Patch UGI to work without security manager

.github/workflows/ci.yml

@@ -11,9 +11,7 @@ jobs:
           - ubuntu-latest
           - macos-latest
         java:
-          - 8
-          - 11
-          - 17
+          - 21
     steps:
       - uses: actions/checkout@v2
       - name: Setup JDK ${{ matrix.java }}

pom.xml

@@ -39,7 +39,7 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <project.build.targetJdk>1.8</project.build.targetJdk>
+        <project.build.targetJdk>21</project.build.targetJdk>
         <shadeBase>io.trino.hadoop.\$internal</shadeBase>
         <dep.slf4j.version>1.7.36</dep.slf4j.version>
         <dep.hadoop.version>3.3.5</dep.hadoop.version>
@@ -413,7 +413,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>
-                <version>3.2.1</version>
+                <version>3.5.2</version>
                 <executions>
                     <execution>
                         <phase>package</phase>
@@ -609,6 +609,8 @@
                                         <exclude>org/apache/hadoop/fs/FileSystem.class</exclude>
                                         <exclude>org/apache/hadoop/fs/FileSystem$*.class</exclude>
                                         <exclude>org/apache/hadoop/util/NativeCodeLoader.class</exclude>
+                                        <exclude>org/apache/hadoop/security/UserGroupInformation.class</exclude>
+                                        <exclude>org/apache/hadoop/security/UserGroupInformation$*.class</exclude>
                                         <exclude>org/apache/hadoop/crypto/key/kms/KMSClientProvider.class</exclude>
                                         <exclude>org/apache/hadoop/crypto/key/kms/KMSClientProvider$*.class</exclude>
                                     </excludes>

src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java

@@ -66,13 +66,13 @@
 import java.nio.charset.StandardCharsets;
 import java.security.GeneralSecurityException;
 import java.security.NoSuchAlgorithmException;
-import java.security.PrivilegedExceptionAction;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Queue;
+import java.util.concurrent.Callable;
 import java.util.concurrent.ExecutionException;
 
 import org.apache.hadoop.crypto.key.KeyProviderCryptoExtension;
@@ -503,14 +503,10 @@ private HttpURLConnection createConnection(final URL url, String method)
         HttpURLConnection conn;
         try {
             final String doAsUser = getDoAsUser();
-            conn = getActualUgi().doAs(new PrivilegedExceptionAction
-                    <HttpURLConnection>() {
-                @Override
-                public HttpURLConnection run() throws Exception {
-                    DelegationTokenAuthenticatedURL authUrl =
-                            createAuthenticatedURL();
-                    return authUrl.openConnection(url, authToken, doAsUser);
-                }
+            conn = getActualUgi().callAs(() -> {
+                DelegationTokenAuthenticatedURL authUrl =
+                        createAuthenticatedURL();
+                return authUrl.openConnection(url, authToken, doAsUser);
             });
         } catch (ConnectException ex) {
             String msg = "Failed to connect to: " + url.toString();
@@ -1026,24 +1022,19 @@ public Token<?> getDelegationToken(final String renewer) throws IOException {
         Token<?> token = null;
         try {
             final String doAsUser = getDoAsUser();
-            token = getActualUgi().doAs(new PrivilegedExceptionAction<Token<?>>() {
-                @Override
-                public Token<?> run() throws Exception {
-                    // Not using the cached token here.. Creating a new token here
-                    // everytime.
-                    LOG.debug("Getting new token from {}, renewer:{}", url, renewer);
-                    return authUrl.getDelegationToken(url,
-                            new DelegationTokenAuthenticatedURL.Token(), renewer, doAsUser);
-                }
+            token = getActualUgi().callAs((Callable<Token<?>>) () -> {
+                // Not using the cached token here.. Creating a new token here
+                // everytime.
+                LOG.debug("Getting new token from {}, renewer:{}", url, renewer);
+                return authUrl.getDelegationToken(url,
+                        new DelegationTokenAuthenticatedURL.Token(), renewer, doAsUser);
             });
             if (token != null) {
                 token.setService(dtService);
                 LOG.info("New token created: ({})", token);
             } else {
                 throw new IOException("Got NULL as delegation token");
             }
-        } catch (InterruptedException e) {
-            Thread.currentThread().interrupt();
         } catch (Exception e) {
             if (e instanceof IOException) {
                 throw (IOException) e;
@@ -1065,13 +1056,8 @@ public long renewDelegationToken(final Token<?> dToken) throws IOException {
                     token, url, doAsUser);
             final DelegationTokenAuthenticatedURL authUrl =
                     createAuthenticatedURL();
-            return getActualUgi().doAs(
-                    new PrivilegedExceptionAction<Long>() {
-                        @Override
-                        public Long run() throws Exception {
-                            return authUrl.renewDelegationToken(url, token, doAsUser);
-                        }
-                    }
+            return getActualUgi().callAs(
+                    () -> authUrl.renewDelegationToken(url, token, doAsUser)
             );
         } catch (Exception ex) {
             if (ex instanceof IOException) {
@@ -1088,18 +1074,15 @@ public Void cancelDelegationToken(final Token<?> dToken) throws IOException {
             final String doAsUser = getDoAsUser();
             final DelegationTokenAuthenticatedURL.Token token =
                     generateDelegationToken(dToken);
-            return getActualUgi().doAs(
-                    new PrivilegedExceptionAction<Void>() {
-                        @Override
-                        public Void run() throws Exception {
-                            final URL url = createURL(null, null, null, null);
-                            LOG.debug("Cancelling delegation token {} with url:{}, as:{}",
-                                    dToken, url, doAsUser);
-                            final DelegationTokenAuthenticatedURL authUrl =
-                                    createAuthenticatedURL();
-                            authUrl.cancelDelegationToken(url, token, doAsUser);
-                            return null;
-                        }
+            return getActualUgi().callAs(
+                    () -> {
+                        final URL url = createURL(null, null, null, null);
+                        LOG.debug("Cancelling delegation token {} with url:{}, as:{}",
+                                dToken, url, doAsUser);
+                        final DelegationTokenAuthenticatedURL authUrl =
+                                createAuthenticatedURL();
+                        authUrl.cancelDelegationToken(url, token, doAsUser);
+                        return null;
                     }
             );
         } catch (Exception ex) {

src/main/java/org/apache/hadoop/fs/FileSystem.java

@@ -25,7 +25,6 @@
 import java.lang.ref.ReferenceQueue;
 import java.net.URI;
 import java.net.URISyntaxException;
-import java.security.PrivilegedExceptionAction;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
@@ -272,12 +271,7 @@ public static FileSystem get(final URI uri, final Configuration conf,
       conf.get(CommonConfigurationKeys.KERBEROS_TICKET_CACHE_PATH);
     UserGroupInformation ugi =
         UserGroupInformation.getBestUGI(ticketCachePath, user);
-    return ugi.doAs(new PrivilegedExceptionAction<FileSystem>() {
-      @Override
-      public FileSystem run() throws IOException {
-        return get(uri, conf);
-      }
-    });
+    return ugi.callAs(() -> get(uri, conf));
   }
 
   /**
@@ -574,12 +568,7 @@ public static FileSystem newInstance(final URI uri, final Configuration conf,
       conf.get(CommonConfigurationKeys.KERBEROS_TICKET_CACHE_PATH);
     UserGroupInformation ugi =
         UserGroupInformation.getBestUGI(ticketCachePath, user);
-    return ugi.doAs(new PrivilegedExceptionAction<FileSystem>() {
-      @Override
-      public FileSystem run() throws IOException {
-        return newInstance(uri, conf);
-      }
-    });
+    return ugi.callAs(() -> newInstance(uri, conf));
   }
 
   /**