co.cask.cdap.security.store

Class FileSecureStore

java.lang.Object

co.cask.cdap.security.store.FileSecureStore

All Implemented Interfaces:

co.cask.cdap.api.security.store.SecureStore, co.cask.cdap.api.security.store.SecureStoreManager

public class FileSecureStore
extends Object
implements co.cask.cdap.api.security.store.SecureStore, co.cask.cdap.api.security.store.SecureStoreManager

File based implementation of secure store. Uses Java JCEKS based keystore. When the client calls a put, the key is put in the keystore. The system then flushes the keystore to the file system. During the flush, the current file is first written to temporary file (_NEW). If that is successful then the temporary file is renamed atomically to the secure store file. If anything fails during this process then the keystore reverts to the last successfully written file. The keystore is flushed to the filesystem after every put and delete. This class is marked as Singleton because it won't work if this class is not a Singleton. Setting in(Scopes.Singleton) in the bindings doesn't work because we are binding this class to two interfaces and we need the instance to be shared between them.

Constructor Summary

Constructors

Constructor and Description
FileSecureStore(CConfiguration cConf, SConfiguration sConf, NamespaceQueryAdmin namespaceQueryAdmin)

Method Summary

Methods

Modifier and Type	Method and Description
void	deleteSecureData(String namespace, String name) Deletes the element with the given name.
co.cask.cdap.api.security.store.SecureStoreData	getSecureData(String namespace, String name) Returns the data stored in the secure store.
Map<String,String>	listSecureData(String namespace) List of all the entries in the secure store belonging to the specified namespace.
void	putSecureData(String namespace, String name, String data, String description, Map<String,String> properties) Stores an element in the secure store.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

FileSecureStore

@Inject
public FileSecureStore(CConfiguration cConf,
                      SConfiguration sConf,
                      NamespaceQueryAdmin namespaceQueryAdmin)
                throws IOException

Throws:

IOException

Method Detail

putSecureData

public void putSecureData(String namespace,
                 String name,
                 String data,
                 String description,
                 Map<String,String> properties)
                   throws Exception

Stores an element in the secure store. Although JCEKS supports overwriting keys the interface currently does not support it. If the key already exists then this method throws an AlreadyExistsException.

Specified by:

putSecureData in interface co.cask.cdap.api.security.store.SecureStoreManager

Parameters:

namespace - The namespace this key belongs to.

name - Name of the element to store.

data - The data that needs to be securely stored.

description - User provided description of the entry.

properties - Metadata associated with the data.

Throws:

NamespaceNotFoundException - If the specified namespace does not exist.

AlreadyExistsException - If the key already exists in the namespace. Updating is not supported.

IOException - If there was a problem storing the key to the in memory keystore or if there was problem persisting the keystore.

Exception

deleteSecureData

public void deleteSecureData(String namespace,
                    String name)
                      throws Exception

Deletes the element with the given name. Flushes the keystore after deleting the key from the in memory keystore. If the flush fails, we attempt to insert to key back to the in memory store and notify the user that delete failed. If the insertion in the key store fails after a flush failure then there would be a discrepancy between the in memory store and the file on the disk. This will be remedied the next time a flush happens. If another flush does not happen and the system is restarted, the only time that file is read, then we will have an extra key in the keystore.

Specified by:

deleteSecureData in interface co.cask.cdap.api.security.store.SecureStoreManager

Parameters:

namespace - The namespace this key belongs to.

name - Name of the element to be deleted.

Throws:

NamespaceNotFoundException - If the specified namespace does not exist.

NotFoundException - If the key to be deleted is not found.

IOException - If their was a problem during deleting the key from the in memory store or if there was a problem persisting the keystore after deleting the element.

Exception

listSecureData

public Map<String,String> listSecureData(String namespace)
                                  throws Exception

List of all the entries in the secure store belonging to the specified namespace. No filtering or authentication is done here.

Specified by:

listSecureData in interface co.cask.cdap.api.security.store.SecureStore

Parameters:

namespace - The namespace this key belongs to.

Returns:

A list of SecureStoreMetadata objects representing the data stored in the store.

Throws:

NamespaceNotFoundException - If the specified namespace does not exist.

IOException - If there was a problem reading from the keystore.

Exception

getSecureData

public co.cask.cdap.api.security.store.SecureStoreData getSecureData(String namespace,
                                                            String name)
                                                              throws Exception

Returns the data stored in the secure store.

Specified by:

getSecureData in interface co.cask.cdap.api.security.store.SecureStore

Parameters:

namespace - The namespace this key belongs to.

name - Name of the data element.

Returns:

An object representing the securely stored data associated with the name.

Throws:

NamespaceNotFoundException - If the specified namespace does not exist.

NotFoundException - If the key is not found in the store.

IOException - If there was a problem reading from the store.

Exception