import org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.DelegationToken; //导入依赖的package包/类
@POST
@Path("/delegation-token")
@Produces({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
@Consumes({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
public Response postDelegationToken(DelegationToken tokenData,
    @Context HttpServletRequest hsr) throws AuthorizationException,
    IOException, InterruptedException, Exception {

  init();
  UserGroupInformation callerUGI;
  try {
    callerUGI = createKerberosUserGroupInformation(hsr);
  } catch (YarnException ye) {
    return Response.status(Status.FORBIDDEN).entity(ye.getMessage()).build();
  }
  return createDelegationToken(tokenData, hsr, callerUGI);
}
 

import org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.DelegationToken; //导入依赖的package包/类
@POST
@Path("/delegation-token/expiration")
@Produces({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
@Consumes({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
public Response
    postDelegationTokenExpiration(@Context HttpServletRequest hsr)
        throws AuthorizationException, IOException, InterruptedException,
        Exception {

  init();
  UserGroupInformation callerUGI;
  try {
    callerUGI = createKerberosUserGroupInformation(hsr);
  } catch (YarnException ye) {
    return Response.status(Status.FORBIDDEN).entity(ye.getMessage()).build();
  }

  DelegationToken requestToken = new DelegationToken();
  requestToken.setToken(extractToken(hsr).encodeToUrlString());
  return renewDelegationToken(requestToken, hsr, callerUGI);
}
 

import org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.DelegationToken; //导入依赖的package包/类
public static DelegationToken getDelegationTokenFromXML(String tokenXML)
    throws IOException, ParserConfigurationException, SAXException {
  DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
  DocumentBuilder db = dbf.newDocumentBuilder();
  InputSource is = new InputSource();
  is.setCharacterStream(new StringReader(tokenXML));
  Document dom = db.parse(is);
  NodeList nodes = dom.getElementsByTagName("delegation-token");
  assertEquals("incorrect number of elements", 1, nodes.getLength());
  Element element = (Element) nodes.item(0);
  DelegationToken ret = new DelegationToken();
  String token = WebServicesTestUtils.getXmlString(element, "token");
  if (token != null) {
    ret.setToken(token);
  } else {
    long expiration =
        WebServicesTestUtils.getXmlLong(element, "expiration-time");
    ret.setNextExpirationTime(expiration);
  }
  return ret;
}
 

import org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.DelegationToken; //导入依赖的package包/类
private Response createDelegationToken(DelegationToken tokenData,
    HttpServletRequest hsr, UserGroupInformation callerUGI)
    throws AuthorizationException, IOException, InterruptedException,
    Exception {

  final String renewer = tokenData.getRenewer();
  GetDelegationTokenResponse resp;
  try {
    resp =
        callerUGI
          .doAs(new PrivilegedExceptionAction<GetDelegationTokenResponse>() {
            @Override
            public GetDelegationTokenResponse run() throws IOException,
                YarnException {
              GetDelegationTokenRequest createReq =
                  GetDelegationTokenRequest.newInstance(renewer);
              return rm.getClientRMService().getDelegationToken(createReq);
            }
          });
  } catch (Exception e) {
    LOG.info("Create delegation token request failed", e);
    throw e;
  }

  Token<RMDelegationTokenIdentifier> tk =
      new Token<RMDelegationTokenIdentifier>(resp.getRMDelegationToken()
        .getIdentifier().array(), resp.getRMDelegationToken().getPassword()
        .array(), new Text(resp.getRMDelegationToken().getKind()), new Text(
        resp.getRMDelegationToken().getService()));
  RMDelegationTokenIdentifier identifier = tk.decodeIdentifier();
  long currentExpiration =
      rm.getRMContext().getRMDelegationTokenSecretManager()
        .getRenewDate(identifier);
  DelegationToken respToken =
      new DelegationToken(tk.encodeToUrlString(), renewer, identifier
        .getOwner().toString(), tk.getKind().toString(), currentExpiration,
        identifier.getMaxDate());
  return Response.status(Status.OK).entity(respToken).build();
}
 

import org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.DelegationToken; //导入依赖的package包/类
private void verifyKerberosAuthCreate(String mType, String cType,
    String reqBody, String renUser) throws Exception {
  final String mediaType = mType;
  final String contentType = cType;
  final String body = reqBody;
  final String renewer = renUser;
  KerberosTestUtils.doAsClient(new Callable<Void>() {
    @Override
    public Void call() throws Exception {
      ClientResponse response =
          resource().path("ws").path("v1").path("cluster")
            .path("delegation-token").accept(contentType)
            .entity(body, mediaType).post(ClientResponse.class);
      assertEquals(Status.OK, response.getClientResponseStatus());
      DelegationToken tok = getDelegationTokenFromResponse(response);
      assertFalse(tok.getToken().isEmpty());
      Token<RMDelegationTokenIdentifier> token =
          new Token<RMDelegationTokenIdentifier>();
      token.decodeFromUrlString(tok.getToken());
      assertEquals(renewer, token.decodeIdentifier().getRenewer().toString());
      assertValidRMToken(tok.getToken());
      DelegationToken dtoken = new DelegationToken();
      response =
          resource().path("ws").path("v1").path("cluster")
            .path("delegation-token").accept(contentType)
            .entity(dtoken, mediaType).post(ClientResponse.class);
      assertEquals(Status.OK, response.getClientResponseStatus());
      tok = getDelegationTokenFromResponse(response);
      assertFalse(tok.getToken().isEmpty());
      token = new Token<RMDelegationTokenIdentifier>();
      token.decodeFromUrlString(tok.getToken());
      assertEquals("", token.decodeIdentifier().getRenewer().toString());
      assertValidRMToken(tok.getToken());
      return null;
    }
  });
}
 

import org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.DelegationToken; //导入依赖的package包/类
private DelegationToken
    getDelegationTokenFromResponse(ClientResponse response)
        throws IOException, ParserConfigurationException, SAXException,
        JSONException {
  if (response.getType().toString().equals(MediaType.APPLICATION_JSON)) {
    return getDelegationTokenFromJson(response.getEntity(JSONObject.class));
  }
  return getDelegationTokenFromXML(response.getEntity(String.class));
}
 

import org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.DelegationToken; //导入依赖的package包/类
public static DelegationToken getDelegationTokenFromJson(JSONObject json)
    throws JSONException {
  DelegationToken ret = new DelegationToken();
  if (json.has("token")) {
    ret.setToken(json.getString("token"));
  } else if (json.has("expiration-time")) {
    ret.setNextExpirationTime(json.getLong("expiration-time"));
  }
  return ret;
}
 

import org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.DelegationToken; //导入依赖的package包/类
private Response renewDelegationToken(DelegationToken tokenData,
    HttpServletRequest hsr, UserGroupInformation callerUGI)
    throws AuthorizationException, IOException, InterruptedException,
    Exception {

  Token<RMDelegationTokenIdentifier> token =
      extractToken(tokenData.getToken());

  org.apache.hadoop.yarn.api.records.Token dToken =
      BuilderUtils.newDelegationToken(token.getIdentifier(), token.getKind()
        .toString(), token.getPassword(), token.getService().toString());
  final RenewDelegationTokenRequest req =
      RenewDelegationTokenRequest.newInstance(dToken);

  RenewDelegationTokenResponse resp;
  try {
    resp =
        callerUGI
          .doAs(new PrivilegedExceptionAction<RenewDelegationTokenResponse>() {
            @Override
            public RenewDelegationTokenResponse run() throws IOException,
                YarnException {
              return rm.getClientRMService().renewDelegationToken(req);
            }
          });
  } catch (UndeclaredThrowableException ue) {
    if (ue.getCause() instanceof YarnException) {
      if (ue.getCause().getCause() instanceof InvalidToken) {
        throw new BadRequestException(ue.getCause().getCause().getMessage());
      } else if (ue.getCause().getCause() instanceof org.apache.hadoop.security.AccessControlException) {
        return Response.status(Status.FORBIDDEN)
          .entity(ue.getCause().getCause().getMessage()).build();
      }
      LOG.info("Renew delegation token request failed", ue);
      throw ue;
    }
    LOG.info("Renew delegation token request failed", ue);
    throw ue;
  } catch (Exception e) {
    LOG.info("Renew delegation token request failed", e);
    throw e;
  }
  long renewTime = resp.getNextExpirationTime();

  DelegationToken respToken = new DelegationToken();
  respToken.setNextExpirationTime(renewTime);
  return Response.status(Status.OK).entity(respToken).build();
}