Examples with AuthenticationTokenIdentifier org.apache.accumulo.core.client.impl.AuthenticationTokenIdentifier used on opensource projects

Example 11 with AuthenticationTokenIdentifier

use of org.apache.accumulo.core.client.impl.AuthenticationTokenIdentifier in project accumulo by apache.

the class SaslServerDigestCallbackHandler method getIdentifier.

private AuthenticationTokenIdentifier getIdentifier(String id, AuthenticationTokenSecretManager secretManager) throws InvalidToken {
    byte[] tokenId = decodeIdentifier(id);
    AuthenticationTokenIdentifier tokenIdentifier = secretManager.createIdentifier();
    try {
        tokenIdentifier.readFields(new DataInputStream(new ByteArrayInputStream(tokenId)));
    } catch (IOException e) {
        throw (InvalidToken) new InvalidToken("Can't de-serialize tokenIdentifier").initCause(e);
    }
    return tokenIdentifier;
}

Example 12 with AuthenticationTokenIdentifier

use of org.apache.accumulo.core.client.impl.AuthenticationTokenIdentifier in project accumulo by apache.

the class SaslServerDigestCallbackHandler method handle.

@Override
public void handle(Callback[] callbacks) throws InvalidToken, UnsupportedCallbackException {
    NameCallback nc = null;
    PasswordCallback pc = null;
    AuthorizeCallback ac = null;
    for (Callback callback : callbacks) {
        if (callback instanceof AuthorizeCallback) {
            ac = (AuthorizeCallback) callback;
        } else if (callback instanceof NameCallback) {
            nc = (NameCallback) callback;
        } else if (callback instanceof PasswordCallback) {
            pc = (PasswordCallback) callback;
        } else if (callback instanceof RealmCallback) {
            // realm is ignored
            continue;
        } else {
            throw new UnsupportedCallbackException(callback, "Unrecognized SASL DIGEST-MD5 Callback");
        }
    }
    if (pc != null) {
        AuthenticationTokenIdentifier tokenIdentifier = getIdentifier(nc.getDefaultName(), secretManager);
        char[] password = getPassword(secretManager, tokenIdentifier);
        UserGroupInformation user = null;
        user = tokenIdentifier.getUser();
        // Set the principal since we already deserialized the token identifier
        UGIAssumingProcessor.getRpcPrincipalThreadLocal().set(user.getUserName());
        log.trace("SASL server DIGEST-MD5 callback: setting password for client: {}", tokenIdentifier.getUser());
        pc.setPassword(password);
    }
    if (ac != null) {
        String authid = ac.getAuthenticationID();
        String authzid = ac.getAuthorizationID();
        if (authid.equals(authzid)) {
            ac.setAuthorized(true);
        } else {
            ac.setAuthorized(false);
        }
        if (ac.isAuthorized()) {
            String username = getIdentifier(authzid, secretManager).getUser().getUserName();
            log.trace("SASL server DIGEST-MD5 callback: setting canonicalized client ID: {}", username);
            ac.setAuthorizedID(authzid);
        }
    }
}

Example 13 with AuthenticationTokenIdentifier

use of org.apache.accumulo.core.client.impl.AuthenticationTokenIdentifier in project accumulo by apache.

the class MasterClientServiceHandler method getDelegationToken.

@Override
public TDelegationToken getDelegationToken(TInfo tinfo, TCredentials credentials, TDelegationTokenConfig tConfig) throws ThriftSecurityException, TException {
    if (!master.security.canObtainDelegationToken(credentials)) {
        throw new ThriftSecurityException(credentials.getPrincipal(), SecurityErrorCode.PERMISSION_DENIED);
    }
    // Round-about way to verify that SASL is also enabled.
    if (!master.delegationTokensAvailable()) {
        throw new TException("Delegation tokens are not available for use");
    }
    final DelegationTokenConfig config = DelegationTokenConfigSerializer.deserialize(tConfig);
    final AuthenticationTokenSecretManager secretManager = master.getSecretManager();
    try {
        Entry<Token<AuthenticationTokenIdentifier>, AuthenticationTokenIdentifier> pair = secretManager.generateToken(credentials.principal, config);
        return new TDelegationToken(ByteBuffer.wrap(pair.getKey().getPassword()), pair.getValue().getThriftIdentifier());
    } catch (Exception e) {
        throw new TException(e.getMessage());
    }
}

Example 14 with AuthenticationTokenIdentifier

use of org.apache.accumulo.core.client.impl.AuthenticationTokenIdentifier in project accumulo by apache.

the class AuthenticationTokenSecretManagerTest method testExpiredPasswordsThrowError.

@Test(expected = InvalidToken.class)
public void testExpiredPasswordsThrowError() throws Exception {
    // start of the test
    long then = System.currentTimeMillis();
    // 500ms lifetime
    long tokenLifetime = 500;
    AuthenticationTokenSecretManager secretManager = new AuthenticationTokenSecretManager(instance, tokenLifetime);
    // Add a current key
    secretManager.addKey(new AuthenticationKey(1, then, then + tokenLifetime, keyGen.generateKey()));
    String principal = "user@EXAMPLE.COM";
    Entry<Token<AuthenticationTokenIdentifier>, AuthenticationTokenIdentifier> pair = secretManager.generateToken(principal, cfg);
    Token<AuthenticationTokenIdentifier> token = pair.getKey();
    // Add a small buffer to make sure we move past the expiration of 0 for the token.
    Thread.sleep(1000);
    // Reconstitute the token identifier (will happen when clients are involved)
    AuthenticationTokenIdentifier id = new AuthenticationTokenIdentifier();
    id.readFields(new DataInputStream(new ByteArrayInputStream(token.getIdentifier())));
    secretManager.retrievePassword(id);
}

Example 15 with AuthenticationTokenIdentifier

use of org.apache.accumulo.core.client.impl.AuthenticationTokenIdentifier in project accumulo by apache.

the class AuthenticationTokenSecretManagerTest method testGenerateToken.

@Test
public void testGenerateToken() throws Exception {
    // start of the test
    long then = System.currentTimeMillis();
    // 1 minute
    long tokenLifetime = 60 * 1000;
    AuthenticationTokenSecretManager secretManager = new AuthenticationTokenSecretManager(instance, tokenLifetime);
    // Add a current key
    secretManager.addKey(new AuthenticationKey(1, then, then + tokenLifetime, keyGen.generateKey()));
    String principal = "user@EXAMPLE.COM";
    Entry<Token<AuthenticationTokenIdentifier>, AuthenticationTokenIdentifier> pair = secretManager.generateToken(principal, cfg);
    assertNotNull(pair);
    Token<AuthenticationTokenIdentifier> token = pair.getKey();
    assertNotNull(token);
    assertEquals(AuthenticationTokenIdentifier.TOKEN_KIND, token.getKind());
    // Reconstitute the token identifier (will happen when clients are involved)
    AuthenticationTokenIdentifier id = new AuthenticationTokenIdentifier();
    id.readFields(new DataInputStream(new ByteArrayInputStream(token.getIdentifier())));
    long now = System.currentTimeMillis();
    // Issue date should be after the test started, but before we deserialized the token
    assertTrue("Issue date did not fall within the expected upper bound. Expected less than " + now + ", but was " + id.getIssueDate(), id.getIssueDate() <= now);
    assertTrue("Issue date did not fall within the expected lower bound. Expected greater than " + then + ", but was " + id.getIssueDate(), id.getIssueDate() >= then);
    // Expiration is the token lifetime plus the issue date
    assertEquals(id.getIssueDate() + tokenLifetime, id.getExpirationDate());
    // Verify instance ID
    assertEquals(instanceId, id.getInstanceId());
    // The returned id should be the same as the reconstructed id
    assertEquals(pair.getValue(), id);
}