Package org.apache.hadoop.security

Class WhitelistBasedResolver

java.lang.Object

org.apache.hadoop.security.SaslPropertiesResolver

org.apache.hadoop.security.WhitelistBasedResolver

All Implemented Interfaces:

Configurable

public class WhitelistBasedResolver
extends SaslPropertiesResolver

An implementation of the SaslPropertiesResolver. Uses a white list of IPs. If the connection's IP address is in the list of IP addresses, the salProperties will be unchanged. If the connection's IP is not in the list of IP addresses, then QOP for the connection will be restricted to "hadoop.rpc.protection.non-whitelist" Uses 3 IPList implementations together to form an aggregate whitelist. 1. ConstantIPList - to check against a set of hardcoded IPs 2. Fixed IP List - to check against a list of IP addresses which are specified externally, but will not change over runtime. 3. Variable IP List - to check against a list of IP addresses which are specified externally and could change during runtime. A connection IP address will checked against these 3 IP Lists in the order specified above. Once a match is found , the IP address is determined to be in whitelist. The behavior can be configured using a bunch of configuration parameters.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	HADOOP_RPC_PROTECTION_NON_WHITELIST	comma separated list containing alternate hadoop.rpc.protection values for clients which are not in whitelist
static final String	HADOOP_SECURITY_SASL_FIXEDWHITELIST_FILE	Path to the file to containing subnets and ip addresses to form fixed whitelist.
static final String	HADOOP_SECURITY_SASL_VARIABLEWHITELIST_CACHE_SECS	time in seconds by which the variable whitelist file is checked for updates
static final String	HADOOP_SECURITY_SASL_VARIABLEWHITELIST_ENABLE	Enables/Disables variable whitelist
static final String	HADOOP_SECURITY_SASL_VARIABLEWHITELIST_FILE	Path to the file to containing subnets and ip addresses to form variable whitelist.
static final org.slf4j.Logger	LOG

Constructor Summary

Constructors

Constructor	Description
WhitelistBasedResolver()

Method Summary

Modifier and Type	Method	Description
Map<String,String>	getServerProperties(String clientAddress)
Map<String,String>	getServerProperties(InetAddress clientAddress)	Identify the Sasl Properties to be used for a connection with a client.
void	setConf(Configuration conf)	Set the configuration to be used by this object.

Methods inherited from class org.apache.hadoop.security.SaslPropertiesResolver

getClientProperties, getClientProperties, getConf, getDefaultProperties, getInstance, getServerProperties

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOG

public static final org.slf4j.Logger LOG

HADOOP_SECURITY_SASL_FIXEDWHITELIST_FILE

public static final String HADOOP_SECURITY_SASL_FIXEDWHITELIST_FILE

Path to the file to containing subnets and ip addresses to form fixed whitelist.

See Also:

• Constant Field Values

HADOOP_SECURITY_SASL_VARIABLEWHITELIST_ENABLE

public static final String HADOOP_SECURITY_SASL_VARIABLEWHITELIST_ENABLE

Enables/Disables variable whitelist

See Also:

• Constant Field Values

HADOOP_SECURITY_SASL_VARIABLEWHITELIST_FILE

public static final String HADOOP_SECURITY_SASL_VARIABLEWHITELIST_FILE

Path to the file to containing subnets and ip addresses to form variable whitelist.

See Also:

• Constant Field Values

HADOOP_SECURITY_SASL_VARIABLEWHITELIST_CACHE_SECS

public static final String HADOOP_SECURITY_SASL_VARIABLEWHITELIST_CACHE_SECS

time in seconds by which the variable whitelist file is checked for updates

See Also:

• Constant Field Values

HADOOP_RPC_PROTECTION_NON_WHITELIST

public static final String HADOOP_RPC_PROTECTION_NON_WHITELIST

comma separated list containing alternate hadoop.rpc.protection values for clients which are not in whitelist

See Also:

• Constant Field Values

Constructor Details

WhitelistBasedResolver

public WhitelistBasedResolver()

Method Details

setConf

public void setConf(Configuration conf)

Description copied from interface: Configurable

Set the configuration to be used by this object.

Specified by:

setConf in interface Configurable

Overrides:

setConf in class SaslPropertiesResolver

Parameters:

conf - configuration to be used

getServerProperties

public Map<String,String> getServerProperties(InetAddress clientAddress)

Identify the Sasl Properties to be used for a connection with a client.

Overrides:

getServerProperties in class SaslPropertiesResolver

Parameters:

clientAddress - client's address

Returns:

the sasl properties to be used for the connection.

getServerProperties

public Map<String,String> getServerProperties(String clientAddress)
                                       throws UnknownHostException

Throws:

UnknownHostException