Examples with AuthenticationToken org.apache.hadoop.security.authentication.server.AuthenticationToken used on opensource projects

Example 11 with AuthenticationToken

use of org.apache.hadoop.security.authentication.server.AuthenticationToken in project hadoop by apache.

the class DelegationTokenAuthenticationFilter method doFilter.

@Override
protected void doFilter(FilterChain filterChain, HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
    boolean requestCompleted = false;
    UserGroupInformation ugi = null;
    AuthenticationToken authToken = (AuthenticationToken) request.getUserPrincipal();
    if (authToken != null && authToken != AuthenticationToken.ANONYMOUS) {
        // if the request was authenticated because of a delegation token,
        // then we ignore proxyuser (this is the same as the RPC behavior).
        ugi = (UserGroupInformation) request.getAttribute(DelegationTokenAuthenticationHandler.DELEGATION_TOKEN_UGI_ATTRIBUTE);
        if (ugi == null) {
            String realUser = request.getUserPrincipal().getName();
            ugi = UserGroupInformation.createRemoteUser(realUser, handlerAuthMethod);
            String doAsUser = getDoAs(request);
            if (doAsUser != null) {
                ugi = UserGroupInformation.createProxyUser(doAsUser, ugi);
                try {
                    ProxyUsers.authorize(ugi, request.getRemoteAddr());
                } catch (AuthorizationException ex) {
                    HttpExceptionUtils.createServletExceptionResponse(response, HttpServletResponse.SC_FORBIDDEN, ex);
                    requestCompleted = true;
                    if (LOG.isDebugEnabled()) {
                        LOG.debug("Authentication exception: " + ex.getMessage(), ex);
                    } else {
                        LOG.warn("Authentication exception: " + ex.getMessage());
                    }
                }
            }
        }
        UGI_TL.set(ugi);
    }
    if (!requestCompleted) {
        final UserGroupInformation ugiF = ugi;
        try {
            request = new HttpServletRequestWrapper(request) {

                @Override
                public String getAuthType() {
                    return (ugiF != null) ? handlerAuthMethod.toString() : null;
                }

                @Override
                public String getRemoteUser() {
                    return (ugiF != null) ? ugiF.getShortUserName() : null;
                }

                @Override
                public Principal getUserPrincipal() {
                    return (ugiF != null) ? new Principal() {

                        @Override
                        public String getName() {
                            return ugiF.getUserName();
                        }
                    } : null;
                }
            };
            super.doFilter(filterChain, request, response);
        } finally {
            UGI_TL.remove();
        }
    }
}

Example 12 with AuthenticationToken

use of org.apache.hadoop.security.authentication.server.AuthenticationToken in project hadoop by apache.

the class TestHttpFSServer method testDelegationTokenOperations.

@Test
@TestDir
@TestJetty
@TestHdfs
public void testDelegationTokenOperations() throws Exception {
    createHttpFSServer(true);
    URL url = new URL(TestJettyHelper.getJettyURL(), "/webhdfs/v1/?op=GETHOMEDIRECTORY");
    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
    Assert.assertEquals(HttpURLConnection.HTTP_UNAUTHORIZED, conn.getResponseCode());
    AuthenticationToken token = new AuthenticationToken("u", "p", new KerberosDelegationTokenAuthenticationHandler().getType());
    token.setExpires(System.currentTimeMillis() + 100000000);
    SignerSecretProvider secretProvider = StringSignerSecretProviderCreator.newStringSignerSecretProvider();
    Properties secretProviderProps = new Properties();
    secretProviderProps.setProperty(AuthenticationFilter.SIGNATURE_SECRET, "secret");
    secretProvider.init(secretProviderProps, null, -1);
    Signer signer = new Signer(secretProvider);
    String tokenSigned = signer.sign(token.toString());
    url = new URL(TestJettyHelper.getJettyURL(), "/webhdfs/v1/?op=GETHOMEDIRECTORY");
    conn = (HttpURLConnection) url.openConnection();
    conn.setRequestProperty("Cookie", AuthenticatedURL.AUTH_COOKIE + "=" + tokenSigned);
    Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
    url = new URL(TestJettyHelper.getJettyURL(), "/webhdfs/v1/?op=GETDELEGATIONTOKEN");
    conn = (HttpURLConnection) url.openConnection();
    conn.setRequestProperty("Cookie", AuthenticatedURL.AUTH_COOKIE + "=" + tokenSigned);
    Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
    JSONObject json = (JSONObject) new JSONParser().parse(new InputStreamReader(conn.getInputStream()));
    json = (JSONObject) json.get(DelegationTokenAuthenticator.DELEGATION_TOKEN_JSON);
    String tokenStr = (String) json.get(DelegationTokenAuthenticator.DELEGATION_TOKEN_URL_STRING_JSON);
    url = new URL(TestJettyHelper.getJettyURL(), "/webhdfs/v1/?op=GETHOMEDIRECTORY&delegation=" + tokenStr);
    conn = (HttpURLConnection) url.openConnection();
    Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
    url = new URL(TestJettyHelper.getJettyURL(), "/webhdfs/v1/?op=RENEWDELEGATIONTOKEN&token=" + tokenStr);
    conn = (HttpURLConnection) url.openConnection();
    conn.setRequestMethod("PUT");
    Assert.assertEquals(HttpURLConnection.HTTP_UNAUTHORIZED, conn.getResponseCode());
    url = new URL(TestJettyHelper.getJettyURL(), "/webhdfs/v1/?op=RENEWDELEGATIONTOKEN&token=" + tokenStr);
    conn = (HttpURLConnection) url.openConnection();
    conn.setRequestMethod("PUT");
    conn.setRequestProperty("Cookie", AuthenticatedURL.AUTH_COOKIE + "=" + tokenSigned);
    Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
    url = new URL(TestJettyHelper.getJettyURL(), "/webhdfs/v1/?op=CANCELDELEGATIONTOKEN&token=" + tokenStr);
    conn = (HttpURLConnection) url.openConnection();
    conn.setRequestMethod("PUT");
    Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
    url = new URL(TestJettyHelper.getJettyURL(), "/webhdfs/v1/?op=GETHOMEDIRECTORY&delegation=" + tokenStr);
    conn = (HttpURLConnection) url.openConnection();
    Assert.assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode());
    // getTrash test with delegation
    url = new URL(TestJettyHelper.getJettyURL(), "/webhdfs/v1/?op=GETTRASHROOT&delegation=" + tokenStr);
    conn = (HttpURLConnection) url.openConnection();
    Assert.assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode());
    url = new URL(TestJettyHelper.getJettyURL(), "/webhdfs/v1/?op=GETTRASHROOT");
    conn = (HttpURLConnection) url.openConnection();
    conn.setRequestProperty("Cookie", AuthenticatedURL.AUTH_COOKIE + "=" + tokenSigned);
    Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
}

Example 13 with AuthenticationToken

use of org.apache.hadoop.security.authentication.server.AuthenticationToken in project incubator-atlas by apache.

the class AtlasAuthenticationFilter method getToken.

@Override
protected AuthenticationToken getToken(HttpServletRequest request) throws IOException, AuthenticationException {
    AuthenticationToken token = null;
    String tokenStr = null;
    Cookie[] cookies = request.getCookies();
    if (cookies != null) {
        for (Cookie cookie : cookies) {
            if (cookie.getName().equals(AuthenticatedURL.AUTH_COOKIE)) {
                tokenStr = cookie.getValue();
                try {
                    tokenStr = this.signer.verifyAndExtract(tokenStr);
                } catch (SignerException ex) {
                    throw new AuthenticationException(ex);
                }
            }
        }
    }
    if (tokenStr != null) {
        token = AuthenticationToken.parse(tokenStr);
        if (token != null) {
            AuthenticationHandler authHandler = getAuthenticationHandler();
            if (!token.getType().equals(authHandler.getType())) {
                throw new AuthenticationException("Invalid AuthenticationToken type");
            }
            if (token.isExpired()) {
                throw new AuthenticationException("AuthenticationToken expired");
            }
        }
    }
    return token;
}