import org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticator; //导入依赖的package包/类
/**
 * Called after a new FileSystem instance is constructed.
 *
 * @param name a uri whose authority section names the host, port, etc. for this FileSystem
 * @param conf the configuration
 */
@Override
public void initialize(URI name, Configuration conf) throws IOException {
  UserGroupInformation ugi = UserGroupInformation.getCurrentUser();

  //the real use is the one that has the Kerberos credentials needed for
  //SPNEGO to work
  realUser = ugi.getRealUser();
  if (realUser == null) {
    realUser = UserGroupInformation.getLoginUser();
  }
  super.initialize(name, conf);
  try {
    uri = new URI(name.getScheme() + "://" + name.getAuthority());
  } catch (URISyntaxException ex) {
    throw new IOException(ex);
  }

  Class<? extends DelegationTokenAuthenticator> klass =
      getConf().getClass("httpfs.authenticator.class",
          KerberosDelegationTokenAuthenticator.class,
          DelegationTokenAuthenticator.class);
  DelegationTokenAuthenticator authenticator =
      ReflectionUtils.newInstance(klass, getConf());
  authURL = new DelegationTokenAuthenticatedURL(authenticator);
}
 

import org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticator; //导入依赖的package包/类
@Test
@TestDir
@TestJetty
@TestHdfs
public void testDelegationTokenHttpFSAccess() throws Exception {
  createHttpFSServer();

  KerberosTestUtils.doAsClient(new Callable<Void>() {
    @Override
    public Void call() throws Exception {
      //get delegation token doing SPNEGO authentication
      URL url = new URL(TestJettyHelper.getJettyURL(),
                        "/webhdfs/v1/?op=GETDELEGATIONTOKEN");
      AuthenticatedURL aUrl = new AuthenticatedURL();
      AuthenticatedURL.Token aToken = new AuthenticatedURL.Token();
      HttpURLConnection conn = aUrl.openConnection(url, aToken);
      Assert.assertEquals(conn.getResponseCode(), HttpURLConnection.HTTP_OK);
      JSONObject json = (JSONObject) new JSONParser()
        .parse(new InputStreamReader(conn.getInputStream()));
      json =
        (JSONObject) json
          .get(DelegationTokenAuthenticator.DELEGATION_TOKEN_JSON);
      String tokenStr = (String) json
        .get(DelegationTokenAuthenticator.DELEGATION_TOKEN_URL_STRING_JSON);

      //access httpfs using the delegation token
      url = new URL(TestJettyHelper.getJettyURL(),
                    "/webhdfs/v1/?op=GETHOMEDIRECTORY&delegation=" +
                    tokenStr);
      conn = (HttpURLConnection) url.openConnection();
      Assert.assertEquals(conn.getResponseCode(), HttpURLConnection.HTTP_OK);

      //try to renew the delegation token without SPNEGO credentials
      url = new URL(TestJettyHelper.getJettyURL(),
                    "/webhdfs/v1/?op=RENEWDELEGATIONTOKEN&token=" + tokenStr);
      conn = (HttpURLConnection) url.openConnection();
      conn.setRequestMethod("PUT");
      Assert.assertEquals(conn.getResponseCode(),
                          HttpURLConnection.HTTP_UNAUTHORIZED);

      //renew the delegation token with SPNEGO credentials
      url = new URL(TestJettyHelper.getJettyURL(),
                    "/webhdfs/v1/?op=RENEWDELEGATIONTOKEN&token=" + tokenStr);
      conn = aUrl.openConnection(url, aToken);
      conn.setRequestMethod("PUT");
      Assert.assertEquals(conn.getResponseCode(), HttpURLConnection.HTTP_OK);

      //cancel delegation token, no need for SPNEGO credentials
      url = new URL(TestJettyHelper.getJettyURL(),
                    "/webhdfs/v1/?op=CANCELDELEGATIONTOKEN&token=" +
                    tokenStr);
      conn = (HttpURLConnection) url.openConnection();
      conn.setRequestMethod("PUT");
      Assert.assertEquals(conn.getResponseCode(), HttpURLConnection.HTTP_OK);

      //try to access httpfs with the canceled delegation token
      url = new URL(TestJettyHelper.getJettyURL(),
                    "/webhdfs/v1/?op=GETHOMEDIRECTORY&delegation=" +
                    tokenStr);
      conn = (HttpURLConnection) url.openConnection();
      Assert.assertEquals(conn.getResponseCode(),
                          HttpURLConnection.HTTP_UNAUTHORIZED);
      return null;
    }
  });
}