Examples with WorkerTokenAuthorizer org.apache.storm.security.auth.workertoken.WorkerTokenAuthorizer used on opensource projects

Example 1 with WorkerTokenAuthorizer

use of org.apache.storm.security.auth.workertoken.WorkerTokenAuthorizer in project storm by apache.

the class KerberosSaslTransportPlugin method getServerTransportFactory.

@Override
public TTransportFactory getServerTransportFactory(boolean impersonationAllowed) throws IOException {
    if (workerTokenAuthorizer == null) {
        workerTokenAuthorizer = new WorkerTokenAuthorizer(conf, type);
    }
    // create an authentication callback handler
    CallbackHandler serverCallbackHandler = new ServerCallbackHandler(conf, impersonationAllowed);
    String jaasConfFile = ClientAuthUtils.getJaasConf(conf);
    // login our principal
    Subject subject = null;
    try {
        // now login
        Login login = new Login(ClientAuthUtils.LOGIN_CONTEXT_SERVER, serverCallbackHandler, jaasConfFile);
        subject = login.getSubject();
        login.startThreadIfNeeded();
    } catch (LoginException ex) {
        LOG.error("Server failed to login in principal:" + ex, ex);
        throw new RuntimeException(ex);
    }
    // check the credential of our principal
    if (subject.getPrivateCredentials(KerberosTicket.class).isEmpty()) {
        throw new RuntimeException("Fail to verify user principal with section \"" + ClientAuthUtils.LOGIN_CONTEXT_SERVER + "\" in login configuration file " + jaasConfFile);
    }
    String principal = ClientAuthUtils.get(conf, ClientAuthUtils.LOGIN_CONTEXT_SERVER, "principal");
    LOG.debug("principal:" + principal);
    KerberosName serviceKerberosName = new KerberosName(principal);
    String serviceName = serviceKerberosName.getServiceName();
    String hostName = serviceKerberosName.getHostName();
    Map<String, String> props = new TreeMap<>();
    props.put(Sasl.QOP, "auth");
    props.put(Sasl.SERVER_AUTH, "false");
    // create a transport factory that will invoke our auth callback for digest
    TSaslServerTransport.Factory factory = new TSaslServerTransport.Factory();
    factory.addServerDefinition(KERBEROS, serviceName, hostName, props, serverCallbackHandler);
    // Also add in support for worker tokens
    factory.addServerDefinition(DIGEST, ClientAuthUtils.SERVICE, hostName, null, new SimpleSaslServerCallbackHandler(impersonationAllowed, workerTokenAuthorizer));
    // create a wrap transport factory so that we could apply user credential during connections
    TUGIAssumingTransportFactory wrapFactory = new TUGIAssumingTransportFactory(factory, subject);
    LOG.info("SASL GSSAPI transport factory will be used");
    return wrapFactory;
}

Example 2 with WorkerTokenAuthorizer

use of org.apache.storm.security.auth.workertoken.WorkerTokenAuthorizer in project storm by apache.

the class DigestSaslTransportPlugin method getServerTransportFactory.

@Override
protected TTransportFactory getServerTransportFactory(boolean impersonationAllowed) throws IOException {
    if (workerTokenAuthorizer == null) {
        workerTokenAuthorizer = new WorkerTokenAuthorizer(conf, type);
    }
    // create an authentication callback handler
    CallbackHandler serverCallbackHandler = new SimpleSaslServerCallbackHandler(impersonationAllowed, workerTokenAuthorizer, new JassPasswordProvider(conf));
    // create a transport factory that will invoke our auth callback for digest
    TSaslServerTransport.Factory factory = new TSaslServerTransport.Factory();
    factory.addServerDefinition(DIGEST, ClientAuthUtils.SERVICE, "localhost", null, serverCallbackHandler);
    LOG.info("SASL DIGEST-MD5 transport factory will be used");
    return factory;
}