Examples with SaslExtensions org.apache.kafka.common.security.auth.SaslExtensions used on opensource projects

Example 6 with SaslExtensions

use of org.apache.kafka.common.security.auth.SaslExtensions in project kafka by apache.

the class OAuthBearerExtensionsValidatorCallbackTest method testInvalidExtensionsAndErrorMessagesAreReturned.

@Test
public void testInvalidExtensionsAndErrorMessagesAreReturned() {
    Map<String, String> extensions = new HashMap<>();
    extensions.put("hello", "bye");
    OAuthBearerExtensionsValidatorCallback callback = new OAuthBearerExtensionsValidatorCallback(TOKEN, new SaslExtensions(extensions));
    assertTrue(callback.validatedExtensions().isEmpty());
    assertTrue(callback.invalidExtensions().isEmpty());
    callback.error("hello", "error");
    assertFalse(callback.invalidExtensions().isEmpty());
    assertEquals("error", callback.invalidExtensions().get("hello"));
    assertTrue(callback.validatedExtensions().isEmpty());
}

Example 7 with SaslExtensions

use of org.apache.kafka.common.security.auth.SaslExtensions in project kafka by apache.

the class OAuthBearerExtensionsValidatorCallbackTest method testValidatedExtensionsAreReturned.

@Test
public void testValidatedExtensionsAreReturned() {
    Map<String, String> extensions = new HashMap<>();
    extensions.put("hello", "bye");
    OAuthBearerExtensionsValidatorCallback callback = new OAuthBearerExtensionsValidatorCallback(TOKEN, new SaslExtensions(extensions));
    assertTrue(callback.validatedExtensions().isEmpty());
    assertTrue(callback.invalidExtensions().isEmpty());
    callback.valid("hello");
    assertFalse(callback.validatedExtensions().isEmpty());
    assertEquals("bye", callback.validatedExtensions().get("hello"));
    assertTrue(callback.invalidExtensions().isEmpty());
}

Example 8 with SaslExtensions

use of org.apache.kafka.common.security.auth.SaslExtensions in project kafka by apache.

the class OAuthBearerSaslClientTest method testNoExtensionsDoesNotAttachAnythingToFirstClientMessage.

@Test
public void testNoExtensionsDoesNotAttachAnythingToFirstClientMessage() throws Exception {
    TEST_PROPERTIES.clear();
    testExtensions = new SaslExtensions(TEST_PROPERTIES);
    String expectedToken = new String(new OAuthBearerClientInitialResponse("", new SaslExtensions(TEST_PROPERTIES)).toBytes(), StandardCharsets.UTF_8);
    OAuthBearerSaslClient client = new OAuthBearerSaslClient(new ExtensionsCallbackHandler(false));
    String message = new String(client.evaluateChallenge("".getBytes()), StandardCharsets.UTF_8);
    assertEquals(expectedToken, message);
}

Example 9 with SaslExtensions

use of org.apache.kafka.common.security.auth.SaslExtensions in project kafka by apache.

the class OAuthBearerSaslClientCallbackHandler method handleCallback.

/**
 * Attaches the first {@link SaslExtensions} found in the public credentials of the Subject
 */
private static void handleCallback(SaslExtensionsCallback extensionsCallback, Subject subject) {
    if (subject != null && !subject.getPublicCredentials(SaslExtensions.class).isEmpty()) {
        SaslExtensions extensions = subject.getPublicCredentials(SaslExtensions.class).iterator().next();
        extensionsCallback.extensions(extensions);
    }
}

Example 10 with SaslExtensions

use of org.apache.kafka.common.security.auth.SaslExtensions in project kafka by apache.

the class OAuthBearerSaslServer method process.

private byte[] process(String tokenValue, String authorizationId, SaslExtensions extensions) throws SaslException {
    OAuthBearerValidatorCallback callback = new OAuthBearerValidatorCallback(tokenValue);
    try {
        callbackHandler.handle(new Callback[] { callback });
    } catch (IOException | UnsupportedCallbackException e) {
        handleCallbackError(e);
    }
    OAuthBearerToken token = callback.token();
    if (token == null) {
        errorMessage = jsonErrorResponse(callback.errorStatus(), callback.errorScope(), callback.errorOpenIDConfiguration());
        log.debug(errorMessage);
        return errorMessage.getBytes(StandardCharsets.UTF_8);
    }
    /*
         * We support the client specifying an authorization ID as per the SASL
         * specification, but it must match the principal name if it is specified.
         */
    if (!authorizationId.isEmpty() && !authorizationId.equals(token.principalName()))
        throw new SaslAuthenticationException(String.format("Authentication failed: Client requested an authorization id (%s) that is different from the token's principal name (%s)", authorizationId, token.principalName()));
    Map<String, String> validExtensions = processExtensions(token, extensions);
    tokenForNegotiatedProperty = token;
    this.extensions = new SaslExtensions(validExtensions);
    complete = true;
    log.debug("Successfully authenticate User={}", token.principalName());
    return new byte[0];
}