container-common/src/main/java/com/streamsets/datacollector/security/SecurityContext.java
public synchronized void login() {
    if (subject != null) {
      throw new IllegalStateException(Utils.format("Service already login, Principal '{}'",
                                                   subject.getPrincipals()));
    }
    if (securityConfiguration.isKerberosEnabled()) {
      try {
        loginContext = createLoginContext();
        subject = loginContext.getSubject();
      } catch (Exception ex) {
        throw new RuntimeException(Utils.format("Could not get Kerberos credentials: {}", ex.toString()), ex);
      }
      if (renewalThread == null) {
        renewalThread = new Thread() {
          @Override
          public void run() {
            LOG.debug("Starting renewal thread");
            if (!SecurityContext.this.sleep(THIRTY_SECONDS_MS)) {
              LOG.info("Interrupted, exiting renewal thread");
              return;
            }
            while (true) {
              LOG.trace("Renewal check starts");
              try {
                KerberosTicket lastExpiringTGT = getNewestTGT();
                if (lastExpiringTGT == null) {
                  LOG.warn(
                      "Could not obtain kerberos ticket, it may have expired already or it was logged out, will wait" +
                      "30 secs to attempt a relogin"
                  );
                  LOG.trace("Ticket not found, sleeping 30 secs and trying to login");
                  if (!SecurityContext.this.sleep(THIRTY_SECONDS_MS)) {
                    LOG.info("Interrupted, exiting renewal thread");
                    return;
                  }
                } else {
                  long renewalTimeMs = calculateRenewalTime(lastExpiringTGT) - THIRTY_SECONDS_MS;
                  LOG.trace("Ticket found time to renewal '{}ms', sleeping that time", renewalTimeMs);
                  if (renewalTimeMs > 0) {
                    if (!SecurityContext.this.sleep(renewalTimeMs)) {
                      LOG.info("Interrupted, exiting renewal thread");
                      return;
                    }
                  }
                }
                LOG.debug("Triggering relogin");
                Set<KerberosTicket> oldTickets = getSubject().getPrivateCredentials(KerberosTicket.class);
                relogin(3);
                // Remove all old private credentials, since we only need the new one we just added
                getSubject().getPrivateCredentials().removeAll(oldTickets);
              } catch (Exception exception) {
                LOG.error("Stopping renewal thread because of exception: " + exception, exception);
                return;
              }
              catch (Throwable throwable) {
                LOG.error("Error in renewal thread: " + throwable, throwable);
                return;
              }
            }
          }
        };
        List<String> principals = new ArrayList<>();
        for (Principal p : subject.getPrincipals()) {
          principals.add(p.getName());
        }
        renewalThread.setName("Kerberos-Renewal-Thread-" + Joiner.on(",").join(principals));
        renewalThread.setContextClassLoader(Thread.currentThread().getContextClassLoader());
        renewalThread.setDaemon(true);
        renewalThread.start();
      }
    } else {
      subject = new Subject();
    }
    LOG.debug("Login. Kerberos enabled '{}', Principal '{}'", securityConfiguration.isKerberosEnabled(),
      subject.getPrincipals());
  }
public synchronized void login() {
    if (subject != null) {
      throw new IllegalStateException(Utils.format("Service already login, Principal '{}'",
                                                   subject.getPrincipals()));
    }
    if (securityConfiguration.isKerberosEnabled()) {
      try {
        loginContext = createLoginContext();
        subject = loginContext.getSubject();
      } catch (Exception ex) {
        throw new RuntimeException(Utils.format("Could not get Kerberos credentials: {}", ex.toString()), ex);
      }
      if (renewalThread == null) {
        renewalThread = new Thread() {
          @Override
          public void run() {
            LOG.debug("Starting renewal thread");
            if (!SecurityContext.this.sleep(THIRTY_SECONDS_MS)) {
              LOG.info("Interrupted, exiting renewal thread");
              return;
            }
            while (true) {
              LOG.trace("Renewal check starts");
              try {
                KerberosTicket lastExpiringTGT = getNewestTGT();
                if (lastExpiringTGT == null) {
                  LOG.warn(
                      "Could not obtain kerberos ticket, it may have expired already or it was logged out, will wait" +
                      "30 secs to attempt a relogin"
                  );
                  LOG.trace("Ticket not found, sleeping 30 secs and trying to login");
                  if (!SecurityContext.this.sleep(THIRTY_SECONDS_MS)) {
                    LOG.info("Interrupted, exiting renewal thread");
                    return;
                  }
                } else {
                  long renewalTimeMs = calculateRenewalTime(lastExpiringTGT) - THIRTY_SECONDS_MS;
                  LOG.trace("Ticket found time to renewal '{}ms', sleeping that time", renewalTimeMs);
                  if (renewalTimeMs > 0) {
                    if (!SecurityContext.this.sleep(renewalTimeMs)) {
                      LOG.info("Interrupted, exiting renewal thread");
                      return;
                    }
                  }
                }
                LOG.debug("Triggering relogin");
                Set<KerberosTicket> oldTickets = getSubject().getPrivateCredentials(KerberosTicket.class);
                relogin(3);
                // Remove all old private credentials, since we only need the new one we just added
                getSubject().getPrivateCredentials().removeAll(oldTickets);
              } catch (Exception exception) {
                LOG.error("Stopping renewal thread because of exception: " + exception, exception);
                return;
              }
              catch (Throwable throwable) {
                LOG.error("Error in renewal thread: " + throwable, throwable);
                return;
              }
            }
          }
        };
        List<String> principals = new ArrayList<>();
        for (Principal p : subject.getPrincipals()) {
          principals.add(p.getName());
        }
        renewalThread.setName("Kerberos-Renewal-Thread-" + Joiner.on(",").join(principals));
        renewalThread.setContextClassLoader(Thread.currentThread().getContextClassLoader());
        renewalThread.setDaemon(true);
        renewalThread.start();
      }
    } else {
      subject = new Subject();
    }
    LOG.debug("Login. Kerberos enabled '{}', Principal '{}'", securityConfiguration.isKerberosEnabled(),
      subject.getPrincipals());
  }
public synchronized void login ( ) { if ( subject != null ) { throw new IllegalStateException ( Utils . format ( "Service already login, Principal '{}'" , subject . getPrincipals ( ) ) ) ; } if ( securityConfiguration . isKerberosEnabled ( ) ) { try { loginContext = createLoginContext ( ) ; subject = loginContext . getSubject ( ) ; } catch ( Exception ex ) { throw new RuntimeException ( Utils . format ( "Could not get Kerberos credentials: {}" , ex . toString ( ) ) , ex ) ; } if ( renewalThread == null ) { renewalThread = new Thread ( ) { @ Override public void run ( ) { LOG . debug ( "Starting renewal thread" ) ; if ( ! SecurityContext . this . sleep ( THIRTY_SECONDS_MS ) ) { LOG . info ( "Interrupted, exiting renewal thread" ) ; return ; } while ( true ) { LOG . trace ( "Renewal check starts" ) ; try { KerberosTicket lastExpiringTGT = getNewestTGT ( ) ; if ( lastExpiringTGT == null ) { LOG . warn ( "Could not obtain kerberos ticket, it may have expired already or it was logged out, will wait" + "30 secs to attempt a relogin" ) ; LOG . trace ( "Ticket not found, sleeping 30 secs and trying to login" ) ; if ( ! SecurityContext . this . sleep ( THIRTY_SECONDS_MS ) ) { LOG . info ( "Interrupted, exiting renewal thread" ) ; return ; } } else { long renewalTimeMs = calculateRenewalTime ( lastExpiringTGT ) - THIRTY_SECONDS_MS ; LOG . trace ( "Ticket found time to renewal '{}ms', sleeping that time" , renewalTimeMs ) ; if ( renewalTimeMs > 0 ) { if ( ! SecurityContext . this . sleep ( renewalTimeMs ) ) { LOG . info ( "Interrupted, exiting renewal thread" ) ; return ; } } } LOG . debug ( "Triggering relogin" ) ; Set < KerberosTicket > oldTickets = getSubject ( ) . getPrivateCredentials ( KerberosTicket . class ) ; relogin ( 3 ) ; // Remove all old private credentials, since we only need the new one we just added getSubject ( ) . getPrivateCredentials ( ) . removeAll ( oldTickets ) ; } catch ( Exception exception ) { LOG . error ( "Stopping renewal thread because of exception: " + exception , exception ) ; return ; } catch ( Throwable throwable ) { LOG . error ( "Error in renewal thread: " + throwable , throwable ) ; return ; } } } } ; List < String > principals = new ArrayList <> ( ) ; for ( Principal p : subject . getPrincipals ( ) ) { principals . add ( p . getName ( ) ) ; } renewalThread . setName ( "Kerberos-Renewal-Thread-" + Joiner . on ( "," ) . join ( principals ) ) ; renewalThread . setContextClassLoader ( Thread . currentThread ( ) . getContextClassLoader ( ) ) ; renewalThread . setDaemon ( true ) ; renewalThread . start ( ) ; } } else { subject = new Subject ( ) ; } LOG . debug ( "Login. Kerberos enabled '{}', Principal '{}'" , securityConfiguration . isKerberosEnabled ( ) , subject . getPrincipals ( ) ) ; }
Logs in. If Kerberos is enabled it logs in against the KDC, otherwise is a NOP.
Logs in . If Kerberos is enabled it logs in against the KDC otherwise is a NOP .