Examples with Identity io.trino.spi.security.Identity used on opensource projects

Example 26 with Identity

use of io.trino.spi.security.Identity in project trino by trinodb.

the class AuthenticationFilter method filter.

@Override
public void filter(ContainerRequestContext request) {
    if (InternalAuthenticationManager.isInternalRequest(request)) {
        internalAuthenticationManager.handleInternalRequest(request);
        return;
    }
    List<Authenticator> authenticators;
    if (request.getSecurityContext().isSecure()) {
        authenticators = this.authenticators;
    } else if (insecureAuthenticationOverHttpAllowed) {
        authenticators = ImmutableList.of(insecureAuthenticator);
    } else {
        throw new ForbiddenException("Authentication over HTTP is not enabled");
    }
    // try to authenticate, collecting errors and authentication headers
    Set<String> messages = new LinkedHashSet<>();
    Set<String> authenticateHeaders = new LinkedHashSet<>();
    for (Authenticator authenticator : authenticators) {
        Identity authenticatedIdentity;
        try {
            authenticatedIdentity = authenticator.authenticate(request);
        } catch (AuthenticationException e) {
            // Some authenticators (e.g. password) nest multiple internal authenticators.
            // Exceptions from additional failed login attempts are suppressed in the first exception
            Stream.concat(Stream.of(e), Arrays.stream(e.getSuppressed())).filter(ex -> ex instanceof AuthenticationException).map(AuthenticationException.class::cast).forEach(ex -> {
                if (ex.getMessage() != null) {
                    messages.add(ex.getMessage());
                }
                ex.getAuthenticateHeader().ifPresent(authenticateHeaders::add);
            });
            continue;
        }
        // authentication succeeded
        setAuthenticatedIdentity(request, authenticatedIdentity);
        return;
    }
    // authentication failed
    if (messages.isEmpty()) {
        messages.add("Unauthorized");
    }
    // The error string is used by clients for exception messages and
    // is presented to the end user, thus it should be a single line.
    String error = Joiner.on(" | ").join(messages);
    sendWwwAuthenticate(request, error, authenticateHeaders);
}

Example 27 with Identity

use of io.trino.spi.security.Identity in project trino by trinodb.

the class HeaderAuthenticator method authenticate.

@Override
public Identity authenticate(ContainerRequestContext request) throws AuthenticationException {
    AuthenticationException exception = null;
    Map<String, List<String>> lowerCasedHeaders = request.getHeaders().entrySet().stream().collect(Collectors.toMap(entry -> entry.getKey().toLowerCase(Locale.ENGLISH), Map.Entry::getValue));
    for (io.trino.spi.security.HeaderAuthenticator authenticator : this.authenticatorManager.getAuthenticators()) {
        try {
            Principal principal = authenticator.createAuthenticatedPrincipal(name -> lowerCasedHeaders.get(name.toLowerCase(Locale.ENGLISH)));
            String authenticatedUser = this.userMapping.mapUser(principal.toString());
            return Identity.forUser(authenticatedUser).withPrincipal(principal).build();
        } catch (UserMappingException | AccessDeniedException e) {
            if (exception == null) {
                exception = new AuthenticationException(e.getMessage());
            } else {
                exception.addSuppressed(new AuthenticationException(e.getMessage()));
            }
        } catch (RuntimeException e) {
            throw new RuntimeException("Authentication error", e);
        }
    }
    verify(exception != null, "exception is not set");
    throw exception;
}

Example 28 with Identity

use of io.trino.spi.security.Identity in project trino by trinodb.

the class CreateViewTask method execute.

@Override
public ListenableFuture<Void> execute(CreateView statement, QueryStateMachine stateMachine, List<Expression> parameters, WarningCollector warningCollector) {
    Session session = stateMachine.getSession();
    QualifiedObjectName name = createQualifiedObjectName(session, statement, statement.getName());
    accessControl.checkCanCreateView(session.toSecurityContext(), name);
    if (metadata.isMaterializedView(session, name)) {
        throw semanticException(TABLE_ALREADY_EXISTS, statement, "Materialized view already exists: '%s'", name);
    }
    if (metadata.isView(session, name)) {
        if (!statement.isReplace()) {
            throw semanticException(TABLE_ALREADY_EXISTS, statement, "View already exists: '%s'", name);
        }
    } else if (metadata.getTableHandle(session, name).isPresent()) {
        throw semanticException(TABLE_ALREADY_EXISTS, statement, "Table already exists: '%s'", name);
    }
    String sql = getFormattedSql(statement.getQuery(), sqlParser);
    Analysis analysis = analyzerFactory.createAnalyzer(session, parameters, parameterExtractor(statement, parameters), stateMachine.getWarningCollector()).analyze(statement);
    List<ViewColumn> columns = analysis.getOutputDescriptor(statement.getQuery()).getVisibleFields().stream().map(field -> new ViewColumn(field.getName().get(), field.getType().getTypeId())).collect(toImmutableList());
    // use DEFINER security by default
    Optional<Identity> owner = Optional.of(session.getIdentity());
    if (statement.getSecurity().orElse(null) == INVOKER) {
        owner = Optional.empty();
    }
    ViewDefinition definition = new ViewDefinition(sql, session.getCatalog(), session.getSchema(), columns, statement.getComment(), owner);
    metadata.createView(session, name, definition, statement.isReplace());
    stateMachine.setOutput(analysis.getTarget());
    stateMachine.setReferencedTables(analysis.getReferencedTables());
    return immediateVoidFuture();
}