Examples with DelegationTokenCache org.apache.kafka.common.security.token.delegation.internals.DelegationTokenCache used on opensource projects

Example 1 with DelegationTokenCache

use of org.apache.kafka.common.security.token.delegation.internals.DelegationTokenCache in project kafka by apache.

the class ScramSaslServerTest method setUp.

@BeforeEach
public void setUp() throws Exception {
    mechanism = ScramMechanism.SCRAM_SHA_256;
    formatter = new ScramFormatter(mechanism);
    CredentialCache.Cache<ScramCredential> credentialCache = new CredentialCache().createCache(mechanism.mechanismName(), ScramCredential.class);
    credentialCache.put(USER_A, formatter.generateCredential("passwordA", 4096));
    credentialCache.put(USER_B, formatter.generateCredential("passwordB", 4096));
    ScramServerCallbackHandler callbackHandler = new ScramServerCallbackHandler(credentialCache, new DelegationTokenCache(ScramMechanism.mechanismNames()));
    saslServer = new ScramSaslServer(mechanism, new HashMap<String, Object>(), callbackHandler);
}

Example 2 with DelegationTokenCache

use of org.apache.kafka.common.security.token.delegation.internals.DelegationTokenCache in project kafka by apache.

the class SaslAuthenticatorTest method testTokenReauthenticationOverSaslScram.

@Test
public void testTokenReauthenticationOverSaslScram() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_SSL;
    TestJaasConfig jaasConfig = configureMechanisms("SCRAM-SHA-256", Arrays.asList("SCRAM-SHA-256"));
    // create jaas config for token auth
    Map<String, Object> options = new HashMap<>();
    String tokenId = "token1";
    String tokenHmac = "abcdefghijkl";
    // tokenId
    options.put("username", tokenId);
    // token hmac
    options.put("password", tokenHmac);
    // enable token authentication
    options.put(ScramLoginModule.TOKEN_AUTH_CONFIG, "true");
    jaasConfig.createOrUpdateEntry(TestJaasConfig.LOGIN_CONTEXT_CLIENT, ScramLoginModule.class.getName(), options);
    // ensure re-authentication based on token expiry rather than a default value
    saslServerConfigs.put(BrokerSecurityConfigs.CONNECTIONS_MAX_REAUTH_MS, Long.MAX_VALUE);
    /*
         * create a token cache that adjusts the token expiration dynamically so that
         * the first time the expiry is read during authentication we use it to define a
         * session expiration time that we can then sleep through; then the second time
         * the value is read (during re-authentication) it will be in the future.
         */
    Function<Integer, Long> tokenLifetime = callNum -> 10 * callNum * CONNECTIONS_MAX_REAUTH_MS_VALUE;
    DelegationTokenCache tokenCache = new DelegationTokenCache(ScramMechanism.mechanismNames()) {

        int callNum = 0;

        @Override
        public TokenInformation token(String tokenId) {
            TokenInformation baseTokenInfo = super.token(tokenId);
            long thisLifetimeMs = System.currentTimeMillis() + tokenLifetime.apply(++callNum).longValue();
            TokenInformation retvalTokenInfo = new TokenInformation(baseTokenInfo.tokenId(), baseTokenInfo.owner(), baseTokenInfo.renewers(), baseTokenInfo.issueTimestamp(), thisLifetimeMs, thisLifetimeMs);
            return retvalTokenInfo;
        }
    };
    server = createEchoServer(ListenerName.forSecurityProtocol(securityProtocol), securityProtocol, tokenCache);
    KafkaPrincipal owner = SecurityUtils.parseKafkaPrincipal("User:Owner");
    KafkaPrincipal renewer = SecurityUtils.parseKafkaPrincipal("User:Renewer1");
    TokenInformation tokenInfo = new TokenInformation(tokenId, owner, Collections.singleton(renewer), System.currentTimeMillis(), System.currentTimeMillis(), System.currentTimeMillis());
    server.tokenCache().addToken(tokenId, tokenInfo);
    updateTokenCredentialCache(tokenId, tokenHmac);
    // initial authentication must succeed
    createClientConnection(securityProtocol, "0");
    checkClientConnection("0");
    // ensure metrics are as expected before trying to re-authenticate
    server.verifyAuthenticationMetrics(1, 0);
    server.verifyReauthenticationMetrics(0, 0);
    /*
         * Now re-authenticate and ensure it succeeds. We have to sleep long enough so
         * that the current delegation token will be expired when the next write occurs;
         * this will trigger a re-authentication. Then the second time the delegation
         * token is read and transmitted to the server it will again have an expiration
         * date in the future.
         */
    delay(tokenLifetime.apply(1));
    checkClientConnection("0");
    server.verifyReauthenticationMetrics(1, 0);
}