Examples with AccessControl org.apache.geode.security.AccessControl used on opensource projects

Example 1 with AccessControl

use of org.apache.geode.security.AccessControl in project geode by apache.

the class CacheClientNotifier method registerGFEClient.

protected void registerGFEClient(DataInputStream dis, DataOutputStream dos, Socket socket, boolean isPrimary, long startTime, Version clientVersion, long acceptorId, boolean notifyBySubscription) throws IOException {
    // Read the ports and throw them away. We no longer need them
    int numberOfPorts = dis.readInt();
    for (int i = 0; i < numberOfPorts; i++) {
        dis.readInt();
    }
    // Read the handshake identifier and convert it to a string member id
    ClientProxyMembershipID proxyID = null;
    CacheClientProxy proxy;
    AccessControl authzCallback = null;
    byte clientConflation = HandShake.CONFLATION_DEFAULT;
    try {
        proxyID = ClientProxyMembershipID.readCanonicalized(dis);
        if (getBlacklistedClient().contains(proxyID)) {
            writeException(dos, HandShake.REPLY_INVALID, new Exception("This client is blacklisted by server"), clientVersion);
            return;
        }
        proxy = getClientProxy(proxyID);
        DistributedMember member = proxyID.getDistributedMember();
        DistributedSystem system = this.getCache().getDistributedSystem();
        Properties sysProps = system.getProperties();
        String authenticator = sysProps.getProperty(SECURITY_CLIENT_AUTHENTICATOR);
        if (clientVersion.compareTo(Version.GFE_603) >= 0) {
            byte[] overrides = HandShake.extractOverrides(new byte[] { (byte) dis.read() });
            clientConflation = overrides[0];
        } else {
            clientConflation = (byte) dis.read();
        }
        switch(clientConflation) {
            case HandShake.CONFLATION_DEFAULT:
            case HandShake.CONFLATION_OFF:
            case HandShake.CONFLATION_ON:
                break;
            default:
                writeException(dos, HandShake.REPLY_INVALID, new IllegalArgumentException("Invalid conflation byte"), clientVersion);
                return;
        }
        proxy = registerClient(socket, proxyID, proxy, isPrimary, clientConflation, clientVersion, acceptorId, notifyBySubscription);
        Properties credentials = HandShake.readCredentials(dis, dos, system);
        if (credentials != null && proxy != null) {
            if (securityLogWriter.fineEnabled()) {
                securityLogWriter.fine("CacheClientNotifier: verifying credentials for proxyID: " + proxyID);
            }
            Object subject = HandShake.verifyCredentials(authenticator, credentials, system.getSecurityProperties(), this.logWriter, this.securityLogWriter, member);
            if (subject instanceof Principal) {
                Principal principal = (Principal) subject;
                if (securityLogWriter.fineEnabled()) {
                    securityLogWriter.fine("CacheClientNotifier: successfully verified credentials for proxyID: " + proxyID + " having principal: " + principal.getName());
                }
                String postAuthzFactoryName = sysProps.getProperty(SECURITY_CLIENT_ACCESSOR_PP);
                if (postAuthzFactoryName != null && postAuthzFactoryName.length() > 0) {
                    if (principal == null) {
                        securityLogWriter.warning(LocalizedStrings.CacheClientNotifier_CACHECLIENTNOTIFIER_POST_PROCESS_AUTHORIZATION_CALLBACK_ENABLED_BUT_AUTHENTICATION_CALLBACK_0_RETURNED_WITH_NULL_CREDENTIALS_FOR_PROXYID_1, new Object[] { SECURITY_CLIENT_AUTHENTICATOR, proxyID });
                    }
                    Method authzMethod = ClassLoadUtil.methodFromName(postAuthzFactoryName);
                    authzCallback = (AccessControl) authzMethod.invoke(null, (Object[]) null);
                    authzCallback.init(principal, member, this.getCache());
                }
                proxy.setPostAuthzCallback(authzCallback);
            } else if (subject instanceof Subject) {
                proxy.setSubject((Subject) subject);
            }
        }
    } catch (ClassNotFoundException e) {
        throw new IOException(LocalizedStrings.CacheClientNotifier_CLIENTPROXYMEMBERSHIPID_OBJECT_COULD_NOT_BE_CREATED_EXCEPTION_OCCURRED_WAS_0.toLocalizedString(e));
    } catch (AuthenticationRequiredException ex) {
        securityLogWriter.warning(LocalizedStrings.CacheClientNotifier_AN_EXCEPTION_WAS_THROWN_FOR_CLIENT_0_1, new Object[] { proxyID, ex });
        writeException(dos, HandShake.REPLY_EXCEPTION_AUTHENTICATION_REQUIRED, ex, clientVersion);
        return;
    } catch (AuthenticationFailedException ex) {
        securityLogWriter.warning(LocalizedStrings.CacheClientNotifier_AN_EXCEPTION_WAS_THROWN_FOR_CLIENT_0_1, new Object[] { proxyID, ex });
        writeException(dos, HandShake.REPLY_EXCEPTION_AUTHENTICATION_FAILED, ex, clientVersion);
        return;
    } catch (CacheException e) {
        logger.warn(LocalizedMessage.create(LocalizedStrings.CacheClientNotifier_0_REGISTERCLIENT_EXCEPTION_ENCOUNTERED_IN_REGISTRATION_1, new Object[] { this, e }), e);
        IOException io = new IOException(LocalizedStrings.CacheClientNotifier_EXCEPTION_OCCURRED_WHILE_TRYING_TO_REGISTER_INTEREST_DUE_TO_0.toLocalizedString(e.getMessage()));
        io.initCause(e);
        throw io;
    } catch (Exception ex) {
        logger.warn(LocalizedMessage.create(LocalizedStrings.CacheClientNotifier_AN_EXCEPTION_WAS_THROWN_FOR_CLIENT_0_1, new Object[] { proxyID, "" }), ex);
        writeException(dos, Acceptor.UNSUCCESSFUL_SERVER_TO_CLIENT, ex, clientVersion);
        return;
    }
    this.statistics.endClientRegistration(startTime);
}