co.cask.cdap.security.auth

Class DistributedKeyManager

java.lang.Object

com.google.common.util.concurrent.AbstractIdleService

co.cask.cdap.security.auth.AbstractKeyManager

co.cask.cdap.security.auth.DistributedKeyManager

All Implemented Interfaces:

KeyManager, ResourceListener<KeyIdentifier>, com.google.common.util.concurrent.Service

public class DistributedKeyManager
extends AbstractKeyManager
implements ResourceListener<KeyIdentifier>

KeyManager implementation that distributes shared secret keys via ZooKeeper to all instances, so that all distributed instances maintain the same local cache of keys. Instances of this class will perform leader election, so that one instance functions as the "active" leader at a time. The leader is responsible for periodically generating a new secret key (with the frequency based on the configured value for Constants.Security#TOKEN_DIGEST_KEY_EXPIRATION. Prior keys are retained for as long as necessary to ensure that any previously issued, non-expired tokens may be validated. Once a previously used key's age exceeds Constants.Security#TOKEN_DIGEST_KEY_EXPIRATION plus Constants.Security#TOKEN_EXPIRATION, the key can safely be removed.

Nested Class Summary

Nested classes/interfaces inherited from interface co.cask.cdap.security.auth.KeyManager

KeyManager.DigestId

Nested classes/interfaces inherited from interface com.google.common.util.concurrent.Service

com.google.common.util.concurrent.Service.Listener, com.google.common.util.concurrent.Service.State

Field Summary

Fields

Modifier and Type	Field and Description
protected AtomicBoolean	leader

Fields inherited from class co.cask.cdap.security.auth.AbstractKeyManager

currentKey, keyAlgo, keyExpirationPeriod, keyGenerator, keyLength, threadLocalMac

Constructor Summary

Constructors

Constructor and Description
DistributedKeyManager(CConfiguration conf, Codec<KeyIdentifier> codec, ZKClient zookeeper)
DistributedKeyManager(CConfiguration conf, Codec<KeyIdentifier> codec, ZKClient zookeeper, List<org.apache.zookeeper.data.ACL> acls)

Method Summary

Methods

Modifier and Type	Method and Description
protected void	addKey(KeyIdentifier key) Adds a given key instance.
protected void	doInit() Extended classes must override this method to initialize/read the key(s) used for signing tokens.
protected KeyIdentifier	getKey(int id) Returns the key instance matching a given unique ID.
protected boolean	hasKey(int id) Returns whether or not a key exists for the given unique ID.
void	onError(String name, Throwable throwable) Invoked when an error occurs in one of the resource operations.
void	onResourceDelete(String name) Invoked when a resource is removed from the shared cache.
void	onResourceUpdate(String name, KeyIdentifier instance) Invoked on an update to an individual resource.
void	onUpdate() Invoked when the entire set of cached resources has changed.
void	shutDown()

Methods inherited from class co.cask.cdap.security.auth.AbstractKeyManager

generateKey, generateMAC, generateMAC, generateMAC, startUp, validateMAC

Methods inherited from class com.google.common.util.concurrent.AbstractIdleService

addListener, executor, isRunning, start, startAndWait, state, stop, stopAndWait, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface com.google.common.util.concurrent.Service

addListener, isRunning, start, startAndWait, state, stop, stopAndWait

Field Detail

leader

protected final AtomicBoolean leader

Constructor Detail

DistributedKeyManager

public DistributedKeyManager(CConfiguration conf,
                     Codec<KeyIdentifier> codec,
                     ZKClient zookeeper)

DistributedKeyManager

public DistributedKeyManager(CConfiguration conf,
                     Codec<KeyIdentifier> codec,
                     ZKClient zookeeper,
                     List<org.apache.zookeeper.data.ACL> acls)

Method Detail

doInit

protected void doInit()
               throws IOException

Description copied from class: AbstractKeyManager

Extended classes must override this method to initialize/read the key(s) used for signing tokens.

Specified by:

doInit in class AbstractKeyManager

Throws:

IOException

shutDown

public void shutDown()

Specified by:

shutDown in class com.google.common.util.concurrent.AbstractIdleService

hasKey

protected boolean hasKey(int id)

Description copied from class: AbstractKeyManager

Returns whether or not a key exists for the given unique ID.

Specified by:

hasKey in class AbstractKeyManager

getKey

protected KeyIdentifier getKey(int id)

Description copied from class: AbstractKeyManager

Returns the key instance matching a given unique ID.

Specified by:

getKey in class AbstractKeyManager

addKey

protected void addKey(KeyIdentifier key)

Description copied from class: AbstractKeyManager

Adds a given key instance.

Specified by:

addKey in class AbstractKeyManager

onUpdate

public void onUpdate()

Description copied from interface: ResourceListener

Invoked when the entire set of cached resources has changed.

Specified by:

onUpdate in interface ResourceListener<KeyIdentifier>

onResourceUpdate

public void onResourceUpdate(String name,
                    KeyIdentifier instance)

Description copied from interface: ResourceListener

Invoked on an update to an individual resource.

Specified by:

onResourceUpdate in interface ResourceListener<KeyIdentifier>

Parameters:

name - the key for the resource being updated

instance - the resource instance which was updated

onResourceDelete

public void onResourceDelete(String name)

Description copied from interface: ResourceListener

Invoked when a resource is removed from the shared cache.

Specified by:

onResourceDelete in interface ResourceListener<KeyIdentifier>

Parameters:

name - the key for the resource that has been removed

onError

public void onError(String name,
           Throwable throwable)

Description copied from interface: ResourceListener

Invoked when an error occurs in one of the resource operations.

Specified by:

onError in interface ResourceListener<KeyIdentifier>

Parameters:

name - the key for the resource on which the error occurred

throwable - the exception that was thrown