Java Code Examples for org.apache.hadoop.security.SaslRpcServer.AuthMethod#TOKEN

The following examples show how to use org.apache.hadoop.security.SaslRpcServer.AuthMethod#TOKEN . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: Server.java    From hadoop with Apache License 2.0 6 votes vote down vote up 
private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws InvalidToken, AccessControlException {
  if (authMethod == AuthMethod.TOKEN) {
    TokenIdentifier tokenId = SaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    UserGroupInformation ugi = tokenId.getUser();
    if (ugi == null) {
      throw new AccessControlException(
          "Can't retrieve username from tokenIdentifier.");
    }
    ugi.addTokenIdentifier(tokenId);
    return ugi;
  } else {
    return UserGroupInformation.createRemoteUser(authorizedId, authMethod);
  }
}
Example 2
Source File: Server.java    From hadoop with Apache License 2.0 6 votes vote down vote up 
/**
 * Authorize proxy users to access this server
 * @throws WrappedRpcServerException - user is not allowed to proxy
 */
private void authorizeConnection() throws WrappedRpcServerException {
  try {
    // If auth method is TOKEN, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (user != null && user.getRealUser() != null
        && (authMethod != AuthMethod.TOKEN)) {
      ProxyUsers.authorize(user, this.getHostAddress());
    }
    authorize(user, protocolName, getHostInetAddress());
    if (LOG.isDebugEnabled()) {
      LOG.debug("Successfully authorized " + connectionContext);
    }
    rpcMetrics.incrAuthorizationSuccesses();
  } catch (AuthorizationException ae) {
    LOG.info("Connection from " + this
        + " for protocol " + connectionContext.getProtocol()
        + " is unauthorized for user " + user);
    rpcMetrics.incrAuthorizationFailures();
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_UNAUTHORIZED, ae);
  }
}
Example 3
Source File: Server.java    From big-c with Apache License 2.0 6 votes vote down vote up 
private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws InvalidToken, AccessControlException {
  if (authMethod == AuthMethod.TOKEN) {
    TokenIdentifier tokenId = SaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    UserGroupInformation ugi = tokenId.getUser();
    if (ugi == null) {
      throw new AccessControlException(
          "Can't retrieve username from tokenIdentifier.");
    }
    ugi.addTokenIdentifier(tokenId);
    return ugi;
  } else {
    return UserGroupInformation.createRemoteUser(authorizedId, authMethod);
  }
}
Example 4
Source File: Server.java    From big-c with Apache License 2.0 6 votes vote down vote up 
/**
 * Authorize proxy users to access this server
 * @throws WrappedRpcServerException - user is not allowed to proxy
 */
private void authorizeConnection() throws WrappedRpcServerException {
  try {
    // If auth method is TOKEN, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (user != null && user.getRealUser() != null
        && (authMethod != AuthMethod.TOKEN)) {
      ProxyUsers.authorize(user, this.getHostAddress());
    }
    authorize(user, protocolName, getHostInetAddress());
    if (LOG.isDebugEnabled()) {
      LOG.debug("Successfully authorized " + connectionContext);
    }
    rpcMetrics.incrAuthorizationSuccesses();
  } catch (AuthorizationException ae) {
    LOG.info("Connection from " + this
        + " for protocol " + connectionContext.getProtocol()
        + " is unauthorized for user " + user);
    rpcMetrics.incrAuthorizationFailures();
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_UNAUTHORIZED, ae);
  }
}
Example 5
Source File: ProtoUtil.java    From hadoop with Apache License 2.0 5 votes vote down vote up 
/** 
 * This method creates the connection context  using exactly the same logic
 * as the old connection context as was done for writable where
 * the effective and real users are set based on the auth method.
 *
 */
public static IpcConnectionContextProto makeIpcConnectionContext(
    final String protocol,
    final UserGroupInformation ugi, final AuthMethod authMethod) {
  IpcConnectionContextProto.Builder result = IpcConnectionContextProto.newBuilder();
  if (protocol != null) {
    result.setProtocol(protocol);
  }
  UserInformationProto.Builder ugiProto =  UserInformationProto.newBuilder();
  if (ugi != null) {
    /*
     * In the connection context we send only additional user info that
     * is not derived from the authentication done during connection setup.
     */
    if (authMethod == AuthMethod.KERBEROS) {
      // Real user was established as part of the connection.
      // Send effective user only.
      ugiProto.setEffectiveUser(ugi.getUserName());
    } else if (authMethod == AuthMethod.TOKEN) {
      // With token, the connection itself establishes 
      // both real and effective user. Hence send none in header.
    } else {  // Simple authentication
      // No user info is established as part of the connection.
      // Send both effective user and real user
      ugiProto.setEffectiveUser(ugi.getUserName());
      if (ugi.getRealUser() != null) {
        ugiProto.setRealUser(ugi.getRealUser().getUserName());
      }
    }
  }   
  result.setUserInfo(ugiProto);
  return result.build();
}
Example 6
Source File: ProtoUtil.java    From big-c with Apache License 2.0 5 votes vote down vote up 
/** 
 * This method creates the connection context  using exactly the same logic
 * as the old connection context as was done for writable where
 * the effective and real users are set based on the auth method.
 *
 */
public static IpcConnectionContextProto makeIpcConnectionContext(
    final String protocol,
    final UserGroupInformation ugi, final AuthMethod authMethod) {
  IpcConnectionContextProto.Builder result = IpcConnectionContextProto.newBuilder();
  if (protocol != null) {
    result.setProtocol(protocol);
  }
  UserInformationProto.Builder ugiProto =  UserInformationProto.newBuilder();
  if (ugi != null) {
    /*
     * In the connection context we send only additional user info that
     * is not derived from the authentication done during connection setup.
     */
    if (authMethod == AuthMethod.KERBEROS) {
      // Real user was established as part of the connection.
      // Send effective user only.
      ugiProto.setEffectiveUser(ugi.getUserName());
    } else if (authMethod == AuthMethod.TOKEN) {
      // With token, the connection itself establishes 
      // both real and effective user. Hence send none in header.
    } else {  // Simple authentication
      // No user info is established as part of the connection.
      // Send both effective user and real user
      ugiProto.setEffectiveUser(ugi.getUserName());
      if (ugi.getRealUser() != null) {
        ugiProto.setRealUser(ugi.getRealUser().getUserName());
      }
    }
  }   
  result.setUserInfo(ugiProto);
  return result.build();
}
Example 7
Source File: Server.java    From hadoop with Apache License 2.0 4 votes vote down vote up 
private RpcSaslProto processSaslMessage(RpcSaslProto saslMessage)
    throws IOException, InterruptedException {
  final RpcSaslProto saslResponse;
  final SaslState state = saslMessage.getState(); // required      
  switch (state) {
    case NEGOTIATE: {
      if (sentNegotiate) {
        throw new AccessControlException(
            "Client already attempted negotiation");
      }
      saslResponse = buildSaslNegotiateResponse();
      // simple-only server negotiate response is success which client
      // interprets as switch to simple
      if (saslResponse.getState() == SaslState.SUCCESS) {
        switchToSimple();
      }
      break;
    }
    case INITIATE: {
      if (saslMessage.getAuthsCount() != 1) {
        throw new SaslException("Client mechanism is malformed");
      }
      // verify the client requested an advertised authType
      SaslAuth clientSaslAuth = saslMessage.getAuths(0);
      if (!negotiateResponse.getAuthsList().contains(clientSaslAuth)) {
        if (sentNegotiate) {
          throw new AccessControlException(
              clientSaslAuth.getMethod() + " authentication is not enabled."
                  + "  Available:" + enabledAuthMethods);
        }
        saslResponse = buildSaslNegotiateResponse();
        break;
      }
      authMethod = AuthMethod.valueOf(clientSaslAuth.getMethod());
      // abort SASL for SIMPLE auth, server has already ensured that
      // SIMPLE is a legit option above.  we will send no response
      if (authMethod == AuthMethod.SIMPLE) {
        switchToSimple();
        saslResponse = null;
        break;
      }
      // sasl server for tokens may already be instantiated
      if (saslServer == null || authMethod != AuthMethod.TOKEN) {
        saslServer = createSaslServer(authMethod);
      }
      saslResponse = processSaslToken(saslMessage);
      break;
    }
    case RESPONSE: {
      saslResponse = processSaslToken(saslMessage);
      break;
    }
    default:
      throw new SaslException("Client sent unsupported state " + state);
  }
  return saslResponse;
}
Example 8
Source File: Server.java    From hadoop with Apache License 2.0 4 votes vote down vote up 
/** Reads the connection context following the connection header
 * @param dis - DataInputStream from which to read the header 
 * @throws WrappedRpcServerException - if the header cannot be
 *         deserialized, or the user is not authorized
 */ 
private void processConnectionContext(DataInputStream dis)
    throws WrappedRpcServerException {
  // allow only one connection context during a session
  if (connectionContextRead) {
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_INVALID_RPC_HEADER,
        "Connection context already processed");
  }
  connectionContext = decodeProtobufFromStream(
      IpcConnectionContextProto.newBuilder(), dis);
  protocolName = connectionContext.hasProtocol() ? connectionContext
      .getProtocol() : null;

  UserGroupInformation protocolUser = ProtoUtil.getUgi(connectionContext);
  if (saslServer == null) {
    user = protocolUser;
  } else {
    // user is authenticated
    user.setAuthenticationMethod(authMethod);
    //Now we check if this is a proxy user case. If the protocol user is
    //different from the 'user', it is a proxy user scenario. However, 
    //this is not allowed if user authenticated with DIGEST.
    if ((protocolUser != null)
        && (!protocolUser.getUserName().equals(user.getUserName()))) {
      if (authMethod == AuthMethod.TOKEN) {
        // Not allowed to doAs if token authentication is used
        throw new WrappedRpcServerException(
            RpcErrorCodeProto.FATAL_UNAUTHORIZED,
            new AccessControlException("Authenticated user (" + user
                + ") doesn't match what the client claims to be ("
                + protocolUser + ")"));
      } else {
        // Effective user can be different from authenticated user
        // for simple auth or kerberos auth
        // The user is the real user. Now we create a proxy user
        UserGroupInformation realUser = user;
        user = UserGroupInformation.createProxyUser(protocolUser
            .getUserName(), realUser);
      }
    }
  }
  authorizeConnection();
  // don't set until after authz because connection isn't established
  connectionContextRead = true;
}
Example 9
Source File: Server.java    From big-c with Apache License 2.0 4 votes vote down vote up 
private RpcSaslProto processSaslMessage(RpcSaslProto saslMessage)
    throws IOException, InterruptedException {
  final RpcSaslProto saslResponse;
  final SaslState state = saslMessage.getState(); // required      
  switch (state) {
    case NEGOTIATE: {
      if (sentNegotiate) {
        throw new AccessControlException(
            "Client already attempted negotiation");
      }
      saslResponse = buildSaslNegotiateResponse();
      // simple-only server negotiate response is success which client
      // interprets as switch to simple
      if (saslResponse.getState() == SaslState.SUCCESS) {
        switchToSimple();
      }
      break;
    }
    case INITIATE: {
      if (saslMessage.getAuthsCount() != 1) {
        throw new SaslException("Client mechanism is malformed");
      }
      // verify the client requested an advertised authType
      SaslAuth clientSaslAuth = saslMessage.getAuths(0);
      if (!negotiateResponse.getAuthsList().contains(clientSaslAuth)) {
        if (sentNegotiate) {
          throw new AccessControlException(
              clientSaslAuth.getMethod() + " authentication is not enabled."
                  + "  Available:" + enabledAuthMethods);
        }
        saslResponse = buildSaslNegotiateResponse();
        break;
      }
      authMethod = AuthMethod.valueOf(clientSaslAuth.getMethod());
      // abort SASL for SIMPLE auth, server has already ensured that
      // SIMPLE is a legit option above.  we will send no response
      if (authMethod == AuthMethod.SIMPLE) {
        switchToSimple();
        saslResponse = null;
        break;
      }
      // sasl server for tokens may already be instantiated
      if (saslServer == null || authMethod != AuthMethod.TOKEN) {
        saslServer = createSaslServer(authMethod);
      }
      saslResponse = processSaslToken(saslMessage);
      break;
    }
    case RESPONSE: {
      saslResponse = processSaslToken(saslMessage);
      break;
    }
    default:
      throw new SaslException("Client sent unsupported state " + state);
  }
  return saslResponse;
}
Example 10
Source File: Server.java    From big-c with Apache License 2.0 4 votes vote down vote up 
/** Reads the connection context following the connection header
 * @param dis - DataInputStream from which to read the header 
 * @throws WrappedRpcServerException - if the header cannot be
 *         deserialized, or the user is not authorized
 */ 
private void processConnectionContext(DataInputStream dis)
    throws WrappedRpcServerException {
  // allow only one connection context during a session
  if (connectionContextRead) {
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_INVALID_RPC_HEADER,
        "Connection context already processed");
  }
  connectionContext = decodeProtobufFromStream(
      IpcConnectionContextProto.newBuilder(), dis);
  protocolName = connectionContext.hasProtocol() ? connectionContext
      .getProtocol() : null;

  UserGroupInformation protocolUser = ProtoUtil.getUgi(connectionContext);
  if (saslServer == null) {
    user = protocolUser;
  } else {
    // user is authenticated
    user.setAuthenticationMethod(authMethod);
    //Now we check if this is a proxy user case. If the protocol user is
    //different from the 'user', it is a proxy user scenario. However, 
    //this is not allowed if user authenticated with DIGEST.
    if ((protocolUser != null)
        && (!protocolUser.getUserName().equals(user.getUserName()))) {
      if (authMethod == AuthMethod.TOKEN) {
        // Not allowed to doAs if token authentication is used
        throw new WrappedRpcServerException(
            RpcErrorCodeProto.FATAL_UNAUTHORIZED,
            new AccessControlException("Authenticated user (" + user
                + ") doesn't match what the client claims to be ("
                + protocolUser + ")"));
      } else {
        // Effective user can be different from authenticated user
        // for simple auth or kerberos auth
        // The user is the real user. Now we create a proxy user
        UserGroupInformation realUser = user;
        user = UserGroupInformation.createProxyUser(protocolUser
            .getUserName(), realUser);
      }
    }
  }
  authorizeConnection();
  // don't set until after authz because connection isn't established
  connectionContextRead = true;
}