Examples with BasicPrincipal io.trino.spi.security.BasicPrincipal used on opensource projects

Example 1 with BasicPrincipal

use of io.trino.spi.security.BasicPrincipal in project trino by trinodb.

the class InsecureAuthenticator method authenticate.

@Override
public Identity authenticate(ContainerRequestContext request) throws AuthenticationException {
    Optional<BasicAuthCredentials> basicAuthCredentials = extractBasicAuthCredentials(request);
    String user;
    if (basicAuthCredentials.isPresent()) {
        if (basicAuthCredentials.get().getPassword().isPresent()) {
            throw new AuthenticationException("Password not allowed for insecure authentication", BasicAuthCredentials.AUTHENTICATE_HEADER);
        }
        user = basicAuthCredentials.get().getUser();
    } else {
        try {
            ProtocolHeaders protocolHeaders = detectProtocol(alternateHeaderName, request.getHeaders().keySet());
            user = emptyToNull(request.getHeaders().getFirst(protocolHeaders.requestUser()));
        } catch (ProtocolDetectionException e) {
            // ignored
            user = null;
        }
    }
    if (user == null) {
        throw new AuthenticationException("Basic authentication or " + TRINO_HEADERS.requestUser() + " must be sent", BasicAuthCredentials.AUTHENTICATE_HEADER);
    }
    try {
        String authenticatedUser = userMapping.mapUser(user);
        return Identity.forUser(authenticatedUser).withPrincipal(new BasicPrincipal(user)).build();
    } catch (UserMappingException e) {
        throw new AuthenticationException(e.getMessage());
    }
}

Example 2 with BasicPrincipal

use of io.trino.spi.security.BasicPrincipal in project trino by trinodb.

the class OAuth2Authenticator method createIdentity.

@Override
protected Optional<Identity> createIdentity(String token) throws UserMappingException {
    try {
        Optional<Map<String, Object>> claims = service.convertTokenToClaims(token);
        if (claims.isEmpty()) {
            return Optional.empty();
        }
        String principal = (String) claims.get().get(principalField);
        Identity.Builder builder = Identity.forUser(userMapping.mapUser(principal));
        builder.withPrincipal(new BasicPrincipal(principal));
        groupsField.flatMap(field -> Optional.ofNullable((List<String>) claims.get().get(field))).ifPresent(groups -> builder.withGroups(ImmutableSet.copyOf(groups)));
        return Optional.of(builder.build());
    } catch (ChallengeFailedException e) {
        return Optional.empty();
    }
}

Example 3 with BasicPrincipal

use of io.trino.spi.security.BasicPrincipal in project trino by trinodb.

the class TestWebUi method testCustomPrincipalField.

@Test
public void testCustomPrincipalField() throws Exception {
    String accessToken = createTokenBuilder().setSubject("unknown").addClaims(ImmutableMap.of("preferred_username", "test-user@email.com")).compact();
    TestingHttpServer jwkServer = createTestingJwkServer();
    jwkServer.start();
    try (TestingTrinoServer server = TestingTrinoServer.builder().setProperties(ImmutableMap.<String, String>builder().putAll(OAUTH2_PROPERTIES).put("http-server.authentication.oauth2.jwks-url", jwkServer.getBaseUrl().toString()).put("http-server.authentication.oauth2.principal-field", "preferred_username").put("http-server.authentication.oauth2.user-mapping.pattern", "(.*)@.*").buildOrThrow()).setAdditionalModule(binder -> {
        newOptionalBinder(binder, OAuth2Client.class).setBinding().toInstance(new OAuth2ClientStub(accessToken));
        jaxrsBinder(binder).bind(AuthenticatedIdentityCapturingFilter.class);
    }).build()) {
        HttpServerInfo httpServerInfo = server.getInstance(Key.get(HttpServerInfo.class));
        assertAuth2Authentication(httpServerInfo, accessToken);
        Identity identity = server.getInstance(Key.get(AuthenticatedIdentityCapturingFilter.class)).getAuthenticatedIdentity();
        assertThat(identity.getUser()).isEqualTo("test-user");
        assertThat(identity.getPrincipal()).isEqualTo(Optional.of(new BasicPrincipal("test-user@email.com")));
    } finally {
        jwkServer.stop();
    }
}

Example 4 with BasicPrincipal

use of io.trino.spi.security.BasicPrincipal in project trino by trinodb.

the class LdapAuthenticator method authenticateWithUserBind.

private Principal authenticateWithUserBind(Credential credential) {
    String user = credential.getUser();
    if (containsSpecialCharacters(user)) {
        throw new AccessDeniedException("Username contains a special LDAP character");
    }
    Exception lastException = new RuntimeException();
    for (String userBindSearchPattern : userBindSearchPatterns) {
        try {
            String userDistinguishedName = replaceUser(userBindSearchPattern, user);
            if (groupAuthorizationSearchPattern.isPresent()) {
                // user password is also validated as user DN and password is used for querying LDAP
                String searchBase = userBaseDistinguishedName.orElseThrow();
                String groupSearch = replaceUser(groupAuthorizationSearchPattern.get(), user);
                if (!client.isGroupMember(searchBase, groupSearch, userDistinguishedName, credential.getPassword())) {
                    String message = format("User [%s] not a member of an authorized group", user);
                    log.debug("%s", message);
                    throw new AccessDeniedException(message);
                }
            } else {
                client.validatePassword(userDistinguishedName, credential.getPassword());
            }
            log.debug("Authentication successful for user [%s]", user);
            return new BasicPrincipal(user);
        } catch (NamingException | AccessDeniedException e) {
            lastException = e;
        }
    }
    log.debug(lastException, "Authentication failed for user [%s], %s", user, lastException.getMessage());
    if (lastException instanceof AccessDeniedException) {
        throw (AccessDeniedException) lastException;
    }
    throw new RuntimeException("Authentication error");
}

Example 5 with BasicPrincipal

use of io.trino.spi.security.BasicPrincipal in project trino by trinodb.

the class OAuth2WebUiAuthenticationFilter method filter.

@Override
public void filter(ContainerRequestContext request) {
    String path = request.getUriInfo().getRequestUri().getPath();
    if (path.equals(DISABLED_LOCATION)) {
        return;
    }
    // doesn't seem very useful if you have OAuth, and would be very complex.
    if (!request.getSecurityContext().isSecure()) {
        // send 401 to REST api calls and redirect to others
        if (path.startsWith("/ui/api/")) {
            sendWwwAuthenticate(request, "Unauthorized", ImmutableSet.of(TRINO_FORM_LOGIN));
            return;
        }
        request.abortWith(Response.seeOther(DISABLED_LOCATION_URI).build());
        return;
    }
    Optional<Map<String, Object>> claims;
    try {
        claims = getAccessToken(request);
        if (claims.isEmpty()) {
            needAuthentication(request);
            return;
        }
    } catch (ChallengeFailedException e) {
        LOG.debug(e, "Invalid token: %s", e.getMessage());
        sendErrorMessage(request, UNAUTHORIZED, "Unauthorized");
        return;
    }
    try {
        Object principal = claims.get().get(principalField);
        if (!isValidPrincipal(principal)) {
            LOG.debug("Invalid principal field: %s. Expected principal to be non-empty", principalField);
            sendErrorMessage(request, UNAUTHORIZED, "Unauthorized");
            return;
        }
        String principalName = (String) principal;
        Identity.Builder builder = Identity.forUser(userMapping.mapUser(principalName));
        builder.withPrincipal(new BasicPrincipal(principalName));
        groupsField.flatMap(field -> Optional.ofNullable((List<String>) claims.get().get(field))).ifPresent(groups -> builder.withGroups(ImmutableSet.copyOf(groups)));
        setAuthenticatedIdentity(request, builder.build());
    } catch (UserMappingException e) {
        sendErrorMessage(request, UNAUTHORIZED, firstNonNull(e.getMessage(), "Unauthorized"));
    }
}