Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

QPID-8529:[Broker-J]set subject on non authenticated http requests #89

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

QPID-8529:[Broker-J]set subject on non authenticated http requests #89

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 19 additions & 15 deletions ...rc/main/java/org/apache/qpid/server/security/auth/manager/AuthenticationResultCacher.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,23 +115,27 @@ private String digestCredentials(final String... content)
MessageDigest md = MessageDigest.getInstance("SHA-256");

Subject subject = Subject.getSubject(AccessController.getContext());
Set<SocketConnectionPrincipal> connectionPrincipals = subject.getPrincipals(SocketConnectionPrincipal.class);
if (connectionPrincipals != null && !connectionPrincipals.isEmpty())
if (subject != null)
{
SocketConnectionPrincipal connectionPrincipal = connectionPrincipals.iterator().next();
SocketAddress remoteAddress = connectionPrincipal.getRemoteAddress();
String address;
if (remoteAddress instanceof InetSocketAddress)
Set<SocketConnectionPrincipal> connectionPrincipals =
subject.getPrincipals(SocketConnectionPrincipal.class);
if (!connectionPrincipals.isEmpty())
{
address = ((InetSocketAddress) remoteAddress).getHostString();
}
else
{
address = remoteAddress.toString();
}
if (address != null)
{
md.update(address.getBytes(UTF8));
SocketConnectionPrincipal connectionPrincipal = connectionPrincipals.iterator().next();
SocketAddress remoteAddress = connectionPrincipal.getRemoteAddress();
String address;
if (remoteAddress instanceof InetSocketAddress)
{
address = ((InetSocketAddress) remoteAddress).getHostString();
}
else
{
address = remoteAddress.toString();
}
if (address != null)
{
md.update(address.getBytes(UTF8));
}
}
}

Expand Down
13 changes: 13 additions & 0 deletions ...est/java/org/apache/qpid/server/security/auth/manager/AuthenticationResultCacherTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,19 @@ public void testCacheHitDifferentRemoteAddressPorts() throws Exception
assertGetOrLoad(credentials, expectedResult, expectedHitCount);
}

@Test
public void testCacheHitNoSubject()
{
final String credentials = "credentials";
final AuthenticationResult result1 = _authenticationResultCacher.getOrLoad(new String[]{credentials}, _loader);
assertEquals("Unexpected AuthenticationResult", _successfulAuthenticationResult, result1);
assertEquals("Unexpected number of loads before cache hit", 1, _loadCallCount);

final AuthenticationResult result2 = _authenticationResultCacher.getOrLoad(new String[]{credentials}, _loader);
assertEquals("Unexpected AuthenticationResult", _successfulAuthenticationResult, result2);
assertEquals("Unexpected number of loads before cache hit", 1, _loadCallCount);
}

private void assertGetOrLoad(final String credentials,
final AuthenticationResult expectedResult,
final int expectedHitCount)
Expand Down
27 changes: 26 additions & 1 deletion ...java/org/apache/qpid/server/management/plugin/filter/InteractiveAuthenticationFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,9 @@
package org.apache.qpid.server.management.plugin.filter;

import java.io.IOException;
import java.security.Principal;
import java.security.PrivilegedActionException;
import java.security.PrivilegedExceptionAction;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
Expand All @@ -40,6 +43,7 @@
import org.apache.qpid.server.management.plugin.HttpManagementConfiguration;
import org.apache.qpid.server.management.plugin.HttpManagementUtil;
import org.apache.qpid.server.management.plugin.HttpRequestInteractiveAuthenticator;
import org.apache.qpid.server.management.plugin.servlet.ServletConnectionPrincipal;
import org.apache.qpid.server.plugin.QpidServiceLoader;
import org.apache.qpid.server.security.auth.AuthenticatedPrincipal;

Expand Down Expand Up @@ -96,7 +100,7 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha

if(handler != null)
{
handler.handleAuthentication(httpResponse);
invokeAuthenticationHandler(httpRequest, httpResponse, handler);
}
else
{
Expand All @@ -105,4 +109,25 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
}
}

private void invokeAuthenticationHandler(final HttpServletRequest httpRequest,
final HttpServletResponse httpResponse,
final HttpRequestInteractiveAuthenticator.AuthenticationHandler handler)
throws ServletException
{
final Subject tempSubject = new Subject(true,
Collections.<Principal>singleton(new ServletConnectionPrincipal(httpRequest)),
Collections.emptySet(),
Collections.emptySet());
try
{
Subject.doAs(tempSubject, (PrivilegedExceptionAction<Void>) () -> {
handler.handleAuthentication(httpResponse);
return null;
});
}
catch (PrivilegedActionException e)
{
throw new ServletException(e);
}
}
}