Examples with AuthorizeCallback javax.security.sasl.AuthorizeCallback used on opensource projects

Example 11 with AuthorizeCallback

use of javax.security.sasl.AuthorizeCallback in project kafka by apache.

the class KerberosClientCallbackHandler method handle.

@Override
public void handle(Callback[] callbacks) throws UnsupportedCallbackException {
    for (Callback callback : callbacks) {
        if (callback instanceof NameCallback) {
            NameCallback nc = (NameCallback) callback;
            nc.setName(nc.getDefaultName());
        } else if (callback instanceof PasswordCallback) {
            String errorMessage = "Could not login: the client is being asked for a password, but the Kafka" + " client code does not currently support obtaining a password from the user.";
            errorMessage += " Make sure -Djava.security.auth.login.config property passed to JVM and" + " the client is configured to use a ticket cache (using" + " the JAAS configuration setting 'useTicketCache=true)'. Make sure you are using" + " FQDN of the Kafka broker you are trying to connect to.";
            throw new UnsupportedCallbackException(callback, errorMessage);
        } else if (callback instanceof RealmCallback) {
            RealmCallback rc = (RealmCallback) callback;
            rc.setText(rc.getDefaultText());
        } else if (callback instanceof AuthorizeCallback) {
            AuthorizeCallback ac = (AuthorizeCallback) callback;
            String authId = ac.getAuthenticationID();
            String authzId = ac.getAuthorizationID();
            ac.setAuthorized(authId.equals(authzId));
            if (ac.isAuthorized())
                ac.setAuthorizedID(authzId);
        } else {
            throw new UnsupportedCallbackException(callback, "Unrecognized SASL ClientCallback");
        }
    }
}

Example 12 with AuthorizeCallback

use of javax.security.sasl.AuthorizeCallback in project alluxio by Alluxio.

the class PlainSaslServer method evaluateResponse.

@Override
@Nullable
public byte[] evaluateResponse(byte[] response) throws SaslException {
    Preconditions.checkState(!mCompleted, "PLAIN authentication has completed");
    Preconditions.checkArgument(response != null, "Received null response");
    try {
        // parse the response
        // message = [authorizationId] UTF8NUL authenticationId UTF8NUL passwd'
        // authorizationId may be empty,then the authorizationId = authenticationId
        String payload;
        try {
            payload = new String(response, "UTF-8");
        } catch (Exception e) {
            throw new IllegalArgumentException("Received corrupt response", e);
        }
        String[] parts = payload.split("\u0000", 3);
        // validate response
        if (parts.length != 3) {
            throw new IllegalArgumentException("Invalid message format, parts must contain 3 items");
        }
        String authorizationId = parts[0];
        String authenticationId = parts[1];
        String passwd = parts[2];
        Preconditions.checkState(authenticationId != null && !authenticationId.isEmpty(), "No authentication identity provided");
        Preconditions.checkState(passwd != null && !passwd.isEmpty(), "No password provided");
        if (authorizationId == null || authorizationId.isEmpty()) {
            authorizationId = authenticationId;
        }
        NameCallback nameCallback = new NameCallback("User");
        nameCallback.setName(authenticationId);
        PasswordCallback passwordCallback = new PasswordCallback("Password", false);
        passwordCallback.setPassword(passwd.toCharArray());
        AuthorizeCallback authCallback = new AuthorizeCallback(authenticationId, authorizationId);
        Callback[] cbList = { nameCallback, passwordCallback, authCallback };
        mHandler.handle(cbList);
        if (!authCallback.isAuthorized()) {
            throw new SaslException("AuthorizeCallback authorized failure");
        }
        mAuthorizationId = authCallback.getAuthorizedID();
    } catch (Exception e) {
        throw new SaslException("Plain authentication failed: " + e.getMessage(), e);
    }
    mCompleted = true;
    return null;
}

Example 13 with AuthorizeCallback

use of javax.security.sasl.AuthorizeCallback in project alluxio by Alluxio.

the class PlainSaslServerCallbackHandlerTest method authenticateNameMatch.

/**
 * Tests that the authentication callbacks matches.
 */
@Test
public void authenticateNameMatch() throws Exception {
    String authenticateId = "alluxio-1";
    NameCallback ncb = new NameCallback(" authentication id: ");
    ncb.setName(authenticateId);
    PasswordCallback pcb = new PasswordCallback(" password: ", false);
    pcb.setPassword("password".toCharArray());
    Callback[] callbacks = new Callback[] { ncb, pcb, new AuthorizeCallback(authenticateId, authenticateId) };
    mPlainServerCBHandler.handle(callbacks);
}

Example 14 with AuthorizeCallback

use of javax.security.sasl.AuthorizeCallback in project hbase by apache.

the class SaslPlainServer method evaluateResponse.

@Override
public byte[] evaluateResponse(byte[] response) throws SaslException {
    if (completed) {
        throw new IllegalStateException("PLAIN authentication has completed");
    }
    if (response == null) {
        throw new IllegalArgumentException("Received null response");
    }
    try {
        String payload;
        try {
            payload = new String(response, StandardCharsets.UTF_8);
        } catch (Exception e) {
            throw new IllegalArgumentException("Received corrupt response", e);
        }
        // [ authz, authn, password ]
        String[] parts = payload.split("\u0000", 3);
        if (parts.length != 3) {
            throw new IllegalArgumentException("Received corrupt response");
        }
        if (parts[0].isEmpty()) {
            // authz = authn
            parts[0] = parts[1];
        }
        NameCallback nc = new NameCallback("SASL PLAIN");
        nc.setName(parts[1]);
        PasswordCallback pc = new PasswordCallback("SASL PLAIN", false);
        pc.setPassword(parts[2].toCharArray());
        AuthorizeCallback ac = new AuthorizeCallback(parts[1], parts[0]);
        cbh.handle(new Callback[] { nc, pc, ac });
        if (ac.isAuthorized()) {
            authz = ac.getAuthorizedID();
        }
    } catch (Exception e) {
        throw new SaslException("PLAIN auth failed: " + e.toString(), e);
    } finally {
        completed = true;
    }
    return null;
}

Example 15 with AuthorizeCallback

use of javax.security.sasl.AuthorizeCallback in project hbase by apache.

the class ThriftServer method setupServer.

/**
 * Setting up the thrift TServer
 */
protected void setupServer() throws Exception {
    // Construct correct ProtocolFactory
    TProtocolFactory protocolFactory = getProtocolFactory();
    ImplType implType = ImplType.getServerImpl(conf);
    TProcessor processorToUse = processor;
    // Construct correct TransportFactory
    TTransportFactory transportFactory;
    if (conf.getBoolean(FRAMED_CONF_KEY, FRAMED_CONF_DEFAULT) || implType.isAlwaysFramed) {
        if (qop != null) {
            throw new RuntimeException("Thrift server authentication" + " doesn't work with framed transport yet");
        }
        transportFactory = new TFramedTransport.Factory(conf.getInt(MAX_FRAME_SIZE_CONF_KEY, MAX_FRAME_SIZE_CONF_DEFAULT) * 1024 * 1024);
        LOG.debug("Using framed transport");
    } else if (qop == null) {
        transportFactory = new TTransportFactory();
    } else {
        // Extract the name from the principal
        String thriftKerberosPrincipal = conf.get(THRIFT_KERBEROS_PRINCIPAL_KEY);
        if (thriftKerberosPrincipal == null) {
            throw new IllegalArgumentException(THRIFT_KERBEROS_PRINCIPAL_KEY + " cannot be null");
        }
        String name = SecurityUtil.getUserFromPrincipal(thriftKerberosPrincipal);
        Map<String, String> saslProperties = SaslUtil.initSaslProperties(qop.name());
        TSaslServerTransport.Factory saslFactory = new TSaslServerTransport.Factory();
        saslFactory.addServerDefinition("GSSAPI", name, host, saslProperties, new SaslRpcServer.SaslGssCallbackHandler() {

            @Override
            public void handle(Callback[] callbacks) throws UnsupportedCallbackException {
                AuthorizeCallback ac = null;
                for (Callback callback : callbacks) {
                    if (callback instanceof AuthorizeCallback) {
                        ac = (AuthorizeCallback) callback;
                    } else {
                        throw new UnsupportedCallbackException(callback, "Unrecognized SASL GSSAPI Callback");
                    }
                }
                if (ac != null) {
                    String authid = ac.getAuthenticationID();
                    String authzid = ac.getAuthorizationID();
                    if (!authid.equals(authzid)) {
                        ac.setAuthorized(false);
                    } else {
                        ac.setAuthorized(true);
                        String userName = SecurityUtil.getUserFromPrincipal(authzid);
                        LOG.info("Effective user: {}", userName);
                        ac.setAuthorizedID(userName);
                    }
                }
            }
        });
        transportFactory = saslFactory;
        // Create a processor wrapper, to get the caller
        processorToUse = (inProt, outProt) -> {
            TSaslServerTransport saslServerTransport = (TSaslServerTransport) inProt.getTransport();
            SaslServer saslServer = saslServerTransport.getSaslServer();
            String principal = saslServer.getAuthorizationID();
            hbaseServiceHandler.setEffectiveUser(principal);
            processor.process(inProt, outProt);
        };
    }
    if (conf.get(BIND_CONF_KEY) != null && !implType.canSpecifyBindIP) {
        LOG.error("Server types {} don't support IP address binding at the moment. See " + "https://issues.apache.org/jira/browse/HBASE-2155 for details.", Joiner.on(", ").join(ImplType.serversThatCannotSpecifyBindIP()));
        throw new RuntimeException("-" + BIND_CONF_KEY + " not supported with " + implType);
    }
    InetSocketAddress inetSocketAddress = new InetSocketAddress(getBindAddress(conf), listenPort);
    if (implType == ImplType.HS_HA || implType == ImplType.NONBLOCKING || implType == ImplType.THREADED_SELECTOR) {
        TNonblockingServerTransport serverTransport = new TNonblockingServerSocket(inetSocketAddress);
        if (implType == ImplType.NONBLOCKING) {
            tserver = getTNonBlockingServer(serverTransport, protocolFactory, processorToUse, transportFactory, inetSocketAddress);
        } else if (implType == ImplType.HS_HA) {
            tserver = getTHsHaServer(serverTransport, protocolFactory, processorToUse, transportFactory, inetSocketAddress);
        } else {
            // THREADED_SELECTOR
            tserver = getTThreadedSelectorServer(serverTransport, protocolFactory, processorToUse, transportFactory, inetSocketAddress);
        }
        LOG.info("starting HBase {} server on {}", implType.simpleClassName(), Integer.toString(listenPort));
    } else if (implType == ImplType.THREAD_POOL) {
        this.tserver = getTThreadPoolServer(protocolFactory, processorToUse, transportFactory, inetSocketAddress);
    } else {
        throw new AssertionError("Unsupported Thrift server implementation: " + implType.simpleClassName());
    }
    // A sanity check that we instantiated the right type of server.
    if (tserver.getClass() != implType.serverClass) {
        throw new AssertionError("Expected to create Thrift server class " + implType.serverClass.getName() + " but got " + tserver.getClass().getName());
    }
}