Examples with KafkaClientAuthenticationPlain io.strimzi.api.kafka.model.authentication.KafkaClientAuthenticationPlain used on opensource projects

Example 6 with KafkaClientAuthenticationPlain

use of io.strimzi.api.kafka.model.authentication.KafkaClientAuthenticationPlain in project strimzi by strimzi.

the class UtilTest method testAuthTlsPlainSecretAndPasswordFound.

@Test
public void testAuthTlsPlainSecretAndPasswordFound() {
    SecretOperator secretOpertator = mock(SecretOperator.class);
    Map<String, String> data = new HashMap<>();
    data.put("passwordKey", "my-password");
    Secret secret = new Secret();
    secret.setData(data);
    CompletionStage<Secret> cf = CompletableFuture.supplyAsync(() -> secret);
    when(secretOpertator.getAsync(anyString(), anyString())).thenReturn(Future.fromCompletionStage(cf));
    KafkaClientAuthenticationPlain auth = new KafkaClientAuthenticationPlain();
    PasswordSecretSource passwordSecretSource = new PasswordSecretSource();
    passwordSecretSource.setSecretName("my-secret");
    passwordSecretSource.setPassword("passwordKey");
    auth.setPasswordSecret(passwordSecretSource);
    Future<Integer> result = Util.authTlsHash(secretOpertator, "anyNamespace", auth, List.of());
    result.onComplete(handler -> {
        assertTrue(handler.succeeded());
        assertEquals("my-password".hashCode(), handler.result());
    });
}

Example 7 with KafkaClientAuthenticationPlain

use of io.strimzi.api.kafka.model.authentication.KafkaClientAuthenticationPlain in project strimzi by strimzi.

the class AuthenticationUtils method getClientAuthenticationProperties.

/**
 * Get a map of properties related to authentication in Kafka clients.
 *
 * @param authentication    Authentication object with auth configuration
 * @return Map of name/value pairs
 */
public static Map<String, String> getClientAuthenticationProperties(KafkaClientAuthentication authentication) {
    Map<String, String> properties = new HashMap<>(3);
    if (authentication != null) {
        if (authentication instanceof KafkaClientAuthenticationTls) {
            KafkaClientAuthenticationTls tlsAuth = (KafkaClientAuthenticationTls) authentication;
            properties.put(TLS_AUTH_CERT, String.format("%s/%s", tlsAuth.getCertificateAndKey().getSecretName(), tlsAuth.getCertificateAndKey().getCertificate()));
            properties.put(TLS_AUTH_KEY, String.format("%s/%s", tlsAuth.getCertificateAndKey().getSecretName(), tlsAuth.getCertificateAndKey().getKey()));
        } else if (authentication instanceof KafkaClientAuthenticationPlain) {
            KafkaClientAuthenticationPlain passwordAuth = (KafkaClientAuthenticationPlain) authentication;
            properties.put(SASL_USERNAME, passwordAuth.getUsername());
            properties.put(SASL_PASSWORD_FILE, String.format("%s/%s", passwordAuth.getPasswordSecret().getSecretName(), passwordAuth.getPasswordSecret().getPassword()));
            properties.put(SASL_MECHANISM, KafkaClientAuthenticationPlain.TYPE_PLAIN);
        } else if (authentication instanceof KafkaClientAuthenticationScram) {
            KafkaClientAuthenticationScram scramAuth = (KafkaClientAuthenticationScram) authentication;
            properties.put(SASL_USERNAME, scramAuth.getUsername());
            properties.put(SASL_PASSWORD_FILE, String.format("%s/%s", scramAuth.getPasswordSecret().getSecretName(), scramAuth.getPasswordSecret().getPassword()));
            properties.put(SASL_MECHANISM, scramAuth.getType());
        } else if (authentication instanceof KafkaClientAuthenticationOAuth) {
            KafkaClientAuthenticationOAuth oauth = (KafkaClientAuthenticationOAuth) authentication;
            properties.put(SASL_MECHANISM, KafkaClientAuthenticationOAuth.TYPE_OAUTH);
            List<String> options = new ArrayList<>(2);
            if (oauth.getClientId() != null)
                options.add(String.format("%s=\"%s\"", ClientConfig.OAUTH_CLIENT_ID, oauth.getClientId()));
            if (oauth.getTokenEndpointUri() != null)
                options.add(String.format("%s=\"%s\"", ClientConfig.OAUTH_TOKEN_ENDPOINT_URI, oauth.getTokenEndpointUri()));
            if (oauth.getScope() != null)
                options.add(String.format("%s=\"%s\"", ClientConfig.OAUTH_SCOPE, oauth.getScope()));
            if (oauth.getAudience() != null)
                options.add(String.format("%s=\"%s\"", ClientConfig.OAUTH_AUDIENCE, oauth.getAudience()));
            if (oauth.isDisableTlsHostnameVerification())
                options.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM, ""));
            if (!oauth.isAccessTokenIsJwt())
                options.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_ACCESS_TOKEN_IS_JWT, false));
            if (oauth.getMaxTokenExpirySeconds() > 0)
                options.add(String.format("%s=\"%s\"", ClientConfig.OAUTH_MAX_TOKEN_EXPIRY_SECONDS, oauth.getMaxTokenExpirySeconds()));
            if (oauth.getConnectTimeoutSeconds() != null && oauth.getConnectTimeoutSeconds() > 0)
                options.add(String.format("%s=\"%s\"", ClientConfig.OAUTH_CONNECT_TIMEOUT_SECONDS, oauth.getConnectTimeoutSeconds()));
            if (oauth.getReadTimeoutSeconds() != null && oauth.getReadTimeoutSeconds() > 0)
                options.add(String.format("%s=\"%s\"", ClientConfig.OAUTH_READ_TIMEOUT_SECONDS, oauth.getReadTimeoutSeconds()));
            properties.put(OAUTH_CONFIG, String.join(" ", options));
        }
    }
    return properties;
}

Example 8 with KafkaClientAuthenticationPlain

use of io.strimzi.api.kafka.model.authentication.KafkaClientAuthenticationPlain in project strimzi by strimzi.

the class AuthenticationUtils method configureClientAuthenticationVolumeMounts.

/**
 * Creates the VolumeMounts used for authentication of Kafka client based components
 * @param authentication    Authentication object from CRD
 * @param volumeMountList    List where the volume mounts will be added
 * @param tlsVolumeMount    Path where the TLS certs should be mounted
 * @param passwordVolumeMount   Path where passwords should be mounted
 * @param oauthCertsVolumeMount Path where the OAuth certificates would be mounted
 * @param oauthVolumeNamePrefix Prefix used for OAuth volume names
 * @param volumeNamePrefix Prefix used for volume mount names
 * @param mountOAuthSecretVolumes Indicates whether OAuth secret volume mounts will be added to the list
 * @param oauthSecretsVolumeMount Path where the OAuth secrets would be mounted
 */
public static void configureClientAuthenticationVolumeMounts(KafkaClientAuthentication authentication, List<VolumeMount> volumeMountList, String tlsVolumeMount, String passwordVolumeMount, String oauthCertsVolumeMount, String oauthVolumeNamePrefix, String volumeNamePrefix, boolean mountOAuthSecretVolumes, String oauthSecretsVolumeMount) {
    if (authentication != null) {
        if (authentication instanceof KafkaClientAuthenticationTls) {
            KafkaClientAuthenticationTls tlsAuth = (KafkaClientAuthenticationTls) authentication;
            // skipping if a volume mount with same Secret name was already added
            if (!volumeMountList.stream().anyMatch(vm -> vm.getName().equals(volumeNamePrefix + tlsAuth.getCertificateAndKey().getSecretName()))) {
                volumeMountList.add(VolumeUtils.createVolumeMount(volumeNamePrefix + tlsAuth.getCertificateAndKey().getSecretName(), tlsVolumeMount + tlsAuth.getCertificateAndKey().getSecretName()));
            }
        } else if (authentication instanceof KafkaClientAuthenticationPlain) {
            KafkaClientAuthenticationPlain passwordAuth = (KafkaClientAuthenticationPlain) authentication;
            volumeMountList.add(VolumeUtils.createVolumeMount(volumeNamePrefix + passwordAuth.getPasswordSecret().getSecretName(), passwordVolumeMount + passwordAuth.getPasswordSecret().getSecretName()));
        } else if (authentication instanceof KafkaClientAuthenticationScram) {
            KafkaClientAuthenticationScram scramAuth = (KafkaClientAuthenticationScram) authentication;
            volumeMountList.add(VolumeUtils.createVolumeMount(volumeNamePrefix + scramAuth.getPasswordSecret().getSecretName(), passwordVolumeMount + scramAuth.getPasswordSecret().getSecretName()));
        } else if (authentication instanceof KafkaClientAuthenticationOAuth) {
            KafkaClientAuthenticationOAuth oauth = (KafkaClientAuthenticationOAuth) authentication;
            volumeMountList.addAll(configureOauthCertificateVolumeMounts(oauthVolumeNamePrefix, oauth.getTlsTrustedCertificates(), oauthCertsVolumeMount));
            if (mountOAuthSecretVolumes) {
                if (oauth.getClientSecret() != null) {
                    volumeMountList.add(VolumeUtils.createVolumeMount(volumeNamePrefix + oauth.getClientSecret().getSecretName(), oauthSecretsVolumeMount + oauth.getClientSecret().getSecretName()));
                }
                if (oauth.getAccessToken() != null) {
                    volumeMountList.add(VolumeUtils.createVolumeMount(volumeNamePrefix + oauth.getAccessToken().getSecretName(), oauthSecretsVolumeMount + oauth.getAccessToken().getSecretName()));
                }
                if (oauth.getRefreshToken() != null) {
                    volumeMountList.add(VolumeUtils.createVolumeMount(volumeNamePrefix + oauth.getRefreshToken().getSecretName(), oauthSecretsVolumeMount + oauth.getRefreshToken().getSecretName()));
                }
            }
        }
    }
}

Example 9 with KafkaClientAuthenticationPlain

use of io.strimzi.api.kafka.model.authentication.KafkaClientAuthenticationPlain in project strimzi-kafka-operator by strimzi.

the class AuthenticationUtils method configureClientAuthenticationVolumeMounts.

/**
 * Creates the VolumeMounts used for authentication of Kafka client based components
 * @param authentication    Authentication object from CRD
 * @param volumeMountList    List where the volume mounts will be added
 * @param tlsVolumeMount    Path where the TLS certs should be mounted
 * @param passwordVolumeMount   Path where passwords should be mounted
 * @param oauthCertsVolumeMount Path where the OAuth certificates would be mounted
 * @param oauthVolumeNamePrefix Prefix used for OAuth volume names
 * @param volumeNamePrefix Prefix used for volume mount names
 * @param mountOAuthSecretVolumes Indicates whether OAuth secret volume mounts will be added to the list
 * @param oauthSecretsVolumeMount Path where the OAuth secrets would be mounted
 */
public static void configureClientAuthenticationVolumeMounts(KafkaClientAuthentication authentication, List<VolumeMount> volumeMountList, String tlsVolumeMount, String passwordVolumeMount, String oauthCertsVolumeMount, String oauthVolumeNamePrefix, String volumeNamePrefix, boolean mountOAuthSecretVolumes, String oauthSecretsVolumeMount) {
    if (authentication != null) {
        if (authentication instanceof KafkaClientAuthenticationTls) {
            KafkaClientAuthenticationTls tlsAuth = (KafkaClientAuthenticationTls) authentication;
            // skipping if a volume mount with same Secret name was already added
            if (!volumeMountList.stream().anyMatch(vm -> vm.getName().equals(volumeNamePrefix + tlsAuth.getCertificateAndKey().getSecretName()))) {
                volumeMountList.add(VolumeUtils.createVolumeMount(volumeNamePrefix + tlsAuth.getCertificateAndKey().getSecretName(), tlsVolumeMount + tlsAuth.getCertificateAndKey().getSecretName()));
            }
        } else if (authentication instanceof KafkaClientAuthenticationPlain) {
            KafkaClientAuthenticationPlain passwordAuth = (KafkaClientAuthenticationPlain) authentication;
            volumeMountList.add(VolumeUtils.createVolumeMount(volumeNamePrefix + passwordAuth.getPasswordSecret().getSecretName(), passwordVolumeMount + passwordAuth.getPasswordSecret().getSecretName()));
        } else if (authentication instanceof KafkaClientAuthenticationScram) {
            KafkaClientAuthenticationScram scramAuth = (KafkaClientAuthenticationScram) authentication;
            volumeMountList.add(VolumeUtils.createVolumeMount(volumeNamePrefix + scramAuth.getPasswordSecret().getSecretName(), passwordVolumeMount + scramAuth.getPasswordSecret().getSecretName()));
        } else if (authentication instanceof KafkaClientAuthenticationOAuth) {
            KafkaClientAuthenticationOAuth oauth = (KafkaClientAuthenticationOAuth) authentication;
            volumeMountList.addAll(configureOauthCertificateVolumeMounts(oauthVolumeNamePrefix, oauth.getTlsTrustedCertificates(), oauthCertsVolumeMount));
            if (mountOAuthSecretVolumes) {
                if (oauth.getClientSecret() != null) {
                    volumeMountList.add(VolumeUtils.createVolumeMount(volumeNamePrefix + oauth.getClientSecret().getSecretName(), oauthSecretsVolumeMount + oauth.getClientSecret().getSecretName()));
                }
                if (oauth.getAccessToken() != null) {
                    volumeMountList.add(VolumeUtils.createVolumeMount(volumeNamePrefix + oauth.getAccessToken().getSecretName(), oauthSecretsVolumeMount + oauth.getAccessToken().getSecretName()));
                }
                if (oauth.getRefreshToken() != null) {
                    volumeMountList.add(VolumeUtils.createVolumeMount(volumeNamePrefix + oauth.getRefreshToken().getSecretName(), oauthSecretsVolumeMount + oauth.getRefreshToken().getSecretName()));
                }
            }
        }
    }
}

Example 10 with KafkaClientAuthenticationPlain

use of io.strimzi.api.kafka.model.authentication.KafkaClientAuthenticationPlain in project strimzi-kafka-operator by strimzi.

the class AuthenticationUtils method configureClientAuthenticationVolumes.

/**
 * Creates the Volumes used for authentication of Kafka client based components
 *
 * @param authentication    Authentication object from CRD
 * @param volumeList    List where the volumes will be added
 * @param oauthVolumeNamePrefix Prefix used for OAuth volumes
 * @param isOpenShift   Indicates whether we run on OpenShift or not
 * @param volumeNamePrefix Prefix used for volume names
 * @param createOAuthSecretVolumes   Indicates whether OAuth secret volumes will be added to the list
 */
public static void configureClientAuthenticationVolumes(KafkaClientAuthentication authentication, List<Volume> volumeList, String oauthVolumeNamePrefix, boolean isOpenShift, String volumeNamePrefix, boolean createOAuthSecretVolumes) {
    if (authentication != null) {
        if (authentication instanceof KafkaClientAuthenticationTls) {
            KafkaClientAuthenticationTls tlsAuth = (KafkaClientAuthenticationTls) authentication;
            addNewVolume(volumeList, volumeNamePrefix, tlsAuth.getCertificateAndKey().getSecretName(), isOpenShift);
        } else if (authentication instanceof KafkaClientAuthenticationPlain) {
            KafkaClientAuthenticationPlain passwordAuth = (KafkaClientAuthenticationPlain) authentication;
            addNewVolume(volumeList, volumeNamePrefix, passwordAuth.getPasswordSecret().getSecretName(), isOpenShift);
        } else if (authentication instanceof KafkaClientAuthenticationScram) {
            KafkaClientAuthenticationScram scramAuth = (KafkaClientAuthenticationScram) authentication;
            addNewVolume(volumeList, volumeNamePrefix, scramAuth.getPasswordSecret().getSecretName(), isOpenShift);
        } else if (authentication instanceof KafkaClientAuthenticationOAuth) {
            KafkaClientAuthenticationOAuth oauth = (KafkaClientAuthenticationOAuth) authentication;
            volumeList.addAll(configureOauthCertificateVolumes(oauthVolumeNamePrefix, oauth.getTlsTrustedCertificates(), isOpenShift));
            if (createOAuthSecretVolumes) {
                if (oauth.getClientSecret() != null) {
                    addNewVolume(volumeList, volumeNamePrefix, oauth.getClientSecret().getSecretName(), isOpenShift);
                }
                if (oauth.getAccessToken() != null) {
                    addNewVolume(volumeList, volumeNamePrefix, oauth.getAccessToken().getSecretName(), isOpenShift);
                }
                if (oauth.getRefreshToken() != null) {
                    addNewVolume(volumeList, volumeNamePrefix, oauth.getRefreshToken().getSecretName(), isOpenShift);
                }
            }
        }
    }
}