Examples with SaslServer javax.security.sasl.SaslServer used on opensource projects

Example 6 with SaslServer

use of javax.security.sasl.SaslServer in project kafka by apache.

the class DefaultKafkaPrincipalBuilderTest method testPrincipalBuilderGssapi.

@Test
public void testPrincipalBuilderGssapi() throws Exception {
    SaslServer server = mock(SaslServer.class);
    KerberosShortNamer kerberosShortNamer = mock(KerberosShortNamer.class);
    when(server.getMechanismName()).thenReturn(SaslConfigs.GSSAPI_MECHANISM);
    when(server.getAuthorizationID()).thenReturn("foo/host@REALM.COM");
    when(kerberosShortNamer.shortName(any())).thenReturn("foo");
    DefaultKafkaPrincipalBuilder builder = new DefaultKafkaPrincipalBuilder(kerberosShortNamer, null);
    KafkaPrincipal principal = builder.build(new SaslAuthenticationContext(server, SecurityProtocol.SASL_PLAINTEXT, InetAddress.getLocalHost(), SecurityProtocol.SASL_PLAINTEXT.name()));
    assertEquals(KafkaPrincipal.USER_TYPE, principal.getPrincipalType());
    assertEquals("foo", principal.getName());
    verify(server, atLeastOnce()).getMechanismName();
    verify(server, atLeastOnce()).getAuthorizationID();
    verify(kerberosShortNamer, atLeastOnce()).shortName(any());
}

Example 7 with SaslServer

use of javax.security.sasl.SaslServer in project kafka by apache.

the class DefaultKafkaPrincipalBuilderTest method testPrincipalBuilderSerde.

@Test
public void testPrincipalBuilderSerde() throws Exception {
    SaslServer server = mock(SaslServer.class);
    KerberosShortNamer kerberosShortNamer = mock(KerberosShortNamer.class);
    when(server.getMechanismName()).thenReturn(SaslConfigs.GSSAPI_MECHANISM);
    when(server.getAuthorizationID()).thenReturn("foo/host@REALM.COM");
    when(kerberosShortNamer.shortName(any())).thenReturn("foo");
    DefaultKafkaPrincipalBuilder builder = new DefaultKafkaPrincipalBuilder(kerberosShortNamer, null);
    KafkaPrincipal principal = builder.build(new SaslAuthenticationContext(server, SecurityProtocol.SASL_PLAINTEXT, InetAddress.getLocalHost(), SecurityProtocol.SASL_PLAINTEXT.name()));
    assertEquals(KafkaPrincipal.USER_TYPE, principal.getPrincipalType());
    assertEquals("foo", principal.getName());
    byte[] serializedPrincipal = builder.serialize(principal);
    KafkaPrincipal deserializedPrincipal = builder.deserialize(serializedPrincipal);
    assertEquals(principal, deserializedPrincipal);
    verify(server, atLeastOnce()).getMechanismName();
    verify(server, atLeastOnce()).getAuthorizationID();
    verify(kerberosShortNamer, atLeastOnce()).shortName(any());
}

Example 8 with SaslServer

use of javax.security.sasl.SaslServer in project kafka by apache.

the class SaslServerAuthenticator method createSaslKerberosServer.

private SaslServer createSaslKerberosServer(final AuthenticateCallbackHandler saslServerCallbackHandler, final Map<String, ?> configs, Subject subject) throws IOException {
    // server is using a JAAS-authenticated subject: determine service principal name and hostname from kafka server's subject.
    final String servicePrincipal = SaslClientAuthenticator.firstPrincipal(subject);
    KerberosName kerberosName;
    try {
        kerberosName = KerberosName.parse(servicePrincipal);
    } catch (IllegalArgumentException e) {
        throw new KafkaException("Principal has name with unexpected format " + servicePrincipal);
    }
    final String servicePrincipalName = kerberosName.serviceName();
    final String serviceHostname = kerberosName.hostName();
    LOG.debug("Creating SaslServer for {} with mechanism {}", kerberosName, saslMechanism);
    try {
        return Subject.doAs(subject, (PrivilegedExceptionAction<SaslServer>) () -> Sasl.createSaslServer(saslMechanism, servicePrincipalName, serviceHostname, configs, saslServerCallbackHandler));
    } catch (PrivilegedActionException e) {
        throw new SaslException("Kafka Server failed to create a SaslServer to interact with a client during session authentication", e.getCause());
    }
}

Example 9 with SaslServer

use of javax.security.sasl.SaslServer in project sissi by KimShen.

the class CachedSaslServers method pull.

@Override
public SaslServer pull(JIDContext context) {
    SaslServer saslServer = this.cached.remove(context);
    this.resourceCounter.decrement(this.resource);
    return saslServer;
}

Example 10 with SaslServer

use of javax.security.sasl.SaslServer in project hbase by apache.

the class ThriftServer method setupServer.

/**
 * Setting up the thrift TServer
 */
protected void setupServer() throws Exception {
    // Construct correct ProtocolFactory
    TProtocolFactory protocolFactory = getProtocolFactory();
    ImplType implType = ImplType.getServerImpl(conf);
    TProcessor processorToUse = processor;
    // Construct correct TransportFactory
    TTransportFactory transportFactory;
    if (conf.getBoolean(FRAMED_CONF_KEY, FRAMED_CONF_DEFAULT) || implType.isAlwaysFramed) {
        if (qop != null) {
            throw new RuntimeException("Thrift server authentication" + " doesn't work with framed transport yet");
        }
        transportFactory = new TFramedTransport.Factory(conf.getInt(MAX_FRAME_SIZE_CONF_KEY, MAX_FRAME_SIZE_CONF_DEFAULT) * 1024 * 1024);
        LOG.debug("Using framed transport");
    } else if (qop == null) {
        transportFactory = new TTransportFactory();
    } else {
        // Extract the name from the principal
        String thriftKerberosPrincipal = conf.get(THRIFT_KERBEROS_PRINCIPAL_KEY);
        if (thriftKerberosPrincipal == null) {
            throw new IllegalArgumentException(THRIFT_KERBEROS_PRINCIPAL_KEY + " cannot be null");
        }
        String name = SecurityUtil.getUserFromPrincipal(thriftKerberosPrincipal);
        Map<String, String> saslProperties = SaslUtil.initSaslProperties(qop.name());
        TSaslServerTransport.Factory saslFactory = new TSaslServerTransport.Factory();
        saslFactory.addServerDefinition("GSSAPI", name, host, saslProperties, new SaslRpcServer.SaslGssCallbackHandler() {

            @Override
            public void handle(Callback[] callbacks) throws UnsupportedCallbackException {
                AuthorizeCallback ac = null;
                for (Callback callback : callbacks) {
                    if (callback instanceof AuthorizeCallback) {
                        ac = (AuthorizeCallback) callback;
                    } else {
                        throw new UnsupportedCallbackException(callback, "Unrecognized SASL GSSAPI Callback");
                    }
                }
                if (ac != null) {
                    String authid = ac.getAuthenticationID();
                    String authzid = ac.getAuthorizationID();
                    if (!authid.equals(authzid)) {
                        ac.setAuthorized(false);
                    } else {
                        ac.setAuthorized(true);
                        String userName = SecurityUtil.getUserFromPrincipal(authzid);
                        LOG.info("Effective user: {}", userName);
                        ac.setAuthorizedID(userName);
                    }
                }
            }
        });
        transportFactory = saslFactory;
        // Create a processor wrapper, to get the caller
        processorToUse = (inProt, outProt) -> {
            TSaslServerTransport saslServerTransport = (TSaslServerTransport) inProt.getTransport();
            SaslServer saslServer = saslServerTransport.getSaslServer();
            String principal = saslServer.getAuthorizationID();
            hbaseServiceHandler.setEffectiveUser(principal);
            processor.process(inProt, outProt);
        };
    }
    if (conf.get(BIND_CONF_KEY) != null && !implType.canSpecifyBindIP) {
        LOG.error("Server types {} don't support IP address binding at the moment. See " + "https://issues.apache.org/jira/browse/HBASE-2155 for details.", Joiner.on(", ").join(ImplType.serversThatCannotSpecifyBindIP()));
        throw new RuntimeException("-" + BIND_CONF_KEY + " not supported with " + implType);
    }
    InetSocketAddress inetSocketAddress = new InetSocketAddress(getBindAddress(conf), listenPort);
    if (implType == ImplType.HS_HA || implType == ImplType.NONBLOCKING || implType == ImplType.THREADED_SELECTOR) {
        TNonblockingServerTransport serverTransport = new TNonblockingServerSocket(inetSocketAddress);
        if (implType == ImplType.NONBLOCKING) {
            tserver = getTNonBlockingServer(serverTransport, protocolFactory, processorToUse, transportFactory, inetSocketAddress);
        } else if (implType == ImplType.HS_HA) {
            tserver = getTHsHaServer(serverTransport, protocolFactory, processorToUse, transportFactory, inetSocketAddress);
        } else {
            // THREADED_SELECTOR
            tserver = getTThreadedSelectorServer(serverTransport, protocolFactory, processorToUse, transportFactory, inetSocketAddress);
        }
        LOG.info("starting HBase {} server on {}", implType.simpleClassName(), Integer.toString(listenPort));
    } else if (implType == ImplType.THREAD_POOL) {
        this.tserver = getTThreadPoolServer(protocolFactory, processorToUse, transportFactory, inetSocketAddress);
    } else {
        throw new AssertionError("Unsupported Thrift server implementation: " + implType.simpleClassName());
    }
    // A sanity check that we instantiated the right type of server.
    if (tserver.getClass() != implType.serverClass) {
        throw new AssertionError("Expected to create Thrift server class " + implType.serverClass.getName() + " but got " + tserver.getClass().getName());
    }
}