Examples with KnoxJwtRealm org.apache.zeppelin.realm.jwt.KnoxJwtRealm used on opensource projects

Example 1 with KnoxJwtRealm

use of org.apache.zeppelin.realm.jwt.KnoxJwtRealm in project zeppelin by apache.

the class ShiroAuthenticationService method getAssociatedRoles.

/**
 * Return the roles associated with the authenticated user if any otherwise returns empty set.
 * TODO(prasadwagle) Find correct way to get user roles (see SHIRO-492)
 *
 * @return shiro roles
 */
@Override
public Set<String> getAssociatedRoles() {
    Subject subject = org.apache.shiro.SecurityUtils.getSubject();
    Set<String> roles = new HashSet<>();
    Map<String, String> allRoles = null;
    if (subject.isAuthenticated()) {
        Collection<Realm> realmsList = getRealmsList();
        for (Realm realm : realmsList) {
            String name = realm.getClass().getName();
            if (INI_REALM.equals(name)) {
                allRoles = ((IniRealm) realm).getIni().get("roles");
                break;
            } else if (LDAP_REALM.equals(name)) {
                try {
                    AuthorizationInfo auth = ((LdapRealm) realm).queryForAuthorizationInfo(new SimplePrincipalCollection(subject.getPrincipal(), realm.getName()), ((LdapRealm) realm).getContextFactory());
                    if (auth != null) {
                        roles = new HashSet<>(auth.getRoles());
                    }
                } catch (NamingException e) {
                    LOGGER.error("Can't fetch roles", e);
                }
                break;
            } else if (ACTIVE_DIRECTORY_GROUP_REALM.equals(name)) {
                allRoles = ((ActiveDirectoryGroupRealm) realm).getListRoles();
                break;
            } else if (realm instanceof KnoxJwtRealm) {
                roles = ((KnoxJwtRealm) realm).mapGroupPrincipals(getPrincipal());
                break;
            }
        }
        if (allRoles != null) {
            for (Map.Entry<String, String> pair : allRoles.entrySet()) {
                if (subject.hasRole(pair.getKey())) {
                    roles.add(pair.getKey());
                }
            }
        }
    }
    return roles;
}

Example 2 with KnoxJwtRealm

use of org.apache.zeppelin.realm.jwt.KnoxJwtRealm in project zeppelin by apache.

the class LoginRestApi method logout.

@POST
@Path("logout")
@ZeppelinApi
public Response logout() {
    logoutCurrentUser();
    Status status;
    Map<String, String> data = new HashMap<>();
    if (zConf.isAuthorizationHeaderClear()) {
        status = Status.UNAUTHORIZED;
        data.put("clearAuthorizationHeader", "true");
    } else {
        status = Status.FORBIDDEN;
        data.put("clearAuthorizationHeader", "false");
    }
    if (isKnoxSSOEnabled()) {
        KnoxJwtRealm knoxJwtRealm = getJTWRealm();
        data.put("redirectURL", constructUrl(knoxJwtRealm.getProviderUrl(), knoxJwtRealm.getRedirectParam(), knoxJwtRealm.getLogout()));
        data.put("isLogoutAPI", knoxJwtRealm.getLogoutAPI().toString());
    } else if (isKerberosRealmEnabled()) {
        KerberosRealm kerberosRealm = getKerberosRealm();
        data.put("redirectURL", constructUrl(kerberosRealm.getProviderUrl(), kerberosRealm.getRedirectParam(), kerberosRealm.getLogout()));
        data.put("isLogoutAPI", kerberosRealm.getLogoutAPI().toString());
    }
    JsonResponse<Map<String, String>> response = new JsonResponse<>(status, "", data);
    LOG.info(response.toString());
    return response.build();
}

Example 3 with KnoxJwtRealm

use of org.apache.zeppelin.realm.jwt.KnoxJwtRealm in project zeppelin by apache.

the class ShiroAuthenticationServiceTest method testKnoxGetRoles.

@Test
public void testKnoxGetRoles() {
    setupPrincipalName("test");
    KnoxJwtRealm realm = spy(new KnoxJwtRealm());
    LifecycleUtils.init(realm);
    Set<String> testRoles = new HashSet<String>() {

        {
            add("role1");
            add("role2");
        }
    };
    when(realm.mapGroupPrincipals("test")).thenReturn(testRoles);
    DefaultSecurityManager securityManager = new DefaultSecurityManager(realm);
    ThreadContext.bind(securityManager);
    Set<String> roles = shiroSecurityService.getAssociatedRoles();
    assertEquals(testRoles, roles);
}

Example 4 with KnoxJwtRealm

use of org.apache.zeppelin.realm.jwt.KnoxJwtRealm in project zeppelin by apache.

the class LoginRestApi method getLogin.

@GET
@ZeppelinApi
public Response getLogin(@Context HttpHeaders headers) {
    JsonResponse<Map<String, String>> response = null;
    if (isKnoxSSOEnabled()) {
        KnoxJwtRealm knoxJwtRealm = getJTWRealm();
        Cookie cookie = headers.getCookies().get(knoxJwtRealm.getCookieName());
        if (cookie != null && cookie.getValue() != null) {
            Subject currentUser = SecurityUtils.getSubject();
            JWTAuthenticationToken token = new JWTAuthenticationToken(null, cookie.getValue());
            try {
                String name = knoxJwtRealm.getName(token);
                if (!currentUser.isAuthenticated() || !currentUser.getPrincipal().equals(name)) {
                    response = proceedToLogin(currentUser, token);
                }
            } catch (ParseException e) {
                LOG.error("ParseException in LoginRestApi: ", e);
            }
        }
        if (response == null) {
            Map<String, String> data = new HashMap<>();
            data.put("redirectURL", constructUrl(knoxJwtRealm.getProviderUrl(), knoxJwtRealm.getRedirectParam(), knoxJwtRealm.getLogin()));
            response = new JsonResponse<>(Status.OK, "", data);
        }
        return response.build();
    }
    KerberosRealm kerberosRealm = getKerberosRealm();
    if (null != kerberosRealm) {
        try {
            Map<String, Cookie> cookies = headers.getCookies();
            KerberosToken kerberosToken = KerberosRealm.getKerberosTokenFromCookies(cookies);
            if (null != kerberosToken) {
                Subject currentUser = SecurityUtils.getSubject();
                String name = (String) kerberosToken.getPrincipal();
                if (!currentUser.isAuthenticated() || !currentUser.getPrincipal().equals(name)) {
                    response = proceedToLogin(currentUser, kerberosToken);
                }
            }
            if (null == response) {
                LOG.warn("No Kerberos token received");
                response = new JsonResponse<>(Status.UNAUTHORIZED, "", null);
            }
            return response.build();
        } catch (AuthenticationException e) {
            LOG.error("Error in Login", e);
        }
    }
    return new JsonResponse<>(Status.METHOD_NOT_ALLOWED).build();
}