCache,
                                                                              ActionLog actionLog)
                                                                       throws org.apache.ambari.server.AmbariException

Creates the keytab or gets one from the cache for a principal.

Parameters:

principal - the principal name for the Keytab to create

password - the password for the Keytab to create

keyNumber - the key number for the Keytab to create

operationHandler - the KerberosOperationHandler for the relevant KDC

checkCache - true to check the cache for an existing Keytab; otherwise false

canCache - true to cache the resulting keytab (if generated); otherwise false

actionLog - the logger (may be null if no logging is desired)

Returns:

a Keytab

Throws:

org.apache.ambari.server.AmbariException

ensureAmbariOnlyAccess

protected void ensureAmbariOnlyAccess(File file)
                               throws org.apache.ambari.server.AmbariException

Ensures that the owner of the Ambari server process is the only local user account able to read and write to the specified file or read, write to, and execute the specified directory.

Parameters:

file - the file or directory for which to modify access

Throws:

org.apache.ambari.server.AmbariException