Skip to content

Use Configuration.getPassword() to support JCEKS in QueryServer #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
iamlapa merged 2 commits into from
Aug 11, 2026
Merged

Use Configuration.getPassword() to support JCEKS in QueryServer #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
39a053a
Use Configuration.getPassword() to support JCEKS in QueryServer
alekseykoshelev Jul 29, 2026
2ca81e2
Replace @VisibleForTesting usage with comment
alekseykoshelev Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/server/QueryServer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -280,15 +280,18 @@ public int run(String[] args) throws Exception {
}
}

private void setTlsIfNeccessary(Builder<Server> builder, Configuration conf) throws Exception {
//@VisibleForTesting
void setTlsIfNeccessary(Builder<Server> builder, Configuration conf) throws Exception {
final boolean useTls = getConf().getBoolean(QueryServerProperties.QUERY_SERVER_TLS_ENABLED, QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_ENABLED);
if(useTls) {
final String tlsKeystore = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE);
final String keystoreType = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_TYPE_KEY, QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_TYPE_DEFAULT);

final String tlsKeystorePassword = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_PASSWORD, QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_KEYSTORE_PASSWORD);
final char[] tlsKeystorePasswordChars = getConf().getPassword(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_PASSWORD);
final String tlsKeystorePassword = tlsKeystorePasswordChars != null ? new String(tlsKeystorePasswordChars) : QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_KEYSTORE_PASSWORD;
final String tlsTruststore = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE);
final String tlsTruststorePassword = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD, QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD);
final char[] tlsTruststorePasswordChars = getConf().getPassword(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD);
final String tlsTruststorePassword = tlsTruststorePasswordChars != null ? new String(tlsTruststorePasswordChars) : QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD;
if(tlsKeystore == null) {
throw new Exception(String.format("if %s is enabled, %s must be specfified" , QueryServerProperties.QUERY_SERVER_TLS_ENABLED, QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE));
}
Expand Down
74 changes: 71 additions & 3 deletions ...ver/src/test/java/org/apache/phoenix/queryserver/server/QueryServerConfigurationTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,7 @@
*/
package org.apache.phoenix.queryserver.server;

import static org.mockito.ArgumentMatchers.any;
import static org.mockito.ArgumentMatchers.anyString;
import static org.mockito.ArgumentMatchers.nullable;
import static org.mockito.ArgumentMatchers.*;
import static org.mockito.Mockito.doReturn;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.never;
Expand All @@ -35,6 +33,9 @@
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.hbase.HBaseConfiguration;
import org.apache.hadoop.security.UserGroupInformation;
import org.apache.hadoop.security.alias.CredentialProvider;
import org.apache.hadoop.security.alias.CredentialProviderFactory;
import org.apache.phoenix.queryserver.QueryServerOptions;
import org.apache.phoenix.queryserver.QueryServerProperties;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.io.TempDir;
Expand Down Expand Up @@ -86,6 +87,73 @@ public void testCustomServerConfiguration() {
verify(builder, never()).withImpersonation(any(DoAsRemoteUserCallback.class));
}

@Test
public void testTlsPasswordsResolvedFromCredentialProvider() throws Exception {
File jceks = new File(testFolder.toFile(), "pqs.jceks");
Configuration conf = HBaseConfiguration.create();
conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH,
"jceks://" + jceks.getAbsolutePath());

CredentialProvider provider = CredentialProviderFactory.getProviders(conf).get(0);
provider.createCredentialEntry(
QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_PASSWORD, "ksSecret".toCharArray());
provider.createCredentialEntry(
QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD, "tsSecret".toCharArray());
provider.flush();

conf.setBoolean(QueryServerProperties.QUERY_SERVER_TLS_ENABLED, true);
conf.set(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE, jceks.getAbsolutePath());
conf.set(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE, jceks.getAbsolutePath());

QueryServer qs = new QueryServer(new String[0], conf);
qs.setTlsIfNeccessary(builder, conf);

verify(builder).withTLS(
any(File.class), eq("ksSecret"),
any(File.class), eq("tsSecret"),
anyString(),
nullable(String[].class),
nullable(String[].class));
}

@Test
public void testTlsPasswordsFallBackToPlaintextConfig() throws Exception {
File dummy = new File(testFolder.toFile(), "dummy.jsk");
Configuration conf = HBaseConfiguration.create();

conf.setBoolean(QueryServerProperties.QUERY_SERVER_TLS_ENABLED, true);
conf.set(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE, dummy.getAbsolutePath());
conf.set(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE, dummy.getAbsolutePath());
conf.set(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_PASSWORD, "ksPlain");
conf.set(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD, "tsPlain");

QueryServer qs = new QueryServer(new String[0], conf);
qs.setTlsIfNeccessary(builder, conf);

verify(builder).withTLS(
any(File.class), eq("ksPlain"),
any(File.class), eq("tsPlain"),
anyString(), nullable(String[].class), nullable(String[].class));
}

@Test
public void testTlsPasswordsUseDefaultsWhenNoProvider() throws Exception {
File dummyStore = new File(testFolder.toFile(), "dummy.keystore");
Configuration conf = HBaseConfiguration.create();

conf.setBoolean(QueryServerProperties.QUERY_SERVER_TLS_ENABLED, true);
conf.set(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE, dummyStore.getAbsolutePath());
conf.set(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE, dummyStore.getAbsolutePath());

QueryServer qs = new QueryServer(new String[0], conf);
qs.setTlsIfNeccessary(builder, conf);

verify(builder).withTLS(
any(File.class), eq(QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_KEYSTORE_PASSWORD),
any(File.class), eq(QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD),
anyString(), nullable(String[].class), nullable(String[].class));
}

private void setupKeytabForSpnego() throws IOException {
File keytabFile = testFolder.resolve("test.keytab").toFile();
CONF.set(QueryServerProperties.QUERY_SERVER_KEYTAB_FILENAME_ATTRIB, keytabFile.getAbsolutePath());
Expand Down
Loading