|
| 1 | +// Licensed to the Apache Software Foundation (ASF) under one |
| 2 | +// or more contributor license agreements. See the NOTICE file |
| 3 | +// distributed with this work for additional information |
| 4 | +// regarding copyright ownership. The ASF licenses this file |
| 5 | +// to you under the Apache License, Version 2.0 (the |
| 6 | +// "License"); you may not use this file except in compliance |
| 7 | +// with the License. You may obtain a copy of the License at |
| 8 | +// |
| 9 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | +// |
| 11 | +// Unless required by applicable law or agreed to in writing, |
| 12 | +// software distributed under the License is distributed on an |
| 13 | +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| 14 | +// KIND, either express or implied. See the License for the |
| 15 | +// specific language governing permissions and limitations |
| 16 | +// under the License. |
| 17 | + |
| 18 | +#include "common/kerberos/kerberos_ticket_mgr.h" |
| 19 | + |
| 20 | +#include <iomanip> |
| 21 | +#include <sstream> |
| 22 | + |
| 23 | +#include "util/md5.h" |
| 24 | + |
| 25 | +namespace doris::kerberos { |
| 26 | + |
| 27 | +KerberosTicketMgr::KerberosTicketMgr() { |
| 28 | + _start_cleanup_thread(); |
| 29 | +} |
| 30 | + |
| 31 | +KerberosTicketMgr::~KerberosTicketMgr() { |
| 32 | + _stop_cleanup_thread(); |
| 33 | +} |
| 34 | + |
| 35 | +std::string KerberosTicketMgr::_generate_key(const std::string& principal, |
| 36 | + const std::string& keytab_path) { |
| 37 | + std::string combined = principal + keytab_path; |
| 38 | + Md5Digest digest; |
| 39 | + digest.update(combined.c_str(), combined.length()); |
| 40 | + digest.digest(); |
| 41 | + return digest.hex(); |
| 42 | +} |
| 43 | + |
| 44 | +Status KerberosTicketMgr::get_or_set_ticket_cache(const KerberosConfig& config, |
| 45 | + std::string* cache_path) { |
| 46 | + std::string key = _generate_key(config.get_principal(), config.get_keytab_path()); |
| 47 | + |
| 48 | + std::lock_guard<std::mutex> lock(_mutex); |
| 49 | + |
| 50 | + // Check if already exists |
| 51 | + auto it = _ticket_caches.find(key); |
| 52 | + if (it != _ticket_caches.end()) { |
| 53 | + it->second.last_access_time = std::chrono::steady_clock::now(); |
| 54 | + *cache_path = it->second.cache->get_ticket_cache_path(); |
| 55 | + return Status::OK(); |
| 56 | + } |
| 57 | + |
| 58 | + // Create new ticket cache |
| 59 | + auto ticket_cache = std::make_unique<KerberosTicketCache>(config); |
| 60 | + RETURN_IF_ERROR(ticket_cache->initialize()); |
| 61 | + RETURN_IF_ERROR(ticket_cache->login()); |
| 62 | + RETURN_IF_ERROR(ticket_cache->write_ticket_cache()); |
| 63 | + ticket_cache->start_periodic_refresh(); |
| 64 | + |
| 65 | + // Add to map |
| 66 | + KerberosTicketEntry entry {.cache = std::move(ticket_cache), |
| 67 | + .last_access_time = std::chrono::steady_clock::now()}; |
| 68 | + |
| 69 | + auto [inserted_it, success] = _ticket_caches.emplace(key, std::move(entry)); |
| 70 | + if (!success) { |
| 71 | + return Status::InternalError("Failed to insert ticket cache into map"); |
| 72 | + } |
| 73 | + |
| 74 | + *cache_path = inserted_it->second.cache->get_ticket_cache_path(); |
| 75 | + LOG(INFO) << "create new kerberos ticket cache: " << *cache_path; |
| 76 | + return Status::OK(); |
| 77 | +} |
| 78 | + |
| 79 | +Status KerberosTicketMgr::get_cache_file_path(const std::string& principal, |
| 80 | + const std::string& keytab_path, |
| 81 | + std::string* cache_path) { |
| 82 | + std::string key = _generate_key(principal, keytab_path); |
| 83 | + |
| 84 | + std::lock_guard<std::mutex> lock(_mutex); |
| 85 | + |
| 86 | + auto it = _ticket_caches.find(key); |
| 87 | + if (it == _ticket_caches.end()) { |
| 88 | + return Status::NotFound("Kerberos ticket cache not found for principal: " + principal); |
| 89 | + } |
| 90 | + |
| 91 | + // Update last access time |
| 92 | + it->second.last_access_time = std::chrono::steady_clock::now(); |
| 93 | + |
| 94 | + *cache_path = it->second.cache->get_ticket_cache_path(); |
| 95 | + return Status::OK(); |
| 96 | +} |
| 97 | + |
| 98 | +void KerberosTicketMgr::_cleanup_thread_func() { |
| 99 | + // Use a shorter sleep interval for quicker shutdown |
| 100 | + static constexpr std::chrono::seconds SLEEP_INTERVAL {1}; |
| 101 | + auto last_cleanup_time = std::chrono::steady_clock::now(); |
| 102 | + |
| 103 | + while (!_should_stop) { |
| 104 | + std::this_thread::sleep_for(SLEEP_INTERVAL); |
| 105 | + auto now = std::chrono::steady_clock::now(); |
| 106 | + if (now - last_cleanup_time < CLEANUP_INTERVAL && !_should_stop) { |
| 107 | + continue; |
| 108 | + } |
| 109 | + |
| 110 | + // Store expired caches here to destroy them after releasing the lock |
| 111 | + std::vector<std::unique_ptr<KerberosTicketCache>> expired_caches; |
| 112 | + { |
| 113 | + std::lock_guard<std::mutex> lock(_mutex); |
| 114 | + // Remove expired entries |
| 115 | + for (auto it = _ticket_caches.begin(); it != _ticket_caches.end();) { |
| 116 | + auto time_since_last_access = now - it->second.last_access_time; |
| 117 | + if (time_since_last_access > EXPIRATION_TIME) { |
| 118 | + // Move the unique_ptr to our expired_caches vector |
| 119 | + expired_caches.push_back(std::move(it->second.cache)); |
| 120 | + it = _ticket_caches.erase(it); |
| 121 | + } else { |
| 122 | + ++it; |
| 123 | + } |
| 124 | + } |
| 125 | + last_cleanup_time = now; |
| 126 | + } |
| 127 | + |
| 128 | + // expired_caches will be destroyed here, outside the lock |
| 129 | + } |
| 130 | +} |
| 131 | + |
| 132 | +void KerberosTicketMgr::_start_cleanup_thread() { |
| 133 | + _should_stop = false; |
| 134 | + _cleanup_thread = std::make_unique<std::thread>(&KerberosTicketMgr::_cleanup_thread_func, this); |
| 135 | +} |
| 136 | + |
| 137 | +void KerberosTicketMgr::_stop_cleanup_thread() { |
| 138 | + if (_cleanup_thread) { |
| 139 | + _should_stop = true; |
| 140 | + _cleanup_thread->join(); |
| 141 | + _cleanup_thread.reset(); |
| 142 | + } |
| 143 | +} |
| 144 | + |
| 145 | +} // namespace doris::kerberos |
0 commit comments