Examples with UI_LOCATION io.trino.server.ui.FormWebUiAuthenticationFilter.UI_LOCATION used on opensource projects

Example 1 with UI_LOCATION

use of io.trino.server.ui.FormWebUiAuthenticationFilter.UI_LOCATION in project trino by trinodb.

the class OAuth2Service method finishOAuth2Challenge.

public Response finishOAuth2Challenge(String state, String code, URI callbackUri, Optional<String> nonce) {
    Optional<String> handlerState;
    try {
        Claims stateClaims = parseState(state);
        handlerState = Optional.ofNullable(stateClaims.get(HANDLER_STATE_CLAIM, String.class));
    } catch (ChallengeFailedException | RuntimeException e) {
        LOG.debug(e, "Authentication response could not be verified invalid state: state=%s", state);
        return Response.status(BAD_REQUEST).entity(getInternalFailureHtml("Authentication response could not be verified")).cookie(NonceCookie.delete()).build();
    }
    // Note: the Web UI may be disabled, so REST requests can not redirect to a success or error page inside of the Web UI
    try {
        // fetch access token
        OAuth2Response oauth2Response = client.getOAuth2Response(code, callbackUri);
        Claims parsedToken = validateAndParseOAuth2Response(oauth2Response, nonce).orElseThrow(() -> new ChallengeFailedException("invalid access token"));
        // determine expiration
        Instant validUntil = determineExpiration(oauth2Response.getValidUntil(), parsedToken.getExpiration());
        if (handlerState.isEmpty()) {
            return Response.seeOther(URI.create(UI_LOCATION)).cookie(OAuthWebUiCookie.create(oauth2Response.getAccessToken(), validUntil), NonceCookie.delete()).build();
        }
        tokenHandler.setAccessToken(handlerState.get(), oauth2Response.getAccessToken());
        Response.ResponseBuilder builder = Response.ok(getSuccessHtml());
        if (webUiOAuthEnabled) {
            builder.cookie(OAuthWebUiCookie.create(oauth2Response.getAccessToken(), validUntil));
        }
        return builder.cookie(NonceCookie.delete()).build();
    } catch (ChallengeFailedException | RuntimeException e) {
        LOG.debug(e, "Authentication response could not be verified: state=%s", state);
        handlerState.ifPresent(value -> tokenHandler.setTokenExchangeError(value, format("Authentication response could not be verified: state=%s", value)));
        return Response.status(BAD_REQUEST).cookie(NonceCookie.delete()).entity(getInternalFailureHtml("Authentication response could not be verified")).build();
    }
}

Example 2 with UI_LOCATION

use of io.trino.server.ui.FormWebUiAuthenticationFilter.UI_LOCATION in project trino by trinodb.

the class TestResourceSecurity method testOAuth2Groups.

@Test(dataProvider = "groups")
public void testOAuth2Groups(Optional<Set<String>> groups) throws Exception {
    try (TokenServer tokenServer = new TokenServer(Optional.empty());
        TestingTrinoServer server = TestingTrinoServer.builder().setProperties(ImmutableMap.<String, String>builder().putAll(SECURE_PROPERTIES).put("web-ui.enabled", "true").put("http-server.authentication.type", "oauth2").putAll(getOAuth2Properties(tokenServer)).put("http-server.authentication.oauth2.groups-field", GROUPS_CLAIM).buildOrThrow()).setAdditionalModule(oauth2Module(tokenServer)).build()) {
        server.getInstance(Key.get(AccessControlManager.class)).addSystemAccessControl(TestSystemAccessControl.NO_IMPERSONATION);
        HttpServerInfo httpServerInfo = server.getInstance(Key.get(HttpServerInfo.class));
        String accessToken = tokenServer.issueAccessToken(groups);
        OkHttpClient clientWithOAuthToken = client.newBuilder().authenticator((route, response) -> response.request().newBuilder().header(AUTHORIZATION, "Bearer " + accessToken).build()).build();
        assertAuthenticationAutomatic(httpServerInfo.getHttpsUri(), clientWithOAuthToken);
        try (Response response = clientWithOAuthToken.newCall(new Request.Builder().url(getLocation(httpServerInfo.getHttpsUri(), "/protocol/identity")).build()).execute()) {
            assertEquals(response.code(), SC_OK);
            assertEquals(response.header("user"), TEST_USER);
            assertEquals(response.header("principal"), TEST_USER);
            assertEquals(response.header("groups"), groups.map(TestResource::toHeader).orElse(""));
        }
        OkHttpClient clientWithOAuthCookie = client.newBuilder().cookieJar(new CookieJar() {

            @Override
            public void saveFromResponse(HttpUrl url, List<Cookie> cookies) {
            }

            @Override
            public List<Cookie> loadForRequest(HttpUrl url) {
                return ImmutableList.of(new Cookie.Builder().domain(httpServerInfo.getHttpsUri().getHost()).path(UI_LOCATION).name(OAUTH2_COOKIE).value(accessToken).httpOnly().secure().build());
            }
        }).build();
        try (Response response = clientWithOAuthCookie.newCall(new Request.Builder().url(getLocation(httpServerInfo.getHttpsUri(), "/ui/api/identity")).build()).execute()) {
            assertEquals(response.code(), SC_OK);
            assertEquals(response.header("user"), TEST_USER);
            assertEquals(response.header("principal"), TEST_USER);
            assertEquals(response.header("groups"), groups.map(TestResource::toHeader).orElse(""));
        }
    }
}