KNOX-2020 - AWS federation support added to hadoop-jwt cookie

gateway-provider-security-aws/pom.xml

@@ -0,0 +1,149 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.apache.knox</groupId>
+        <artifactId>gateway</artifactId>
+        <version>1.4.0-SNAPSHOT</version>
+    </parent>
+
+    <artifactId>gateway-provider-security-aws</artifactId>
+    <name>gateway-provider-security-aws</name>
+    <description>Interact with AWS.</description>
+
+    <dependencies>
+
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>commons-codec</groupId>
+            <artifactId>commons-codec</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>javax.servlet</groupId>
+            <artifactId>javax.servlet-api</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>com.sun.activation</groupId>
+            <artifactId>javax.activation</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.apache.directory.server</groupId>
+            <artifactId>apacheds-jdbm</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-log4j12</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>log4j</groupId>
+            <artifactId>log4j</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.opensaml</groupId>
+            <artifactId>opensaml-core</artifactId>
+            <version>${opensaml-version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.opensaml</groupId>
+            <artifactId>opensaml-saml-api</artifactId>
+            <version>${opensaml-version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.opensaml</groupId>
+            <artifactId>opensaml-saml-impl</artifactId>
+            <version>${opensaml-version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.projectlombok</groupId>
+            <artifactId>lombok</artifactId>
+            <version>${lombok-version}</version>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>com.amazonaws</groupId>
+            <artifactId>aws-java-sdk-core</artifactId>
+            <version>${aws-sdk-version}</version>
+            <scope>compile</scope>
+        </dependency>
+
+      <dependency>
+        <groupId>com.amazonaws</groupId>
+        <artifactId>aws-java-sdk-sts</artifactId>
+        <version>1.11.562</version>
+      </dependency>
+
+        <dependency>
+            <groupId>com.google.code.gson</groupId>
+            <artifactId>gson</artifactId>
+            <version>2.8.5</version>
+            <scope>compile</scope>
+        </dependency>
+
+
+        <dependency>
+            <groupId>com.amazonaws</groupId>
+            <artifactId>aws-java-sdk-core</artifactId>
+            <version>${aws-sdk-version}</version>
+        </dependency>
+
+        <!-- ********** ********** ********** ********** ********** ********** -->
+        <!-- ********** Test Dependencies                           ********** -->
+        <!-- ********** ********** ********** ********** ********** ********** -->
+        <dependency>
+            <groupId>org.mockito</groupId>
+            <artifactId>mockito-core</artifactId>
+            <version>1.10.19</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.knox</groupId>
+            <artifactId>gateway-test-utils</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.knox</groupId>
+            <artifactId>gateway-i18n</artifactId>
+        </dependency>
+
+    </dependencies>
+</project>

gateway-provider-security-aws/src/main/java/org/apache/knox/gateway/aws/AwsConstants.java

@@ -0,0 +1,28 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.aws;
+
+/**
+ * Constants for AWS integration.
+ */
+public class AwsConstants {
+
+  public static final String AWS_COOKIE_NAME = "aws-session";
+
+  public static final String AWS_SAML_ATTRIBUTE_NAME = "https://aws.amazon.com/SAML/Attributes/Role";
+}

gateway-provider-security-aws/src/main/java/org/apache/knox/gateway/aws/AwsMessages.java

@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.aws;
+
+import org.apache.knox.gateway.i18n.messages.Message;
+import org.apache.knox.gateway.i18n.messages.MessageLevel;
+import org.apache.knox.gateway.i18n.messages.Messages;
+
+/**
+ * Logging messages for the pac4j provider.
+ *
+ * @since 0.8.0
+ */
+@Messages(logger="org.apache.knox.gateway.aws")
+public interface AwsMessages {
+
+  @Message(level = MessageLevel.DEBUG, text = "Processing SAML Response")
+  void processSamlResponse();
+
+  @Message(level = MessageLevel.DEBUG, text = "Processing AWS credentials")
+  void processAwsCredentials();
+
+  @Message(level = MessageLevel.DEBUG, text = "Processed the AWS credentials - done with SAML handler")
+  void samlHandlerDone();
+}

gateway-provider-security-aws/src/main/java/org/apache/knox/gateway/aws/AwsSamlException.java

@@ -0,0 +1,36 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p/>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p/>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.aws;
+
+/**
+ * The exceptions thrown when processing SAML Response to federate into AWS.
+ */
+public class AwsSamlException extends Exception {
+
+  public AwsSamlException(Exception e) {
+    super(e);
+  }
+
+  public AwsSamlException(String message, Exception e) {
+    super(message, e);
+  }
+
+  public AwsSamlException(String message) {
+    super(message);
+  }
+}

gateway-provider-security-aws/src/main/java/org/apache/knox/gateway/aws/AwsSamlHandler.java

@@ -0,0 +1,77 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.aws;
+
+import javax.servlet.FilterConfig;
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import lombok.AllArgsConstructor;
+import lombok.NonNull;
+import org.apache.knox.gateway.aws.model.AwsSamlCredentials;
+import org.apache.knox.gateway.aws.utils.SamlUtils;
+import org.apache.knox.gateway.i18n.messages.MessagesFactory;
+
+/**
+ * Interceptor for AWS federation using SAML.
+ */
+@AllArgsConstructor
+public class AwsSamlHandler {
+
+  public static final String AWS_SAML_FEDERATION_ENABLED = "saml.aws.federation.enabled";
+
+  private static AwsMessages log = MessagesFactory.get(AwsMessages.class);
+
+  @NonNull
+  private FilterConfig filterConfig;
+
+  @NonNull
+  private AwsSamlInvoker awsSamlInvoker;
+
+  public AwsSamlHandler(FilterConfig filterConfig) {
+    this(filterConfig, AwsSamlInvokerFactory.getAwsSamlInvoker(filterConfig));
+  }
+
+  /**
+   * Processes the {@code request} and adds {@link Cookie} containing AWS credentials to {@code
+   * response}.
+   * <p>
+   * SAML Response in {@code request} is used to get the AWS credentials. The response is unchanged
+   * if there is no SAML Response in {@code request}.
+   *
+   * @param request the request object
+   * @param response the response object
+   * @param domain the domain for server
+   * @throws AwsSamlException if processing the {@code request} is not successful
+   */
+  public void processSamlResponse(@NonNull HttpServletRequest request,
+      @NonNull HttpServletResponse response, String domain)
+      throws AwsSamlException {
+    String samlResponse = request.getParameter(SamlUtils.SAML_RESPONSE);
+    Boolean awsFederationEnabled = Boolean.valueOf(filterConfig.getInitParameter
+        (AWS_SAML_FEDERATION_ENABLED));
+    if (awsFederationEnabled && samlResponse != null) {
+      log.processSamlResponse();
+      awsSamlInvoker.init(filterConfig);
+      AwsSamlCredentials awsSamlCredentials = awsSamlInvoker.getAwsCredentials(samlResponse);
+      log.processAwsCredentials();
+      awsSamlInvoker.processAwsCredentials(awsSamlCredentials, request, response, domain);
+      log.samlHandlerDone();
+    }
+  }
+}

gateway-provider-security-aws/src/main/java/org/apache/knox/gateway/aws/AwsSamlInvoker.java

@@ -0,0 +1,56 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p/>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p/>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.aws;
+
+import javax.servlet.FilterConfig;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.apache.knox.gateway.aws.model.AwsSamlCredentials;
+
+/**
+ * Defines the interactions with AWS using a SAML Response.
+ */
+public interface AwsSamlInvoker {
+
+  /**
+   * Initializes the implementation.
+   *
+   * @param filterConfig the config used internally by {@link org.apache.knox.gateway.pac4j.filter.Pac4jDispatcherFilter}
+   */
+  void init(FilterConfig filterConfig);
+
+  /**
+   * Fetches AWS credentials using a SAML Response.
+   *
+   * @param samlResponse the SAML Response received from an Identity provider
+   * @return {@link AwsSamlCredentials} that encapsulates credentials received from AWS
+   * @throws AwsSamlException if AWS credentials cannot be fetched using the {@code samlResponse}
+   */
+  AwsSamlCredentials getAwsCredentials(String samlResponse) throws AwsSamlException;
+
+  /**
+   * Processes the AWS credentials obtained from SAML federation.
+   *
+   * @param awsSamlCredentials the AWS credentials obtained using SAML federation
+   * @param request the HTTP request object
+   * @param response the HTTP response object
+   * @param  domain the inferred domain for the server
+   */
+  void processAwsCredentials(AwsSamlCredentials awsSamlCredentials, HttpServletRequest request,
+      HttpServletResponse response, String domain) throws AwsSamlException;
+}