| 1354 | } |
| 1355 | |
| 1356 | Status AuthManager::InitKerberosEnv() { |
| 1357 | if (IsKerberosEnabled()) { |
| 1358 | RETURN_IF_ERROR(CheckReplayCacheDirPermissions()); |
| 1359 | if (FLAGS_keytab_file.empty()) { |
| 1360 | return Status("--keytab_file must be configured if kerberos is enabled"); |
| 1361 | } |
| 1362 | if (FLAGS_krb5_ccname.empty()) { |
| 1363 | return Status("--krb5_ccname must be configured if kerberos is enabled"); |
| 1364 | } |
| 1365 | } |
| 1366 | |
| 1367 | if (!FLAGS_keytab_file.empty()) { |
| 1368 | if (!is_regular(FLAGS_keytab_file)) { |
| 1369 | return Status(Substitute("Bad --keytab_file value: The file $0 is not a " |
| 1370 | "regular file", FLAGS_keytab_file)); |
| 1371 | } |
| 1372 | |
| 1373 | // Set the keytab name in the environment so that Sasl Kerberos and kinit can |
| 1374 | // find and use it. |
| 1375 | if (setenv("KRB5_KTNAME", FLAGS_keytab_file.c_str(), 1)) { |
| 1376 | return Status(Substitute("Kerberos could not set KRB5_KTNAME: $0", |
| 1377 | GetStrErrMsg())); |
| 1378 | } |
| 1379 | } |
| 1380 | |
| 1381 | if (!FLAGS_krb5_ccname.empty()) { |
| 1382 | // We want to set a custom location for the impala credential cache. |
| 1383 | // Usually, it's /tmp/krb5cc_xxx where xxx is the UID of the process. This |
| 1384 | // is normally fine, but if you're not running impala daemons as user |
| 1385 | // 'impala', the kinit we perform is going to blow away credentials for the |
| 1386 | // current user. Not setting this isn't technically fatal, so ignore errors. |
| 1387 | const path krb5_ccname_path(FLAGS_krb5_ccname); |
| 1388 | if (!krb5_ccname_path.is_absolute()) { |
| 1389 | return Status(Substitute("Bad --krb5_ccname value: $0 is not an absolute file path", |
| 1390 | FLAGS_krb5_ccname)); |
| 1391 | } |
| 1392 | discard_result(setenv("KRB5CCNAME", FLAGS_krb5_ccname.c_str(), 1)); |
| 1393 | } |
| 1394 | |
| 1395 | // If an alternate krb5_conf location is supplied, set both KRB5_CONFIG and |
| 1396 | // JAVA_TOOL_OPTIONS in the environment. |
| 1397 | if (!FLAGS_krb5_conf.empty()) { |
| 1398 | // Ensure it points to a regular file |
| 1399 | if (!is_regular(FLAGS_krb5_conf)) { |
| 1400 | return Status(Substitute("Bad --krb5_conf value: The file $0 is not a " |
| 1401 | "regular file", FLAGS_krb5_conf)); |
| 1402 | } |
| 1403 | |
| 1404 | // Overwrite KRB5_CONFIG |
| 1405 | if (setenv("KRB5_CONFIG", FLAGS_krb5_conf.c_str(), 1) < 0) { |
| 1406 | return Status(Substitute("Bad --krb5_conf value: Could not set " |
| 1407 | "KRB5_CONFIG: $0", GetStrErrMsg())); |
| 1408 | } |
| 1409 | |
| 1410 | RETURN_IF_ERROR(EnvAppend("JAVA_TOOL_OPTIONS", "java.security.krb5.conf", |
| 1411 | FLAGS_krb5_conf)); |
| 1412 | |
| 1413 | LOG(INFO) << "Using custom Kerberos configuration file at " |
nothing calls this directly
no test coverage detected