Examples with BasicPrincipal io.trino.spi.security.BasicPrincipal used on opensource projects

Example 6 with BasicPrincipal

use of io.trino.spi.security.BasicPrincipal in project trino by trinodb.

the class TestLdapAuthenticator method testSingleBindPattern.

@Test
public void testSingleBindPattern() throws Exception {
    try (DisposableSubContext organization = openLdapServer.createOrganization();
        DisposableSubContext ignored = openLdapServer.createUser(organization, "alice", "alice-pass")) {
        LdapAuthenticator ldapAuthenticator = new LdapAuthenticator(client, new LdapConfig().setUserBindSearchPatterns("uid=${USER}," + organization.getDistinguishedName()));
        assertThatThrownBy(() -> ldapAuthenticator.createAuthenticatedPrincipal("alice", "invalid")).isInstanceOf(AccessDeniedException.class).hasMessageMatching("Access Denied: Invalid credentials");
        assertThatThrownBy(() -> ldapAuthenticator.createAuthenticatedPrincipal("unknown", "alice-pass")).isInstanceOf(RuntimeException.class).hasMessageMatching("Access Denied: Invalid credentials");
        assertEquals(ldapAuthenticator.createAuthenticatedPrincipal("alice", "alice-pass"), new BasicPrincipal("alice"));
    }
}

Example 7 with BasicPrincipal

use of io.trino.spi.security.BasicPrincipal in project trino by trinodb.

the class TestLdapAuthenticator method testGroupMembership.

@Test
public void testGroupMembership() throws Exception {
    try (DisposableSubContext organization = openLdapServer.createOrganization();
        DisposableSubContext group = openLdapServer.createGroup(organization);
        DisposableSubContext alice = openLdapServer.createUser(organization, "alice", "alice-pass");
        DisposableSubContext ignored = openLdapServer.createUser(organization, "bob", "bob-pass")) {
        LdapAuthenticator ldapAuthenticator = new LdapAuthenticator(client, new LdapConfig().setUserBindSearchPatterns("uid=${USER}," + organization.getDistinguishedName()).setUserBaseDistinguishedName(organization.getDistinguishedName()).setGroupAuthorizationSearchPattern(format("(&(objectClass=groupOfNames)(cn=group_*)(member=uid=${USER},%s))", organization.getDistinguishedName())));
        assertThatThrownBy(() -> ldapAuthenticator.createAuthenticatedPrincipal("alice", "invalid")).isInstanceOf(AccessDeniedException.class).hasMessageMatching("Access Denied: Invalid credentials");
        assertThatThrownBy(() -> ldapAuthenticator.createAuthenticatedPrincipal("unknown", "alice-pass")).isInstanceOf(AccessDeniedException.class).hasMessageMatching("Access Denied: Invalid credentials");
        assertThatThrownBy(() -> ldapAuthenticator.createAuthenticatedPrincipal("bob", "bob-pass")).isInstanceOf(AccessDeniedException.class).hasMessageMatching("Access Denied: User \\[bob] not a member of an authorized group");
        openLdapServer.addUserToGroup(alice, group);
        assertEquals(ldapAuthenticator.createAuthenticatedPrincipal("alice", "alice-pass"), new BasicPrincipal("alice"));
    }
}

Example 8 with BasicPrincipal

use of io.trino.spi.security.BasicPrincipal in project trino by trinodb.

the class TestLdapAuthenticator method testDistinguishedNameLookup.

@Test
public void testDistinguishedNameLookup() throws Exception {
    try (DisposableSubContext organization = openLdapServer.createOrganization();
        DisposableSubContext group = openLdapServer.createGroup(organization);
        DisposableSubContext alice = openLdapServer.createUser(organization, "alice", "alice-pass");
        DisposableSubContext bob = openLdapServer.createUser(organization, "bob", "bob-pass")) {
        LdapAuthenticator ldapAuthenticator = new LdapAuthenticator(client, new LdapConfig().setUserBaseDistinguishedName(organization.getDistinguishedName()).setGroupAuthorizationSearchPattern(format("(&(objectClass=inetOrgPerson)(memberof=%s))", group.getDistinguishedName())).setBindDistingushedName("cn=admin,dc=trino,dc=testldap,dc=com").setBindPassword("admin"));
        assertThatThrownBy(() -> ldapAuthenticator.createAuthenticatedPrincipal("unknown_user", "invalid")).isInstanceOf(AccessDeniedException.class).hasMessageMatching("Access Denied: User \\[unknown_user] not a member of an authorized group");
        assertThatThrownBy(() -> ldapAuthenticator.createAuthenticatedPrincipal("alice", "invalid")).isInstanceOf(AccessDeniedException.class).hasMessageMatching("Access Denied: User \\[alice] not a member of an authorized group");
        ldapAuthenticator.invalidateCache();
        assertThatThrownBy(() -> ldapAuthenticator.createAuthenticatedPrincipal("alice", "alice-pass")).isInstanceOf(AccessDeniedException.class).hasMessageMatching("Access Denied: User \\[alice] not a member of an authorized group");
        ldapAuthenticator.invalidateCache();
        assertThatThrownBy(() -> ldapAuthenticator.createAuthenticatedPrincipal("bob", "bob-pass")).isInstanceOf(AccessDeniedException.class).hasMessageMatching("Access Denied: User \\[bob] not a member of an authorized group");
        ldapAuthenticator.invalidateCache();
        openLdapServer.addUserToGroup(alice, group);
        assertEquals(ldapAuthenticator.createAuthenticatedPrincipal("alice", "alice-pass"), new BasicPrincipal("alice"));
        ldapAuthenticator.invalidateCache();
        assertThatThrownBy(() -> ldapAuthenticator.createAuthenticatedPrincipal("alice", "invalid")).isInstanceOf(AccessDeniedException.class).hasMessageMatching("Access Denied: Invalid credentials");
        ldapAuthenticator.invalidateCache();
        // Now group authorization filter will return multiple entries
        openLdapServer.addUserToGroup(bob, group);
        assertThatThrownBy(() -> ldapAuthenticator.createAuthenticatedPrincipal("alice", "alice-pass")).isInstanceOf(AccessDeniedException.class).hasMessageMatching("Access Denied: Multiple group membership results for user \\[alice].*");
        ldapAuthenticator.invalidateCache();
    }
}

Example 9 with BasicPrincipal

use of io.trino.spi.security.BasicPrincipal in project trino by trinodb.

the class TestLdapAuthenticator method testMultipleBindPattern.

@Test
public void testMultipleBindPattern() throws Exception {
    try (DisposableSubContext organization = openLdapServer.createOrganization();
        DisposableSubContext alternativeOrganization = openLdapServer.createOrganization();
        DisposableSubContext ignored = openLdapServer.createUser(organization, "alice", "alice-pass");
        DisposableSubContext ignored1 = openLdapServer.createUser(alternativeOrganization, "bob", "bob-pass");
        DisposableSubContext ignored2 = openLdapServer.createUser(alternativeOrganization, "alice", "alt-alice-pass")) {
        LdapAuthenticator ldapAuthenticator = new LdapAuthenticator(client, new LdapConfig().setUserBindSearchPatterns(format("uid=${USER},%s:uid=${USER},%s", organization.getDistinguishedName(), alternativeOrganization.getDistinguishedName())));
        assertEquals(ldapAuthenticator.createAuthenticatedPrincipal("alice", "alice-pass"), new BasicPrincipal("alice"));
        ldapAuthenticator.invalidateCache();
        assertEquals(ldapAuthenticator.createAuthenticatedPrincipal("bob", "bob-pass"), new BasicPrincipal("bob"));
        ldapAuthenticator.invalidateCache();
        assertEquals(ldapAuthenticator.createAuthenticatedPrincipal("alice", "alt-alice-pass"), new BasicPrincipal("alice"));
        ldapAuthenticator.invalidateCache();
        assertEquals(ldapAuthenticator.createAuthenticatedPrincipal("alice", "alice-pass"), new BasicPrincipal("alice"));
        ldapAuthenticator.invalidateCache();
    }
}

Example 10 with BasicPrincipal

use of io.trino.spi.security.BasicPrincipal in project trino by trinodb.

the class TestLdapAuthenticatorWithTimeouts method testReadTimeout.

@Test
public void testReadTimeout() throws Exception {
    try (DisposableSubContext organization = openLdapServer.createOrganization();
        DisposableSubContext group = openLdapServer.createGroup(organization);
        DisposableSubContext alice = openLdapServer.createUser(organization, "alice", "alice-pass")) {
        openLdapServer.addUserToGroup(alice, group);
        LdapConfig ldapConfig = new LdapConfig().setLdapUrl(proxyLdapUrl).setLdapReadTimeout(new Duration(1, SECONDS)).setUserBindSearchPatterns("uid=${USER}," + organization.getDistinguishedName()).setUserBaseDistinguishedName(organization.getDistinguishedName()).setGroupAuthorizationSearchPattern(format("(&(objectClass=groupOfNames)(cn=group_*)(member=uid=${USER},%s))", organization.getDistinguishedName()));
        LdapAuthenticator ldapAuthenticator = new LdapAuthenticator(new JdkLdapAuthenticatorClient(ldapConfig), ldapConfig);
        assertThatThrownBy(() -> ldapAuthenticator.createAuthenticatedPrincipal("alice", "alice-pass")).isInstanceOf(RuntimeException.class).hasMessageMatching(".*Authentication error.*");
        LdapConfig withIncreasedTimeout = ldapConfig.setLdapReadTimeout(new Duration(30, SECONDS));
        assertEquals(new LdapAuthenticator(new JdkLdapAuthenticatorClient(withIncreasedTimeout), withIncreasedTimeout).createAuthenticatedPrincipal("alice", "alice-pass"), new BasicPrincipal("alice"));
    }
}