[
https://issues.apache.org/jira/browse/FLINK-3929?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15395772#comment-15395772
]
ASF GitHub Bot commented on FLINK-3929:
---------------------------------------
Github user mxm commented on a diff in the pull request:
https://github.com/apache/flink/pull/2275#discussion_r72450591
--- Diff:
flink-test-utils-parent/flink-test-utils/src/main/java/org/apache/flink/test/util/SecureTestEnvironment.java
---
@@ -0,0 +1,207 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.flink.test.util;
+
+import org.apache.flink.configuration.ConfigConstants;
+import org.apache.flink.runtime.security.SecurityContext;
+import org.apache.hadoop.fs.FileUtil;
+import org.apache.hadoop.minikdc.MiniKdc;
+import org.junit.rules.TemporaryFolder;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import static org.junit.Assert.assertTrue;
+
+import javax.annotation.Nullable;
+import java.io.File;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+
+/**
+ * Helper {@link SecureTestEnvironment} to handle MiniKDC lifecycle.
+ * This class can be used to start/stop MiniKDC and create secure
configurations for MiniDFSCluster
+ * and MiniYarn
+ */
+
+public class SecureTestEnvironment {
+
+ protected static final Logger LOG =
LoggerFactory.getLogger(SecureTestEnvironment.class);
+
+ private static MiniKdc kdc;
+
+ private static String testKeytab = null;
+
+ private static String testPrincipal = null;
+
+ private static String testZkServerPrincipal = null;
+
+ private static String hadoopServicePrincipal = null;
+
+ private static File baseDirForSecureRun = null;
+
+ public static void prepare(TemporaryFolder tempFolder) {
+
+ try {
+ baseDirForSecureRun = tempFolder.newFolder();
+
+ LOG.info("Base Directory for Secure Environment: {}",
baseDirForSecureRun);
+
+ FileUtil.fullyDelete(baseDirForSecureRun);
+
+ assertTrue(baseDirForSecureRun.mkdirs());
+
+ Properties kdcConf = MiniKdc.createConf();
+
+ kdc = new MiniKdc(kdcConf, baseDirForSecureRun);
+
+ kdc.start();
+
+ LOG.info("Started Mini KDC");
+
+ File keytabFile = new File(baseDirForSecureRun,
"test-users.keytab");
+
+ testKeytab = keytabFile.getAbsolutePath();
+
+ testZkServerPrincipal = "zookeeper/127.0.0.1";
+
+ hadoopServicePrincipal = "hadoop/localhost";
+
+ testPrincipal = "client/localhost";
+
+ kdc.createPrincipal(keytabFile, testPrincipal,
testZkServerPrincipal, hadoopServicePrincipal);
+
+
+ testPrincipal = testPrincipal + "@" + kdc.getRealm();
+ testZkServerPrincipal = testZkServerPrincipal + "@" +
kdc.getRealm();
+ hadoopServicePrincipal = hadoopServicePrincipal + "@" +
kdc.getRealm();
+
+
LOG.info("-------------------------------------------------------------------");
+ LOG.info("Test Principal: {}", testPrincipal);
+ LOG.info("Test ZK Server Principal: {}",
testZkServerPrincipal);
+ LOG.info("Test Hadoop Service Principal: {}",
hadoopServicePrincipal);
+ LOG.info("Test Keytab: {}", testKeytab);
+
LOG.info("-------------------------------------------------------------------");
+
+ //Security Context is established to allow non hadoop
applications that requires JAAS
+ //based SASL/Kerberos authentication to work. However,
for Hadoop specific applications
+ //the context can be reinitialized with Hadoop
configuration by calling
+ //ctx.setHadoopConfiguration() for the UGI
implementation to work properly.
+ //See Yarn test case module for reference
+ SecurityContext.SecurityConfiguration ctx = new
SecurityContext.SecurityConfiguration();
+ ctx.setCredentials(testKeytab, testPrincipal);
+ TestingSecurityContext.install(ctx,
getClientSecurityConfigurationMap());
+
+ populateSystemEnvVariables();
+
+ } catch(Exception e) {
+ LOG.error("Exception occured while preparing secure
environment. Reason: {}", e);
+ throw new RuntimeException(e);
+ }
+
+ }
+
+ public static void cleanup() {
+
+ LOG.info("Cleaning up Secure Environment");
+
+ if( kdc != null) {
+ kdc.stop();
+ LOG.info("Stopped KDC server");
+ }
+
+ if(baseDirForSecureRun != null) {
+ try {
+ FileUtil.fullyDelete(baseDirForSecureRun);
--- End diff --
Not necessary to cleanup `TemporaryFolder`.
> Support for Kerberos Authentication with Keytab Credential
> ----------------------------------------------------------
>
> Key: FLINK-3929
> URL: https://issues.apache.org/jira/browse/FLINK-3929
> Project: Flink
> Issue Type: New Feature
> Reporter: Eron Wright
> Assignee: Vijay Srinivasaraghavan
> Labels: kerberos, security
> Original Estimate: 672h
> Remaining Estimate: 672h
>
> _This issue is part of a series of improvements detailed in the [Secure Data
> Access|https://docs.google.com/document/d/1-GQB6uVOyoaXGwtqwqLV8BHDxWiMO2WnVzBoJ8oPaAs/edit?usp=sharing]
> design doc._
> Add support for a keytab credential to be associated with the Flink cluster,
> to facilitate:
> - Kerberos-authenticated data access for connectors
> - Kerberos-authenticated ZooKeeper access
> Support both the standalone and YARN deployment modes.
>
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
