Skip to content

Commit

Permalink
more test cases for authentication/authorization added
Browse files Browse the repository at this point in the history
  • Loading branch information
afeng committed Feb 17, 2013
1 parent 2847f41 commit 1e24e9f
Show file tree
Hide file tree
Showing 9 changed files with 614 additions and 546 deletions.
45 changes: 25 additions & 20 deletions src/jvm/backtype/storm/security/auth/AuthUtils.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,29 +7,34 @@
import java.io.IOException;

public class AuthUtils {
public static String LoginContextServer = "StormServer";
public static String LoginContextClient = "StormClient";
public static final String DIGEST = "DIGEST-MD5";
public static final String ANONYMOUS = "ANONYMOUS";
public static final String KERBEROS = "GSSAPI";
public static final String SERVICE = "storm_thrift_server";
private static final Logger LOG = LoggerFactory.getLogger(AuthUtils.class);
public static String LoginContextServer = "StormServer";
public static String LoginContextClient = "StormClient";
public static final String DIGEST = "DIGEST-MD5";
public static final String ANONYMOUS = "ANONYMOUS";
public static final String KERBEROS = "GSSAPI";
public static final String SERVICE = "storm_thrift_server";
private static final Logger LOG = LoggerFactory.getLogger(AuthUtils.class);


public static String get(Configuration configuration, String section, String key) throws IOException {
AppConfigurationEntry configurationEntries[] = configuration.getAppConfigurationEntry(section);
if (configurationEntries == null) {
String errorMessage = "Could not find a '"+ section + "' entry in this configuration.";
LOG.error(errorMessage);
throw new IOException(errorMessage);
public static synchronized Configuration getConfiguration(String loginConfigurationFile) {
Configuration.setConfiguration(null);
System.setProperty("java.security.auth.login.config", loginConfigurationFile);
return Configuration.getConfiguration();
}

for(AppConfigurationEntry entry: configurationEntries) {
Object val = entry.getOptions().get(key);
if (val != null)
return (String)val;
public static String get(Configuration configuration, String section, String key) throws IOException {
AppConfigurationEntry configurationEntries[] = configuration.getAppConfigurationEntry(section);
if (configurationEntries == null) {
String errorMessage = "Could not find a '"+ section + "' entry in this configuration.";
LOG.error(errorMessage);
throw new IOException(errorMessage);
}

for(AppConfigurationEntry entry: configurationEntries) {
Object val = entry.getOptions().get(key);
if (val != null)
return (String)val;
}
return null;
}
return null;
}
}

160 changes: 80 additions & 80 deletions src/jvm/backtype/storm/security/auth/SaslClientCallbackHandler.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,90 +18,90 @@
* SASL client side callback handler.
*/
public class SaslClientCallbackHandler implements CallbackHandler {
private static final String USERNAME = "username";
private static final String PASSWORD = "password";
private static final Logger LOG = LoggerFactory.getLogger(SaslClientCallbackHandler.class);
private String _username = null;
private String _password = null;
private static final String USERNAME = "username";
private static final String PASSWORD = "password";
private static final Logger LOG = LoggerFactory.getLogger(SaslClientCallbackHandler.class);
private String _username = null;
private String _password = null;

/**
* Constructor based on a JAAS configuration
*
* For digest, you should have a pair of user name and password defined in this figgure.
*
* @param configuration
* @throws IOException
*/
public SaslClientCallbackHandler(Configuration configuration) throws IOException {
if (configuration == null) return;
AppConfigurationEntry configurationEntries[] = configuration.getAppConfigurationEntry(AuthUtils.LoginContextClient);
if (configurationEntries == null) {
String errorMessage = "Could not find a '"+AuthUtils.LoginContextClient
+ "' entry in this configuration: Client cannot start.";
LOG.error(errorMessage);
throw new IOException(errorMessage);
}
/**
* Constructor based on a JAAS configuration
*
* For digest, you should have a pair of user name and password defined in this figgure.
*
* @param configuration
* @throws IOException
*/
public SaslClientCallbackHandler(Configuration configuration) throws IOException {
if (configuration == null) return;
AppConfigurationEntry configurationEntries[] = configuration.getAppConfigurationEntry(AuthUtils.LoginContextClient);
if (configurationEntries == null) {
String errorMessage = "Could not find a '"+AuthUtils.LoginContextClient
+ "' entry in this configuration: Client cannot start.";
LOG.error(errorMessage);
throw new IOException(errorMessage);
}

for(AppConfigurationEntry entry: configurationEntries) {
if (entry.getOptions().get(USERNAME) != null) {
_username = (String)entry.getOptions().get(USERNAME);
}
if (entry.getOptions().get(PASSWORD) != null) {
_password = (String)entry.getOptions().get(PASSWORD);
}
for(AppConfigurationEntry entry: configurationEntries) {
if (entry.getOptions().get(USERNAME) != null) {
_username = (String)entry.getOptions().get(USERNAME);
}
if (entry.getOptions().get(PASSWORD) != null) {
_password = (String)entry.getOptions().get(PASSWORD);
}
}
}
}

/**
* This method is invoked by SASL for authentication challenges
* @param callbacks a collection of challenge callbacks
*/
public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
for (Callback c : callbacks) {
if (c instanceof NameCallback) {
LOG.debug("name callback");
NameCallback nc = (NameCallback) c;
nc.setName(_username);
} else if (c instanceof PasswordCallback) {
LOG.debug("pwd callback");
PasswordCallback pc = (PasswordCallback)c;
if (_password != null) {
pc.setPassword(_password.toCharArray());
} else {
LOG.warn("Could not login: the client is being asked for a password, but the " +
" client code does not currently support obtaining a password from the user." +
" Make sure that the client is configured to use a ticket cache (using" +
" the JAAS configuration setting 'useTicketCache=true)' and restart the client. If" +
" you still get this message after that, the TGT in the ticket cache has expired and must" +
" be manually refreshed. To do so, first determine if you are using a password or a" +
" keytab. If the former, run kinit in a Unix shell in the environment of the user who" +
" is running this client using the command" +
" 'kinit <princ>' (where <princ> is the name of the client's Kerberos principal)." +
" If the latter, do" +
" 'kinit -k -t <keytab> <princ>' (where <princ> is the name of the Kerberos principal, and" +
" <keytab> is the location of the keytab file). After manually refreshing your cache," +
" restart this client. If you continue to see this message after manually refreshing" +
" your cache, ensure that your KDC host's clock is in sync with this host's clock.");
}
} else if (c instanceof AuthorizeCallback) {
LOG.debug("authorization callback");
AuthorizeCallback ac = (AuthorizeCallback) c;
String authid = ac.getAuthenticationID();
String authzid = ac.getAuthorizationID();
if (authid.equals(authzid)) {
ac.setAuthorized(true);
} else {
ac.setAuthorized(false);
}
if (ac.isAuthorized()) {
ac.setAuthorizedID(authzid);
/**
* This method is invoked by SASL for authentication challenges
* @param callbacks a collection of challenge callbacks
*/
public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
for (Callback c : callbacks) {
if (c instanceof NameCallback) {
LOG.debug("name callback");
NameCallback nc = (NameCallback) c;
nc.setName(_username);
} else if (c instanceof PasswordCallback) {
LOG.debug("password callback");
PasswordCallback pc = (PasswordCallback)c;
if (_password != null) {
pc.setPassword(_password.toCharArray());
} else {
LOG.warn("Could not login: the client is being asked for a password, but the " +
" client code does not currently support obtaining a password from the user." +
" Make sure that the client is configured to use a ticket cache (using" +
" the JAAS configuration setting 'useTicketCache=true)' and restart the client. If" +
" you still get this message after that, the TGT in the ticket cache has expired and must" +
" be manually refreshed. To do so, first determine if you are using a password or a" +
" keytab. If the former, run kinit in a Unix shell in the environment of the user who" +
" is running this client using the command" +
" 'kinit <princ>' (where <princ> is the name of the client's Kerberos principal)." +
" If the latter, do" +
" 'kinit -k -t <keytab> <princ>' (where <princ> is the name of the Kerberos principal, and" +
" <keytab> is the location of the keytab file). After manually refreshing your cache," +
" restart this client. If you continue to see this message after manually refreshing" +
" your cache, ensure that your KDC host's clock is in sync with this host's clock.");
}
} else if (c instanceof AuthorizeCallback) {
LOG.debug("authorization callback");
AuthorizeCallback ac = (AuthorizeCallback) c;
String authid = ac.getAuthenticationID();
String authzid = ac.getAuthorizationID();
if (authid.equals(authzid)) {
ac.setAuthorized(true);
} else {
ac.setAuthorized(false);
}
if (ac.isAuthorized()) {
ac.setAuthorizedID(authzid);
}
} else if (c instanceof RealmCallback) {
RealmCallback rc = (RealmCallback) c;
((RealmCallback) c).setText(rc.getDefaultText());
} else {
throw new UnsupportedCallbackException(c);
}
}
} else if (c instanceof RealmCallback) {
RealmCallback rc = (RealmCallback) c;
((RealmCallback) c).setText(rc.getDefaultText());
} else {
throw new UnsupportedCallbackException(c);
}
}
}
}
Loading

0 comments on commit 1e24e9f

Please sign in to comment.