import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws IOException {
  UserGroupInformation authorizedUgi;
  if (authMethod == AuthMethod.DIGEST) {
    TokenIdentifier tokenId = HBaseSaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    authorizedUgi = tokenId.getUser();
    if (authorizedUgi == null) {
      throw new AccessDeniedException(
          "Can't retrieve username from tokenIdentifier.");
    }
    authorizedUgi.addTokenIdentifier(tokenId);
  } else {
    authorizedUgi = UserGroupInformation.createRemoteUser(authorizedId);
  }
  authorizedUgi.setAuthenticationMethod(authMethod.authenticationMethod.getAuthMethod());
  return authorizedUgi;
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private boolean authorizeConnection() throws IOException {
  try {
    // If auth method is DIGEST, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (ugi != null && ugi.getRealUser() != null
        && (authMethod != AuthMethod.DIGEST)) {
      ProxyUsers.authorize(ugi, this.getHostAddress(), conf);
    }
    authorize(ugi, connectionHeader, getHostInetAddress());
    metrics.authorizationSuccess();
  } catch (AuthorizationException ae) {
    if (LOG.isDebugEnabled()) {
      LOG.debug("Connection authorization failed: " + ae.getMessage(), ae);
    }
    metrics.authorizationFailure();
    setupResponse(authFailedResponse, authFailedCall,
      new AccessDeniedException(ae), ae.getMessage());
    responder.doRespond(authFailedCall);
    return false;
  }
  return true;
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private synchronized UserInformation getUserInfo(UserGroupInformation ugi) {
  if (ugi == null || authMethod == AuthMethod.DIGEST) {
    // Don't send user for token auth
    return null;
  }
  UserInformation.Builder userInfoPB = UserInformation.newBuilder();
  if (authMethod == AuthMethod.KERBEROS) {
    // Send effective user for Kerberos auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
  } else if (authMethod == AuthMethod.SIMPLE) {
    //Send both effective user and real user for simple auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
    if (ugi.getRealUser() != null) {
      userInfoPB.setRealUser(ugi.getRealUser().getUserName());
    }
  }
  return userInfoPB.build();
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
/**
 * Build the user information
 *
 * @param ugi        User Group Information
 * @param authMethod Authorization method
 * @return UserInformation protobuf
 */
private RPCProtos.UserInformation buildUserInfo(UserGroupInformation ugi, AuthMethod authMethod) {
  if (ugi == null || authMethod == AuthMethod.DIGEST) {
    // Don't send user for token auth
    return null;
  }
  RPCProtos.UserInformation.Builder userInfoPB = RPCProtos.UserInformation.newBuilder();
  if (authMethod == AuthMethod.KERBEROS) {
    // Send effective user for Kerberos auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
  } else if (authMethod == AuthMethod.SIMPLE) {
    //Send both effective user and real user for simple auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
    if (ugi.getRealUser() != null) {
      userInfoPB.setRealUser(ugi.getRealUser().getUserName());
    }
  }
  return userInfoPB.build();
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws IOException {
  if (authMethod == AuthMethod.DIGEST) {
    TokenIdentifier tokenId = HBaseSaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    UserGroupInformation ugi = tokenId.getUser();
    if (ugi == null) {
      throw new AccessDeniedException(
          "Can't retrieve username from tokenIdentifier.");
    }
    ugi.addTokenIdentifier(tokenId);
    return ugi;
  } else {
    return UserGroupInformation.createRemoteUser(authorizedId);
  }
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private boolean authorizeConnection() throws IOException {
  try {
    // If auth method is DIGEST, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (user != null && user.getRealUser() != null
        && (authMethod != AuthMethod.DIGEST)) {
      ProxyUsers.authorize(user, this.getHostAddress(), conf);
    }
    authorize(user, connectionHeader, getHostInetAddress());
    metrics.authorizationSuccess();
  } catch (AuthorizationException ae) {
    if (LOG.isDebugEnabled()) {
      LOG.debug("Connection authorization failed: " + ae.getMessage(), ae);
    }
    metrics.authorizationFailure();
    setupResponse(authFailedResponse, authFailedCall,
      new AccessDeniedException(ae), ae.getMessage());
    responder.doRespond(authFailedCall);
    return false;
  }
  return true;
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private UserInformation getUserInfo(UserGroupInformation ugi) {
  if (ugi == null || authMethod == AuthMethod.DIGEST) {
    // Don't send user for token auth
    return null;
  }
  UserInformation.Builder userInfoPB = UserInformation.newBuilder();
  if (authMethod == AuthMethod.KERBEROS) {
    // Send effective user for Kerberos auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
  } else if (authMethod == AuthMethod.SIMPLE) {
    //Send both effective user and real user for simple auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
    if (ugi.getRealUser() != null) {
      userInfoPB.setRealUser(ugi.getRealUser().getUserName());
    }
  }
  return userInfoPB.build();
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws IOException {
  if (authMethod == AuthMethod.DIGEST) {
    TokenIdentifier tokenId = HBaseSaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    UserGroupInformation ugi = tokenId.getUser();
    if (ugi == null) {
      throw new AccessControlException(
          "Can't retrieve username from tokenIdentifier.");
    }
    ugi.addTokenIdentifier(tokenId);
    return ugi;
  } else {
    return UserGroupInformation.createRemoteUser(authorizedId);
  }
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private boolean authorizeConnection() throws IOException {
  try {
    // If auth method is DIGEST, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (user != null && user.getRealUser() != null
        && (authMethod != AuthMethod.DIGEST)) {
      ProxyUsers.authorize(user, this.getHostAddress(), conf);
    }
    authorize(user, connectionHeader, getHostInetAddress());
    if (LOG.isDebugEnabled()) {
      LOG.debug("Authorized " + TextFormat.shortDebugString(connectionHeader));
    }
    metrics.authorizationSuccess();
  } catch (AuthorizationException ae) {
    LOG.debug("Connection authorization failed: " + ae.getMessage(), ae);
    metrics.authorizationFailure();
    setupResponse(authFailedResponse, authFailedCall, ae, ae.getMessage());
    responder.doRespond(authFailedCall);
    return false;
  }
  return true;
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws IOException {
  UserGroupInformation authorizedUgi;
  if (authMethod == AuthMethod.DIGEST) {
    TokenIdentifier tokenId = HBaseSaslRpcServer.getIdentifier(authorizedId,
        this.rpcServer.secretManager);
    authorizedUgi = tokenId.getUser();
    if (authorizedUgi == null) {
      throw new AccessDeniedException(
          "Can't retrieve username from tokenIdentifier.");
    }
    authorizedUgi.addTokenIdentifier(tokenId);
  } else {
    authorizedUgi = UserGroupInformation.createRemoteUser(authorizedId);
  }
  authorizedUgi.setAuthenticationMethod(authMethod.authenticationMethod.getAuthMethod());
  return authorizedUgi;
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private boolean authorizeConnection() throws IOException {
  try {
    // If auth method is DIGEST, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (ugi != null && ugi.getRealUser() != null
        && (authMethod != AuthMethod.DIGEST)) {
      ProxyUsers.authorize(ugi, this.getHostAddress(), this.rpcServer.conf);
    }
    this.rpcServer.authorize(ugi, connectionHeader, getHostInetAddress());
    this.rpcServer.metrics.authorizationSuccess();
  } catch (AuthorizationException ae) {
    if (RpcServer.LOG.isDebugEnabled()) {
      RpcServer.LOG.debug("Connection authorization failed: " + ae.getMessage(), ae);
    }
    this.rpcServer.metrics.authorizationFailure();
    doRespond(getErrorResponse(ae.getMessage(), new AccessDeniedException(ae)));
    return false;
  }
  return true;
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private UserInformation getUserInfo(UserGroupInformation ugi) {
  if (ugi == null || authMethod == AuthMethod.DIGEST) {
    // Don't send user for token auth
    return null;
  }
  UserInformation.Builder userInfoPB = UserInformation.newBuilder();
  if (authMethod == AuthMethod.KERBEROS) {
    // Send effective user for Kerberos auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
  } else if (authMethod == AuthMethod.SIMPLE) {
    // Send both effective user and real user for simple auth
    userInfoPB.setEffectiveUser(ugi.getUserName());
    if (ugi.getRealUser() != null) {
      userInfoPB.setRealUser(ugi.getRealUser().getUserName());
    }
  }
  return userInfoPB.build();
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private synchronized boolean shouldAuthenticateOverKrb() throws IOException {
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  UserGroupInformation currentUser =
    UserGroupInformation.getCurrentUser();
  UserGroupInformation realUser = currentUser.getRealUser();
  return authMethod == AuthMethod.KERBEROS &&
      loginUser != null &&
      //Make sure user logged in using Kerberos either keytab or TGT
      loginUser.hasKerberosCredentials() &&
      // relogin only in case it is the login user (e.g. JT)
      // or superuser (like oozie).
      (loginUser.equals(currentUser) || loginUser.equals(realUser));
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
/**
 * Check if user should authenticate over Kerberos
 *
 * @return true if should be authenticated over Kerberos
 * @throws java.io.IOException on failure of check
 */
private synchronized boolean shouldAuthenticateOverKrb() throws IOException {
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  UserGroupInformation currentUser = UserGroupInformation.getCurrentUser();
  UserGroupInformation realUser = currentUser.getRealUser();
  return authMethod == AuthMethod.KERBEROS &&
      loginUser != null &&
      //Make sure user logged in using Kerberos either keytab or TGT
      loginUser.hasKerberosCredentials() &&
      // relogin only in case it is the login user (e.g. JT)
      // or superuser (like oozie).
      (loginUser.equals(currentUser) || loginUser.equals(realUser));
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private void processConnectionHeader(byte[] buf) throws IOException {
  this.connectionHeader = ConnectionHeader.parseFrom(buf);
  String serviceName = connectionHeader.getServiceName();
  if (serviceName == null) throw new EmptyServiceNameException();
  this.service = getService(services, serviceName);
  if (this.service == null) throw new UnknownServiceException(serviceName);
  setupCellBlockCodecs(this.connectionHeader);
  UserGroupInformation protocolUser = createUser(connectionHeader);
  if (!useSasl) {
    user = protocolUser;
    if (user != null) {
      user.setAuthenticationMethod(AuthMethod.SIMPLE.authenticationMethod);
    }
  } else {
    // user is authenticated
    user.setAuthenticationMethod(authMethod.authenticationMethod);
    //Now we check if this is a proxy user case. If the protocol user is
    //different from the 'user', it is a proxy user scenario. However,
    //this is not allowed if user authenticated with DIGEST.
    if ((protocolUser != null)
        && (!protocolUser.getUserName().equals(user.getUserName()))) {
      if (authMethod == AuthMethod.DIGEST) {
        // Not allowed to doAs if token authentication is used
        throw new AccessDeniedException("Authenticated user (" + user
            + ") doesn't match what the client claims to be ("
            + protocolUser + ")");
      } else {
        // Effective user can be different from authenticated user
        // for simple auth or kerberos auth
        // The user is the real user. Now we create a proxy user
        UserGroupInformation realUser = user;
        user = UserGroupInformation.createProxyUser(protocolUser
            .getUserName(), realUser);
        // Now the user is a proxy user, set Authentication method Proxy.
        user.setAuthenticationMethod(AuthenticationMethod.PROXY);
      }
    }
  }
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private void processConnectionHeader(byte[] buf) throws IOException {
  this.connectionHeader = ConnectionHeader.parseFrom(buf);
  String serviceName = connectionHeader.getServiceName();
  if (serviceName == null) throw new EmptyServiceNameException();
  this.service = getService(services, serviceName);
  if (this.service == null) throw new UnknownServiceException(serviceName);
  setupCellBlockCodecs(this.connectionHeader);
  UserGroupInformation protocolUser = createUser(connectionHeader);
  if (!useSasl) {
    user = protocolUser;
    if (user != null) {
      user.setAuthenticationMethod(AuthMethod.SIMPLE.authenticationMethod);
    }
  } else {
    // user is authenticated
    user.setAuthenticationMethod(authMethod.authenticationMethod);
    //Now we check if this is a proxy user case. If the protocol user is
    //different from the 'user', it is a proxy user scenario. However,
    //this is not allowed if user authenticated with DIGEST.
    if ((protocolUser != null)
        && (!protocolUser.getUserName().equals(user.getUserName()))) {
      if (authMethod == AuthMethod.DIGEST) {
        // Not allowed to doAs if token authentication is used
        throw new AccessControlException("Authenticated user (" + user
            + ") doesn't match what the client claims to be ("
            + protocolUser + ")");
      } else {
        // Effective user can be different from authenticated user
        // for simple auth or kerberos auth
        // The user is the real user. Now we create a proxy user
        UserGroupInformation realUser = user;
        user = UserGroupInformation.createProxyUser(protocolUser
            .getUserName(), realUser);
        // Now the user is a proxy user, set Authentication method Proxy.
        user.setAuthenticationMethod(AuthenticationMethod.PROXY);
      }
    }
  }
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
@Test
public void test() throws IOException, InterruptedException {
  int rpcHeaderLen = HConstants.RPC_HEADER.length;
  byte[] preamble = new byte[rpcHeaderLen + 2];
  System.arraycopy(HConstants.RPC_HEADER, 0, preamble, 0, rpcHeaderLen);
  preamble[rpcHeaderLen] = HConstants.RPC_CURRENT_VERSION;
  preamble[rpcHeaderLen + 1] = AuthMethod.SIMPLE.code;
  socket.getOutputStream().write(preamble, 0, rpcHeaderLen + 1);
  socket.getOutputStream().flush();
  Thread.sleep(5000);
  socket.getOutputStream().write(preamble, rpcHeaderLen + 1, 1);
  socket.getOutputStream().flush();

  ConnectionHeader header = ConnectionHeader.newBuilder()
      .setServiceName(TestRpcServiceProtos.TestProtobufRpcProto.getDescriptor().getFullName())
      .setVersionInfo(ProtobufUtil.getVersionInfo()).build();
  DataOutputStream dos = new DataOutputStream(socket.getOutputStream());
  dos.writeInt(header.getSerializedSize());
  header.writeTo(dos);
  dos.flush();

  int callId = 10;
  Call call = new Call(callId, TestProtobufRpcProto.getDescriptor().findMethodByName("ping"),
      EmptyRequestProto.getDefaultInstance(), null, EmptyResponseProto.getDefaultInstance(), 1000,
      HConstants.NORMAL_QOS, null, MetricsConnection.newCallStats());
  RequestHeader requestHeader = IPCUtil.buildRequestHeader(call, null);
  dos.writeInt(IPCUtil.getTotalSizeWhenWrittenDelimited(requestHeader, call.param));
  requestHeader.writeDelimitedTo(dos);
  call.param.writeDelimitedTo(dos);
  dos.flush();

  DataInputStream dis = new DataInputStream(new BufferedInputStream(socket.getInputStream()));
  int size = dis.readInt();
  ResponseHeader responseHeader = ResponseHeader.parseDelimitedFrom(dis);
  assertEquals(callId, responseHeader.getCallId());
  EmptyResponseProto.Builder builder = EmptyResponseProto.newBuilder();
  builder.mergeDelimitedFrom(dis);
  assertEquals(size, IPCUtil.getTotalSizeWhenWrittenDelimited(responseHeader, builder.build()));
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
protected UserGroupInformation getUGI() {
  UserGroupInformation ticket = remoteId.getTicket().getUGI();
  if (authMethod == AuthMethod.KERBEROS) {
    if (ticket != null && ticket.getRealUser() != null) {
      ticket = ticket.getRealUser();
    }
  }
  return ticket;
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
protected boolean shouldAuthenticateOverKrb() throws IOException {
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  UserGroupInformation currentUser = UserGroupInformation.getCurrentUser();
  UserGroupInformation realUser = currentUser.getRealUser();
  return authMethod == AuthMethod.KERBEROS && loginUser != null &&
  // Make sure user logged in using Kerberos either keytab or TGT
      loginUser.hasKerberosCredentials() &&
      // relogin only in case it is the login user (e.g. JT)
      // or superuser (like oozie).
      (loginUser.equals(currentUser) || loginUser.equals(realUser));
}
 

import org.apache.hadoop.hbase.security.AuthMethod; //导入依赖的package包/类
private void processConnectionHeader(byte[] buf) throws IOException {
  this.connectionHeader = ConnectionHeader.parseFrom(buf);
  String serviceName = connectionHeader.getServiceName();
  if (serviceName == null) throw new EmptyServiceNameException();
  this.service = getService(services, serviceName);
  if (this.service == null) throw new UnknownServiceException(serviceName);
  setupCellBlockCodecs(this.connectionHeader);
  UserGroupInformation protocolUser = createUser(connectionHeader);
  if (!useSasl) {
    ugi = protocolUser;
    if (ugi != null) {
      ugi.setAuthenticationMethod(AuthMethod.SIMPLE.authenticationMethod);
    }
    // audit logging for SASL authenticated users happens in saslReadAndProcess()
    if (authenticatedWithFallback) {
      LOG.warn("Allowed fallback to SIMPLE auth for " + ugi
          + " connecting from " + getHostAddress());
    }
    AUDITLOG.info(AUTH_SUCCESSFUL_FOR + ugi);
  } else {
    // user is authenticated
    ugi.setAuthenticationMethod(authMethod.authenticationMethod);
    //Now we check if this is a proxy user case. If the protocol user is
    //different from the 'user', it is a proxy user scenario. However,
    //this is not allowed if user authenticated with DIGEST.
    if ((protocolUser != null)
        && (!protocolUser.getUserName().equals(ugi.getUserName()))) {
      if (authMethod == AuthMethod.DIGEST) {
        // Not allowed to doAs if token authentication is used
        throw new AccessDeniedException("Authenticated user (" + ugi
            + ") doesn't match what the client claims to be ("
            + protocolUser + ")");
      } else {
        // Effective user can be different from authenticated user
        // for simple auth or kerberos auth
        // The user is the real user. Now we create a proxy user
        UserGroupInformation realUser = ugi;
        ugi = UserGroupInformation.createProxyUser(protocolUser
            .getUserName(), realUser);
        // Now the user is a proxy user, set Authentication method Proxy.
        ugi.setAuthenticationMethod(AuthenticationMethod.PROXY);
      }
    }
  }
  if (connectionHeader.hasVersionInfo()) {
    // see if this connection will support RetryImmediatelyException
    retryImmediatelySupported = VersionInfoUtil.hasMinimumVersion(getVersionInfo(), 1, 2);

    AUDITLOG.info("Connection from " + this.hostAddress + " port: " + this.remotePort
        + " with version info: "
        + TextFormat.shortDebugString(connectionHeader.getVersionInfo()));
  } else {
    AUDITLOG.info("Connection from " + this.hostAddress + " port: " + this.remotePort
        + " with unknown version info");
  }


}