ZKDelegationTokenSecretManager (Apache Hadoop Common 3.5.0 API)
Description: declaration: package: org.apache.hadoop.security.token.delegation, class: ZKDelegationTokenSecretManager

Package org.apache.hadoop.security.token.delegation

# Class ZKDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>

java.lang.Object
org.apache.hadoop.security.token.SecretManager<TokenIdent>
org.apache.hadoop.security.token.delegation.AbstractDelegationTokenSecretManager<TokenIdent>
org.apache.hadoop.security.token.delegation.ZKDelegationTokenSecretManager<TokenIdent>

@Private public abstract class ZKDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier> extends AbstractDelegationTokenSecretManager<TokenIdent>
An implementation of `AbstractDelegationTokenSecretManager` that persists TokenIdentifiers and DelegationKeys in Zookeeper. This class can be used by HA (Highly available) services that consists of multiple nodes. This class ensures that Identifiers and Keys are replicated to all nodes of the service.

- ## Nested Class Summary

  ## Nested classes/interfaces inherited from class org.apache.hadoop.security.token.delegation.AbstractDelegationTokenSecretManager

  `AbstractDelegationTokenSecretManager.DelegationTokenInformation`

  ## Nested classes/interfaces inherited from class org.apache.hadoop.security.token.SecretManager

  `SecretManager.InvalidToken`

- ## Field Summary

  Fields
  Modifier and Type
  Field
  Description
  `static final String`
  `ZK_CONF_PREFIX`
  `static final String`
  `ZK_DTSM_TOKEN_SEQNUM_BATCH_SIZE`
  `static final int`
  `ZK_DTSM_TOKEN_SEQNUM_BATCH_SIZE_DEFAULT`
  `static final String`
  `ZK_DTSM_TOKEN_WATCHER_ENABLED`
  `static final boolean`
  `ZK_DTSM_TOKEN_WATCHER_ENABLED_DEFAULT`
  `protected static final String`
  `ZK_DTSM_TOKENS_ROOT`
  `static final String`
  `ZK_DTSM_ZK_AUTH_TYPE`
  `static final String`
  `ZK_DTSM_ZK_CONNECTION_STRING`
  `static final String`
  `ZK_DTSM_ZK_CONNECTION_TIMEOUT`
  `static final int`
  `ZK_DTSM_ZK_CONNECTION_TIMEOUT_DEFAULT`
  `static final String`
  `ZK_DTSM_ZK_KERBEROS_KEYTAB`
  `static final String`
  `ZK_DTSM_ZK_KERBEROS_PRINCIPAL`
  `static final String`
  `ZK_DTSM_ZK_KERBEROS_SERVER_PRINCIPAL`
  `static final String`
  `ZK_DTSM_ZK_NUM_RETRIES`
  `static final int`
  `ZK_DTSM_ZK_NUM_RETRIES_DEFAULT`
  `static final String`
  `ZK_DTSM_ZK_SESSION_TIMEOUT`
  `static final int`
  `ZK_DTSM_ZK_SESSION_TIMEOUT_DEFAULT`
  `static final String`
  `ZK_DTSM_ZK_SHUTDOWN_TIMEOUT`
  `static final int`
  `ZK_DTSM_ZK_SHUTDOWN_TIMEOUT_DEFAULT`
  `static final String`
  `ZK_DTSM_ZK_SSL_ENABLED`
  `static final String`
  `ZK_DTSM_ZK_SSL_KEYSTORE_LOCATION`
  `static final String`
  `ZK_DTSM_ZK_SSL_KEYSTORE_PASSWORD`
  `static final String`
  `ZK_DTSM_ZK_SSL_TRUSTSTORE_LOCATION`
  `static final String`
  `ZK_DTSM_ZK_SSL_TRUSTSTORE_PASSWORD`
  `static final String`
  `ZK_DTSM_ZNODE_WORKING_PATH`
  `static final String`
  `ZK_DTSM_ZNODE_WORKING_PATH_DEAFULT`
  `protected final org.apache.curator.framework.CuratorFramework`
  `zkClient`

  ### Fields inherited from class org.apache.hadoop.security.token.delegation.AbstractDelegationTokenSecretManager

  `allKeys, currentId, currentTokens, delegationTokenSequenceNumber, noInterruptsLock, running, storeTokenTrackingId, tokenOwnerStats`

- ## Constructor Summary

  Constructors
  Constructor
  Description
  `ZKDelegationTokenSecretManager(Configuration conf)`

- ## Method Summary

  Modifier and Type
  Method
  Description
  `protected void`
  `addOrUpdateToken(TokenIdent ident, AbstractDelegationTokenSecretManager.DelegationTokenInformation info, boolean isUpdate)`
  `TokenIdent`
  `cancelToken(Token<TokenIdent> token, String canceller)`
  Cancel a token by removing it from cache.
  `protected static org.apache.curator.framework.CuratorFramework`
  `getCurator()`
  `protected int`
  `getCurrentKeyId()`
  For subclasses externalizing the storage, for example Zookeeper based implementations.
  `protected DelegationKey`
  `getDelegationKey(int keyId)`
  For subclasses externalizing the storage, for example Zookeeper based implementations.
  `protected int`
  `getDelegationTokenSeqNum()`
  For subclasses externalizing the storage, for example Zookeeper based implementations.
  `protected AbstractDelegationTokenSecretManager.DelegationTokenInformation`
  `getTokenInfo(TokenIdent ident)`
  For subclasses externalizing the storage, for example Zookeeper based implementations
  `protected AbstractDelegationTokenSecretManager.DelegationTokenInformation`
  `getTokenInfoFromZK(String nodePath, boolean quiet)`
  `protected AbstractDelegationTokenSecretManager.DelegationTokenInformation`
  `getTokenInfoFromZK(TokenIdent ident)`
  `protected AbstractDelegationTokenSecretManager.DelegationTokenInformation`
  `getTokenInfoFromZK(TokenIdent ident, boolean quiet)`
  `protected int`
  `incrementCurrentKeyId()`
  For subclasses externalizing the storage, for example Zookeeper based implementations.
  `protected int`
  `incrementDelegationTokenSeqNum()`
  For subclasses externalizing the storage, for example Zookeeper based implementations.
  `boolean`
  `isTokenWatcherEnabled()`
  `protected TokenIdent`
  `processTokenAddOrUpdate(byte[] data)`
  `protected void`
  `removeStoredMasterKey(DelegationKey key)`
  `protected void`
  `removeStoredToken(TokenIdent ident)`
  `protected void`
  `removeStoredToken(TokenIdent ident, boolean checkAgainstZkBeforeDeletion)`
  `static void`
  `setCurator(org.apache.curator.framework.CuratorFramework curator)`
  `protected void`
  `setDelegationTokenSeqNum(int seqNum)`
  For subclasses externalizing the storage, for example Zookeeper based implementations.
  `void`
  `startThreads()`
  should be called before this object is used.
  `void`
  `stopThreads()`
  `protected void`
  `storeDelegationKey(DelegationKey key)`
  For subclasses externalizing the storage, for example Zookeeper based implementations.
  `protected void`
  `storeToken(TokenIdent ident, AbstractDelegationTokenSecretManager.DelegationTokenInformation tokenInfo)`
  For subclasses externalizing the storage, for example Zookeeper based implementations.
  `protected void`
  `syncLocalCacheWithZk(TokenIdent ident)`
  This method synchronizes the state of a delegation token information in local cache with its actual value in Zookeeper.
  `protected void`
  `updateDelegationKey(DelegationKey key)`
  For subclasses externalizing the storage, for example Zookeeper based implementations.
  `protected void`
  `updateToken(TokenIdent ident, AbstractDelegationTokenSecretManager.DelegationTokenInformation tokenInfo)`
  For subclasses externalizing the storage, for example Zookeeper based implementations.

  ### Methods inherited from class org.apache.hadoop.security.token.delegation.AbstractDelegationTokenSecretManager

  `addKey, addPersistedDelegationToken, addTokenForOwnerStats, checkToken, createPassword, createSecretKey, decodeTokenIdentifier, getAllKeys, getCandidateTokensForCleanup, getCurrentTokensSize, getMetrics, getTokenRenewInterval, getTokenTrackingId, getTopTokenRealOwners, getTrackingIdIfEnabled, isRunning, logExpireToken, logExpireTokens, logUpdateMasterKey, removeExpiredStoredToken, renewToken, reset, retrievePassword, rollMasterKey, setCurrentKeyId, storeNewMasterKey, storeNewToken, syncTokenOwnerStats, updateStoredToken, verifyToken`

  ### Methods inherited from class org.apache.hadoop.security.token.SecretManager

  `checkAvailableForRead, createIdentifier, createPassword, generateSecret, retriableRetrievePassword, update, validateSecretKeyLength`

  ### Methods inherited from class java.lang.Object

  `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- ## Field Details

  - ### ZK_CONF_PREFIX

    public static final String ZK_CONF_PREFIX
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_NUM_RETRIES

    public static final String ZK_DTSM_ZK_NUM_RETRIES
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_SESSION_TIMEOUT

    public static final String ZK_DTSM_ZK_SESSION_TIMEOUT
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_CONNECTION_TIMEOUT

    public static final String ZK_DTSM_ZK_CONNECTION_TIMEOUT
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_SHUTDOWN_TIMEOUT

    public static final String ZK_DTSM_ZK_SHUTDOWN_TIMEOUT
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZNODE_WORKING_PATH

    public static final String ZK_DTSM_ZNODE_WORKING_PATH
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_AUTH_TYPE

    public static final String ZK_DTSM_ZK_AUTH_TYPE
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_CONNECTION_STRING

    public static final String ZK_DTSM_ZK_CONNECTION_STRING
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_KERBEROS_KEYTAB

    public static final String ZK_DTSM_ZK_KERBEROS_KEYTAB
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_KERBEROS_PRINCIPAL

    public static final String ZK_DTSM_ZK_KERBEROS_PRINCIPAL
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_KERBEROS_SERVER_PRINCIPAL

    public static final String ZK_DTSM_ZK_KERBEROS_SERVER_PRINCIPAL
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_TOKEN_SEQNUM_BATCH_SIZE

    public static final String ZK_DTSM_TOKEN_SEQNUM_BATCH_SIZE
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_TOKEN_WATCHER_ENABLED

    public static final String ZK_DTSM_TOKEN_WATCHER_ENABLED
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_TOKEN_WATCHER_ENABLED_DEFAULT

    public static final boolean ZK_DTSM_TOKEN_WATCHER_ENABLED_DEFAULT
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_SSL_ENABLED

    public static final String ZK_DTSM_ZK_SSL_ENABLED
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_SSL_KEYSTORE_LOCATION

    public static final String ZK_DTSM_ZK_SSL_KEYSTORE_LOCATION
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_SSL_KEYSTORE_PASSWORD

    public static final String ZK_DTSM_ZK_SSL_KEYSTORE_PASSWORD
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_SSL_TRUSTSTORE_LOCATION

    public static final String ZK_DTSM_ZK_SSL_TRUSTSTORE_LOCATION
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_SSL_TRUSTSTORE_PASSWORD

    public static final String ZK_DTSM_ZK_SSL_TRUSTSTORE_PASSWORD
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_NUM_RETRIES_DEFAULT

    public static final int ZK_DTSM_ZK_NUM_RETRIES_DEFAULT
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_SESSION_TIMEOUT_DEFAULT

    public static final int ZK_DTSM_ZK_SESSION_TIMEOUT_DEFAULT
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_CONNECTION_TIMEOUT_DEFAULT

    public static final int ZK_DTSM_ZK_CONNECTION_TIMEOUT_DEFAULT
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZK_SHUTDOWN_TIMEOUT_DEFAULT

    public static final int ZK_DTSM_ZK_SHUTDOWN_TIMEOUT_DEFAULT
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_ZNODE_WORKING_PATH_DEAFULT

    public static final String ZK_DTSM_ZNODE_WORKING_PATH_DEAFULT
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_TOKEN_SEQNUM_BATCH_SIZE_DEFAULT

    public static final int ZK_DTSM_TOKEN_SEQNUM_BATCH_SIZE_DEFAULT
    See Also:
      - Constant Field Values

  - ### ZK_DTSM_TOKENS_ROOT

    protected static final String ZK_DTSM_TOKENS_ROOT
    See Also:
      - Constant Field Values

  - ### zkClient

    protected final org.apache.curator.framework.CuratorFramework zkClient

- ## Constructor Details

  - ### ZKDelegationTokenSecretManager

    public ZKDelegationTokenSecretManager(Configuration conf)

- ## Method Details

  - ### setCurator

    public static void setCurator(org.apache.curator.framework.CuratorFramework curator)

  - ### getCurator

    @VisibleForTesting protected static org.apache.curator.framework.CuratorFramework getCurator()

  - ### startThreads

    public void startThreads() throws IOException
    Description copied from class: `AbstractDelegationTokenSecretManager`
    should be called before this object is used.
    Overrides:
      `startThreads` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`
    Throws:
      `IOException` - raised on errors performing I/O.

  - ### processTokenAddOrUpdate

    protected TokenIdent processTokenAddOrUpdate(byte[] data) throws IOException
    Throws:
      `IOException`

  - ### stopThreads

    public void stopThreads()
    Overrides:
      `stopThreads` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`

  - ### getDelegationTokenSeqNum

    protected int getDelegationTokenSeqNum()
    Description copied from class: `AbstractDelegationTokenSecretManager`
    For subclasses externalizing the storage, for example Zookeeper based implementations.
    Overrides:
      `getDelegationTokenSeqNum` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`
    Returns:
      delegationTokenSequenceNumber.

  - ### incrementDelegationTokenSeqNum

    protected int incrementDelegationTokenSeqNum()
    Description copied from class: `AbstractDelegationTokenSecretManager`
    For subclasses externalizing the storage, for example Zookeeper based implementations.
    Overrides:
      `incrementDelegationTokenSeqNum` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`
    Returns:
      delegationTokenSequenceNumber.

  - ### setDelegationTokenSeqNum

    protected void setDelegationTokenSeqNum(int seqNum)
    Description copied from class: `AbstractDelegationTokenSecretManager`
    For subclasses externalizing the storage, for example Zookeeper based implementations.
    Overrides:
      `setDelegationTokenSeqNum` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`
    Parameters:
      `seqNum` - seqNum.

  - ### getCurrentKeyId

    protected int getCurrentKeyId()
    Description copied from class: `AbstractDelegationTokenSecretManager`
    For subclasses externalizing the storage, for example Zookeeper based implementations.
    Overrides:
      `getCurrentKeyId` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`
    Returns:
      currentId.

  - ### incrementCurrentKeyId

    protected int incrementCurrentKeyId()
    Description copied from class: `AbstractDelegationTokenSecretManager`
    For subclasses externalizing the storage, for example Zookeeper based implementations.
    Overrides:
      `incrementCurrentKeyId` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`
    Returns:
      currentId.

  - ### getDelegationKey

    protected DelegationKey getDelegationKey(int keyId)
    Description copied from class: `AbstractDelegationTokenSecretManager`
    For subclasses externalizing the storage, for example Zookeeper based implementations.
    Overrides:
      `getDelegationKey` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`
    Parameters:
      `keyId` - keyId.
    Returns:
      DelegationKey.

  - ### getTokenInfo

    protected AbstractDelegationTokenSecretManager.DelegationTokenInformation getTokenInfo(TokenIdent ident)
    Description copied from class: `AbstractDelegationTokenSecretManager`
    For subclasses externalizing the storage, for example Zookeeper based implementations
    Overrides:
      `getTokenInfo` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`
    Parameters:
      `ident` - ident.
    Returns:
      DelegationTokenInformation.

  - ### syncLocalCacheWithZk

    protected void syncLocalCacheWithZk(TokenIdent ident)
    This method synchronizes the state of a delegation token information in local cache with its actual value in Zookeeper.
    Parameters:
      `ident` - Identifier of the token

  - ### getTokenInfoFromZK

    protected AbstractDelegationTokenSecretManager.DelegationTokenInformation getTokenInfoFromZK(TokenIdent ident) throws IOException
    Throws:
      `IOException`

  - ### getTokenInfoFromZK

    protected AbstractDelegationTokenSecretManager.DelegationTokenInformation getTokenInfoFromZK(TokenIdent ident, boolean quiet) throws IOException
    Throws:
      `IOException`

  - ### getTokenInfoFromZK

    protected AbstractDelegationTokenSecretManager.DelegationTokenInformation getTokenInfoFromZK(String nodePath, boolean quiet) throws IOException
    Throws:
      `IOException`

  - ### storeDelegationKey

    protected void storeDelegationKey(DelegationKey key) throws IOException
    Description copied from class: `AbstractDelegationTokenSecretManager`
    For subclasses externalizing the storage, for example Zookeeper based implementations.
    Overrides:
      `storeDelegationKey` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`
    Parameters:
      `key` - DelegationKey.
    Throws:
      `IOException` - raised on errors performing I/O.

  - ### updateDelegationKey

    protected void updateDelegationKey(DelegationKey key) throws IOException
    Description copied from class: `AbstractDelegationTokenSecretManager`
    For subclasses externalizing the storage, for example Zookeeper based implementations.
    Overrides:
      `updateDelegationKey` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`
    Parameters:
      `key` - DelegationKey.
    Throws:
      `IOException` - raised on errors performing I/O.

  - ### removeStoredMasterKey

    protected void removeStoredMasterKey(DelegationKey key)
    Overrides:
      `removeStoredMasterKey` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`

  - ### storeToken

    protected void storeToken(TokenIdent ident, AbstractDelegationTokenSecretManager.DelegationTokenInformation tokenInfo) throws IOException
    Description copied from class: `AbstractDelegationTokenSecretManager`
    For subclasses externalizing the storage, for example Zookeeper based implementations.
    Overrides:
      `storeToken` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`
    Parameters:
      `ident` - ident.
      `tokenInfo` - tokenInfo.
    Throws:
      `IOException` - raised on errors performing I/O.

  - ### updateToken

    protected void updateToken(TokenIdent ident, AbstractDelegationTokenSecretManager.DelegationTokenInformation tokenInfo) throws IOException
    Description copied from class: `AbstractDelegationTokenSecretManager`
    For subclasses externalizing the storage, for example Zookeeper based implementations.
    Overrides:
      `updateToken` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`
    Parameters:
      `ident` - ident.
      `tokenInfo` - tokenInfo.
    Throws:
      `IOException` - raised on errors performing I/O.

  - ### removeStoredToken

    protected void removeStoredToken(TokenIdent ident) throws IOException
    Overrides:
      `removeStoredToken` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`
    Throws:
      `IOException`

  - ### removeStoredToken

    protected void removeStoredToken(TokenIdent ident, boolean checkAgainstZkBeforeDeletion) throws IOException
    Throws:
      `IOException`

  - ### cancelToken

    public TokenIdent cancelToken(Token<TokenIdent> token, String canceller) throws IOException
    Description copied from class: `AbstractDelegationTokenSecretManager`
    Cancel a token by removing it from cache.
    Overrides:
      `cancelToken` in class `AbstractDelegationTokenSecretManager<TokenIdent extends AbstractDelegationTokenIdentifier>`
    Parameters:
      `token` - token.
      `canceller` - canceller.
    Returns:
      Identifier of the canceled token
    Throws:
      `SecretManager.InvalidToken` - for invalid token
      `AccessControlException` - if the user isn't allowed to cancel
      `IOException`

  - ### addOrUpdateToken

    protected void addOrUpdateToken(TokenIdent ident, AbstractDelegationTokenSecretManager.DelegationTokenInformation info, boolean isUpdate) throws Exception
    Throws:
      `Exception`

  - ### isTokenWatcherEnabled

    public boolean isTokenWatcherEnabled()