WIP

Author: cgivre

contrib/storage-phoenix/pom.xml

@@ -39,7 +39,6 @@
   </properties>
 
   <dependencies>
-    <!-- Drill -->
     <dependency>
       <groupId>org.apache.drill.exec</groupId>
       <artifactId>drill-java-exec</artifactId>
@@ -231,6 +230,8 @@
             -Xms2048m -Xmx2048m
             --add-opens=java.base/java.lang=ALL-UNNAMED
             --add-opens=java.base/java.util=ALL-UNNAMED
+            -Dhbase.security.authentication=simple
+            -Dhadoop.security.authentication=simple
           </argLine>
         </configuration>
       </plugin>

contrib/storage-phoenix/src/test/java/org/apache/drill/exec/store/phoenix/secured/PhoenixEnvironment.java

@@ -17,29 +17,18 @@
  */
 package org.apache.drill.exec.store.phoenix.secured;
 
-import static org.apache.hadoop.hbase.HConstants.HBASE_DIR;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-
-import java.io.File;
-import java.io.IOException;
-import java.lang.reflect.Field;
-import java.net.InetAddress;
-import java.util.AbstractMap;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.UUID;
-
 import org.apache.commons.io.FileUtils;
 import org.apache.hadoop.conf.Configuration;
 import org.apache.hadoop.fs.Path;
 import org.apache.hadoop.hbase.HBaseConfiguration;
 import org.apache.hadoop.hbase.HBaseTestingUtility;
 import org.apache.hadoop.hbase.HConstants;
 import org.apache.hadoop.hbase.LocalHBaseCluster;
+import org.apache.hadoop.hbase.coprocessor.CoprocessorHost;
 import org.apache.hadoop.hbase.security.HBaseKerberosUtils;
 import org.apache.hadoop.hbase.security.User;
+import org.apache.hadoop.hbase.security.access.AccessController;
+import org.apache.hadoop.hbase.security.token.TokenProvider;
 import org.apache.hadoop.hdfs.DFSConfigKeys;
 import org.apache.hadoop.http.HttpConfig;
 import org.apache.hadoop.minikdc.MiniKdc;
@@ -49,6 +38,20 @@
 import org.apache.phoenix.util.InstanceResolver;
 import org.apache.phoenix.util.PhoenixRuntime;
 
+import java.io.File;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.net.InetAddress;
+import java.util.AbstractMap;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+
+import static org.apache.hadoop.hbase.HConstants.HBASE_DIR;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
 /**
  * This is a copy of class from `org.apache.phoenix:phoenix-queryserver-it`,
  * see original javadoc in {@code org.apache.phoenix.end2end.QueryServerEnvironment}.
@@ -195,8 +198,7 @@ private static void ensureIsEmptyDirectory(File f) throws IOException {
   /**
    * Setup and start kerberosed, hbase
    */
-  public PhoenixEnvironment(final Configuration confIn, int numberOfUsers, boolean tls)
-    throws Exception {
+  public PhoenixEnvironment(final Configuration confIn, int numberOfUsers, boolean tls) throws Exception {
 
     Configuration conf = util.getConfiguration();
     conf.addResource(confIn);
@@ -228,6 +230,26 @@ public PhoenixEnvironment(final Configuration confIn, int numberOfUsers, boolean
     conf.setInt(HConstants.REGIONSERVER_PORT, 0);
     conf.setInt(HConstants.REGIONSERVER_INFO_PORT, 0);
 
+    conf.set("hadoop.security.authentication", "kerberos");
+    conf.set("hbase.security.authentication", "kerberos");
+
+    File serviceKeytab = getServiceKeytab(); // already generated by your MiniKdc setup
+    String servicePrincipal = HBaseKerberosUtils.getPrincipalForTesting();
+    if (serviceKeytab == null || servicePrincipal == null) {
+      throw new IllegalStateException("MiniKdc did not provide service keytab/principal");
+    }
+
+    conf.set("hbase.master.keytab.file", serviceKeytab.getAbsolutePath());
+    conf.set("hbase.regionserver.keytab.file", serviceKeytab.getAbsolutePath());
+    conf.set("hbase.master.kerberos.principal", servicePrincipal);
+    conf.set("hbase.regionserver.kerberos.principal", servicePrincipal);
+
+    // Coprocessors, proxy user configs, etc. (whatever you already have)
+    conf.setStrings(CoprocessorHost.MASTER_COPROCESSOR_CONF_KEY, AccessController.class.getName());
+    conf.setStrings(CoprocessorHost.REGIONSERVER_COPROCESSOR_CONF_KEY, AccessController.class.getName());
+    conf.setStrings(CoprocessorHost.REGION_COPROCESSOR_CONF_KEY,
+        AccessController.class.getName(), TokenProvider.class.getName());
+
     // Clear the cached singletons so we can inject our own.
     InstanceResolver.clearSingletons();
     // Make sure the ConnectionInfo doesn't try to pull a default Configuration