Examples with AppConfigurationEntry javax.security.auth.login.AppConfigurationEntry used on opensource projects

Example 1 with AppConfigurationEntry

use of javax.security.auth.login.AppConfigurationEntry in project flink by apache.

the class JaasModule method install.

@Override
public void install(SecurityUtils.SecurityConfiguration securityConfig) throws SecurityInstallException {
    // ensure that a config file is always defined, for compatibility with
    // ZK and Kafka which check for the system property and existence of the file
    priorConfigFile = System.getProperty(JAVA_SECURITY_AUTH_LOGIN_CONFIG, null);
    if (priorConfigFile == null) {
        File configFile = generateDefaultConfigFile();
        System.setProperty(JAVA_SECURITY_AUTH_LOGIN_CONFIG, configFile.getAbsolutePath());
    }
    // read the JAAS configuration file
    priorConfig = javax.security.auth.login.Configuration.getConfiguration();
    // construct a dynamic JAAS configuration
    currentConfig = new DynamicConfiguration(priorConfig);
    // wire up the configured JAAS login contexts to use the krb5 entries
    AppConfigurationEntry[] krb5Entries = getAppConfigurationEntries(securityConfig);
    if (krb5Entries != null) {
        for (String app : securityConfig.getLoginContextNames()) {
            currentConfig.addAppConfigurationEntry(app, krb5Entries);
        }
    }
    javax.security.auth.login.Configuration.setConfiguration(currentConfig);
}

Example 2 with AppConfigurationEntry

use of javax.security.auth.login.AppConfigurationEntry in project flink by apache.

the class JaasModule method getAppConfigurationEntries.

private static AppConfigurationEntry[] getAppConfigurationEntries(SecurityUtils.SecurityConfiguration securityConfig) {
    AppConfigurationEntry userKerberosAce = null;
    if (securityConfig.useTicketCache()) {
        userKerberosAce = KerberosUtils.ticketCacheEntry();
    }
    AppConfigurationEntry keytabKerberosAce = null;
    if (securityConfig.getKeytab() != null) {
        keytabKerberosAce = KerberosUtils.keytabEntry(securityConfig.getKeytab(), securityConfig.getPrincipal());
    }
    AppConfigurationEntry[] appConfigurationEntry;
    if (userKerberosAce != null && keytabKerberosAce != null) {
        appConfigurationEntry = new AppConfigurationEntry[] { keytabKerberosAce, userKerberosAce };
    } else if (keytabKerberosAce != null) {
        appConfigurationEntry = new AppConfigurationEntry[] { keytabKerberosAce };
    } else if (userKerberosAce != null) {
        appConfigurationEntry = new AppConfigurationEntry[] { userKerberosAce };
    } else {
        return null;
    }
    return appConfigurationEntry;
}

Example 3 with AppConfigurationEntry

use of javax.security.auth.login.AppConfigurationEntry in project hadoop by apache.

the class UserGroupInformation method getUGIFromTicketCache.

/**
   * Create a UserGroupInformation from a Kerberos ticket cache.
   * 
   * @param user                The principal name to load from the ticket
   *                            cache
   * @param ticketCache     the path to the ticket cache file
   *
   * @throws IOException        if the kerberos login fails
   */
@InterfaceAudience.Public
@InterfaceStability.Evolving
public static UserGroupInformation getUGIFromTicketCache(String ticketCache, String user) throws IOException {
    if (!isAuthenticationMethodEnabled(AuthenticationMethod.KERBEROS)) {
        return getBestUGI(null, user);
    }
    try {
        Map<String, String> krbOptions = new HashMap<String, String>();
        if (IBM_JAVA) {
            krbOptions.put("useDefaultCcache", "true");
            // The first value searched when "useDefaultCcache" is used.
            System.setProperty("KRB5CCNAME", ticketCache);
        } else {
            krbOptions.put("doNotPrompt", "true");
            krbOptions.put("useTicketCache", "true");
            krbOptions.put("useKeyTab", "false");
            krbOptions.put("ticketCache", ticketCache);
        }
        krbOptions.put("renewTGT", "false");
        krbOptions.putAll(HadoopConfiguration.BASIC_JAAS_OPTIONS);
        AppConfigurationEntry ace = new AppConfigurationEntry(KerberosUtil.getKrb5LoginModuleName(), LoginModuleControlFlag.REQUIRED, krbOptions);
        DynamicConfiguration dynConf = new DynamicConfiguration(new AppConfigurationEntry[] { ace });
        LoginContext login = newLoginContext(HadoopConfiguration.USER_KERBEROS_CONFIG_NAME, null, dynConf);
        login.login();
        Subject loginSubject = login.getSubject();
        Set<Principal> loginPrincipals = loginSubject.getPrincipals();
        if (loginPrincipals.isEmpty()) {
            throw new RuntimeException("No login principals found!");
        }
        if (loginPrincipals.size() != 1) {
            LOG.warn("found more than one principal in the ticket cache file " + ticketCache);
        }
        User ugiUser = new User(loginPrincipals.iterator().next().getName(), AuthenticationMethod.KERBEROS, login);
        loginSubject.getPrincipals().add(ugiUser);
        UserGroupInformation ugi = new UserGroupInformation(loginSubject, false);
        ugi.setLogin(login);
        ugi.setAuthenticationMethod(AuthenticationMethod.KERBEROS);
        return ugi;
    } catch (LoginException le) {
        KerberosAuthException kae = new KerberosAuthException(FAILURE_TO_LOGIN, le);
        kae.setUser(user);
        kae.setTicketCacheFile(ticketCache);
        throw kae;
    }
}

Example 4 with AppConfigurationEntry

use of javax.security.auth.login.AppConfigurationEntry in project flink by apache.

the class KerberosUtilsTest method testKeytabEntry.

@Test
public void testKeytabEntry() {
    String keytab = "user.keytab";
    String principal = "user";
    AppConfigurationEntry entry = KerberosUtils.keytabEntry(keytab, principal);
    assertNotNull(entry);
}

Example 5 with AppConfigurationEntry

use of javax.security.auth.login.AppConfigurationEntry in project flink by apache.

the class KerberosUtilsTest method testTicketCacheEntry.

@Test
public void testTicketCacheEntry() {
    AppConfigurationEntry entry = KerberosUtils.ticketCacheEntry();
    assertNotNull(entry);
}