org.apache.solr.security.util.job

Class JobSecurityUtil

java.lang.Object

org.apache.solr.security.util.job.JobSecurityUtil

public class JobSecurityUtil
extends Object

Utility for setting up MR Job Security Credentials

Field Summary

Fields

Modifier and Type	Field and Description
static String	CREDENTIALS_FILE_LOCATION Location of the (optional) credentials file; if set, the credentials file is used to pass the credentials rather than the JobContext.
static String	USE_SECURE_CREDENTIALS Property in the job configuration that controls whether secure credentials will be used.

Constructor Summary

Constructors

Constructor and Description
JobSecurityUtil()

Method Summary

Methods

Modifier and Type	Method and Description
static void	cleanupCredentials(SolrServer server, org.apache.hadoop.conf.Configuration conf, String serviceName) Cleanup job credentials; call at the end of the job so that credentials can't be used outside of the lifetime of the job.
static void	cleanupCredentials(SolrServer server, org.apache.hadoop.mapreduce.JobContext job, String serviceName) Cleanup job credentials; call at the end of the job so that credentials can't be used outside of the lifetime of the job.
static void	initCredentials(File tokenFile, org.apache.hadoop.conf.Configuration conf, String serviceName) Init job credentials from a file.
static void	initCredentials(SolrServer server, org.apache.hadoop.mapreduce.JobContext job, String serviceName) Init job credentials for when the tasks need to communicate with secure solr directly.
static void	loadCredentialsForClients(org.apache.hadoop.conf.Configuration conf, String serviceName) Load job credentials for Solr clients running in this process.
static void	loadCredentialsForClients(org.apache.hadoop.mapreduce.JobContext job, String serviceName) Load job credentials for Solr clients running in this process.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

USE_SECURE_CREDENTIALS

public static final String USE_SECURE_CREDENTIALS

Property in the job configuration that controls whether secure credentials will be used. If set explicitly, the value is respected. Otherwise, it is set to true in initCredentials(org.apache.solr.client.solrj.SolrServer, org.apache.hadoop.mapreduce.JobContext, java.lang.String) if a JAAS configuration is configured (via System property java.security.auth.login.config).

See Also:

Constant Field Values

CREDENTIALS_FILE_LOCATION

public static final String CREDENTIALS_FILE_LOCATION

Location of the (optional) credentials file; if set, the credentials file is used to pass the credentials rather than the JobContext.

See Also:

Constant Field Values

Constructor Detail

JobSecurityUtil

public JobSecurityUtil()

Method Detail

initCredentials

public static void initCredentials(SolrServer server,
                   org.apache.hadoop.mapreduce.JobContext job,
                   String serviceName)
                            throws SolrServerException,
                                   IOException

Init job credentials for when the tasks need to communicate with secure solr directly.

Parameters:

server - SolrServer to get credentials from

job - JobContext to store the credentials

serviceName - service name for which the credentials are valid. Should be a unique identifier for the solr cluster, i.e. the zkHost.

Throws:

SolrServerException

IOException

initCredentials

public static void initCredentials(File tokenFile,
                   org.apache.hadoop.conf.Configuration conf,
                   String serviceName)
                            throws IOException

Init job credentials from a file. Currently used for Spark jobs, which can't automatically pass the credentials in cluster mode.

Parameters:

tokenFile - file storing the tokens. File should be the output of a curl call to get the token, e.g. "curl --negotiate -u: 'http://host:port/solr/?op=GETDELEGATIONTOKEN'"

conf - configuration passed to MR/Spark job.

serviceName - service name for which the credentials are valid. Should be a unique identifier for the solr cluster, i.e. the zkHost.

Throws:

IOException

loadCredentialsForClients

public static void loadCredentialsForClients(org.apache.hadoop.mapreduce.JobContext job,
                             String serviceName)
                                      throws IOException

Load job credentials for Solr clients running in this process. Clients created after calling this method will automatically authenticate using the provided credentials.

Parameters:

job - JobContext to load the credentials from

serviceName - should be the same as passed to initCredentials(org.apache.solr.client.solrj.SolrServer, org.apache.hadoop.mapreduce.JobContext, java.lang.String)

Throws:

IOException

loadCredentialsForClients

public static void loadCredentialsForClients(org.apache.hadoop.conf.Configuration conf,
                             String serviceName)
                                      throws IOException

Load job credentials for Solr clients running in this process. Clients created after calling this method will automatically authenticate using the provided credentials.

Parameters:

conf - Configuration that stores the CREDENTIALS_FILE_LOCATION, probably passed to initCredentials(File, Configuration, String)

serviceName - should be the same as passed to initCredentials(org.apache.solr.client.solrj.SolrServer, org.apache.hadoop.mapreduce.JobContext, java.lang.String)

Throws:

IOException

cleanupCredentials

public static void cleanupCredentials(SolrServer server,
                      org.apache.hadoop.mapreduce.JobContext job,
                      String serviceName)
                               throws SolrServerException,
                                      IOException

Cleanup job credentials; call at the end of the job so that credentials can't be used outside of the lifetime of the job.

Parameters:

server - SolrServer to cleanup the credentials on

job - JobContext to load the credentials from

serviceName - should be the same as passed to initCredentials(org.apache.solr.client.solrj.SolrServer, org.apache.hadoop.mapreduce.JobContext, java.lang.String)

Throws:

SolrServerException

IOException

cleanupCredentials

public static void cleanupCredentials(SolrServer server,
                      org.apache.hadoop.conf.Configuration conf,
                      String serviceName)
                               throws SolrServerException,
                                      IOException

Cleanup job credentials; call at the end of the job so that credentials can't be used outside of the lifetime of the job.

Parameters:

server - SolrServer to cleanup the credentials on

conf - Configuration that stores the CREDENTIALS_FILE_LOCATION, probably passed to initCredentials(File, Configuration, String)

serviceName - should be the same as passed to initCredentials(org.apache.solr.client.solrj.SolrServer, org.apache.hadoop.mapreduce.JobContext, java.lang.String)

Throws:

SolrServerException

IOException