Java RpcErrorCodeProto.FATAL_UNAUTHORIZED属性代码示例

/**
 * Authorize proxy users to access this server
 * @throws WrappedRpcServerException - user is not allowed to proxy
 */
private void authorizeConnection() throws WrappedRpcServerException {
  try {
    // If auth method is TOKEN, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (user != null && user.getRealUser() != null
        && (authMethod != AuthMethod.TOKEN)) {
      ProxyUsers.authorize(user, this.getHostAddress());
    }
    authorize(user, protocolName, getHostInetAddress());
    if (LOG.isDebugEnabled()) {
      LOG.debug("Successfully authorized " + connectionContext);
    }
    rpcMetrics.incrAuthorizationSuccesses();
  } catch (AuthorizationException ae) {
    LOG.info("Connection from " + this
        + " for protocol " + connectionContext.getProtocol()
        + " is unauthorized for user " + user);
    rpcMetrics.incrAuthorizationFailures();
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_UNAUTHORIZED, ae);
  }
}
 

/**
 * Authorize proxy users to access this server
 * @throws WrappedRpcServerException - user is not allowed to proxy
 */
private void authorizeConnection() throws WrappedRpcServerException {
  try {
    // If auth method is TOKEN, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (user != null && user.getRealUser() != null
        && (authMethod != AuthMethod.TOKEN)) {
      ProxyUsers.authorize(user, this.getHostAddress(), conf);
    }
    authorize(user, protocolName, getHostInetAddress());
    if (LOG.isDebugEnabled()) {
      LOG.debug("Successfully authorized " + connectionContext);
    }
    rpcMetrics.incrAuthorizationSuccesses();
  } catch (AuthorizationException ae) {
    LOG.info("Connection from " + this
        + " for protocol " + connectionContext.getProtocol()
        + " is unauthorized for user " + user);
    rpcMetrics.incrAuthorizationFailures();
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_UNAUTHORIZED, ae);
  }
}
 

/**
 * Authorize proxy users to access this server
 * @throws RpcServerException - user is not allowed to proxy
 */
private void authorizeConnection() throws RpcServerException {
  try {
    // If auth method is TOKEN, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (user != null && user.getRealUser() != null
        && (authMethod != AuthMethod.TOKEN)) {
      ProxyUsers.authorize(user, this.getHostAddress());
    }
    authorize(user, protocolName, getHostInetAddress());
    if (LOG.isDebugEnabled()) {
      LOG.debug("Successfully authorized " + connectionContext);
    }
    rpcMetrics.incrAuthorizationSuccesses();
  } catch (AuthorizationException ae) {
    LOG.info("Connection from " + this
        + " for protocol " + connectionContext.getProtocol()
        + " is unauthorized for user " + user);
    rpcMetrics.incrAuthorizationFailures();
    throw new FatalRpcServerException(
        RpcErrorCodeProto.FATAL_UNAUTHORIZED, ae);
  }
}
 

/**
 * Process saslMessage and send saslResponse back
 * @param saslMessage received SASL message
 * @throws WrappedRpcServerException setup failed due to SASL negotiation 
 *         failure, premature or invalid connection context, or other state 
 *         errors. This exception needs to be sent to the client. This 
 *         exception will wrap {@link RetriableException}, 
 *         {@link InvalidToken}, {@link StandbyException} or 
 *         {@link SaslException}.
 * @throws IOException if sending reply fails
 * @throws InterruptedException
 */
private void saslProcess(RpcSaslProto saslMessage)
    throws WrappedRpcServerException, IOException, InterruptedException {
  if (saslContextEstablished) {
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_INVALID_RPC_HEADER,
        new SaslException("Negotiation is already complete"));
  }
  RpcSaslProto saslResponse = null;
  try {
    try {
      saslResponse = processSaslMessage(saslMessage);
    } catch (IOException e) {
      rpcMetrics.incrAuthenticationFailures();
      if (LOG.isDebugEnabled()) {
        LOG.debug(StringUtils.stringifyException(e));
      }
      // attempting user could be null
      IOException tce = (IOException) getTrueCause(e);
      AUDITLOG.warn(AUTH_FAILED_FOR + this.toString() + ":"
          + attemptingUser + " (" + e.getLocalizedMessage()
          + ") with true cause: (" + tce.getLocalizedMessage() + ")");
      throw tce;
    }
    
    if (saslServer != null && saslServer.isComplete()) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("SASL server context established. Negotiated QoP is "
            + saslServer.getNegotiatedProperty(Sasl.QOP));
      }
      user = getAuthorizedUgi(saslServer.getAuthorizationID());
      if (LOG.isDebugEnabled()) {
        LOG.debug("SASL server successfully authenticated client: " + user);
      }
      rpcMetrics.incrAuthenticationSuccesses();
      AUDITLOG.info(AUTH_SUCCESSFUL_FOR + user);
      saslContextEstablished = true;
    }
  } catch (WrappedRpcServerException wrse) { // don't re-wrap
    throw wrse;
  } catch (IOException ioe) {
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_UNAUTHORIZED, ioe);
  }
  // send back response if any, may throw IOException
  if (saslResponse != null) {
    doSaslReply(saslResponse);
  }
  // do NOT enable wrapping until the last auth response is sent
  if (saslContextEstablished) {
    String qop = (String) saslServer.getNegotiatedProperty(Sasl.QOP);
    // SASL wrapping is only used if the connection has a QOP, and
    // the value is not auth.  ex. auth-int & auth-priv
    useWrap = (qop != null && !"auth".equalsIgnoreCase(qop));        
  }
}
 

/** Reads the connection context following the connection header
 * @param dis - DataInputStream from which to read the header 
 * @throws WrappedRpcServerException - if the header cannot be
 *         deserialized, or the user is not authorized
 */ 
private void processConnectionContext(DataInputStream dis)
    throws WrappedRpcServerException {
  // allow only one connection context during a session
  if (connectionContextRead) {
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_INVALID_RPC_HEADER,
        "Connection context already processed");
  }
  connectionContext = decodeProtobufFromStream(
      IpcConnectionContextProto.newBuilder(), dis);
  protocolName = connectionContext.hasProtocol() ? connectionContext
      .getProtocol() : null;

  UserGroupInformation protocolUser = ProtoUtil.getUgi(connectionContext);
  if (saslServer == null) {
    user = protocolUser;
  } else {
    // user is authenticated
    user.setAuthenticationMethod(authMethod);
    //Now we check if this is a proxy user case. If the protocol user is
    //different from the 'user', it is a proxy user scenario. However, 
    //this is not allowed if user authenticated with DIGEST.
    if ((protocolUser != null)
        && (!protocolUser.getUserName().equals(user.getUserName()))) {
      if (authMethod == AuthMethod.TOKEN) {
        // Not allowed to doAs if token authentication is used
        throw new WrappedRpcServerException(
            RpcErrorCodeProto.FATAL_UNAUTHORIZED,
            new AccessControlException("Authenticated user (" + user
                + ") doesn't match what the client claims to be ("
                + protocolUser + ")"));
      } else {
        // Effective user can be different from authenticated user
        // for simple auth or kerberos auth
        // The user is the real user. Now we create a proxy user
        UserGroupInformation realUser = user;
        user = UserGroupInformation.createProxyUser(protocolUser
            .getUserName(), realUser);
      }
    }
  }
  authorizeConnection();
  // don't set until after authz because connection isn't established
  connectionContextRead = true;
}
 

private void saslProcess(RpcSaslProto saslMessage)
    throws WrappedRpcServerException, IOException, InterruptedException {
  if (saslContextEstablished) {
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_INVALID_RPC_HEADER,
        new SaslException("Negotiation is already complete"));
  }
  RpcSaslProto saslResponse = null;
  try {
    try {
      saslResponse = processSaslMessage(saslMessage);
    } catch (IOException e) {
      rpcMetrics.incrAuthenticationFailures();
      // attempting user could be null
      AUDITLOG.warn(AUTH_FAILED_FOR + this.toString() + ":"
          + attemptingUser + " (" + e.getLocalizedMessage() + ")");
      throw (IOException) getCauseForInvalidToken(e);
    }
    
    if (saslServer != null && saslServer.isComplete()) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("SASL server context established. Negotiated QoP is "
            + saslServer.getNegotiatedProperty(Sasl.QOP));
      }
      user = getAuthorizedUgi(saslServer.getAuthorizationID());
      if (LOG.isDebugEnabled()) {
        LOG.debug("SASL server successfully authenticated client: " + user);
      }
      rpcMetrics.incrAuthenticationSuccesses();
      AUDITLOG.info(AUTH_SUCCESSFUL_FOR + user);
      saslContextEstablished = true;
    }
  } catch (WrappedRpcServerException wrse) { // don't re-wrap
    throw wrse;
  } catch (IOException ioe) {
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_UNAUTHORIZED, ioe);
  }
  // send back response if any, may throw IOException
  if (saslResponse != null) {
    doSaslReply(saslResponse);
  }
  // do NOT enable wrapping until the last auth response is sent
  if (saslContextEstablished) {
    String qop = (String) saslServer.getNegotiatedProperty(Sasl.QOP);
    // SASL wrapping is only used if the connection has a QOP, and
    // the value is not auth.  ex. auth-int & auth-priv
    useWrap = (qop != null && !"auth".equalsIgnoreCase(qop));        
  }
}
 

private void saslProcess(RpcSaslProto saslMessage)
    throws WrappedRpcServerException, IOException, InterruptedException {
  if (saslContextEstablished) {
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_INVALID_RPC_HEADER,
        new SaslException("Negotiation is already complete"));
  }
  RpcSaslProto saslResponse = null;
  try {
    try {
      saslResponse = processSaslMessage(saslMessage);
    } catch (IOException e) {
      rpcMetrics.incrAuthenticationFailures();
      if (LOG.isDebugEnabled()) {
        LOG.debug(StringUtils.stringifyException(e));
      }
      // attempting user could be null
      IOException tce = (IOException) getCauseForInvalidToken(e);
      AUDITLOG.warn(AUTH_FAILED_FOR + this.toString() + ":"
          + attemptingUser + " (" + e.getLocalizedMessage()
          + ") with true cause: (" + tce.getLocalizedMessage() + ")");
      throw tce;
    }
    
    if (saslServer != null && saslServer.isComplete()) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("SASL server context established. Negotiated QoP is "
            + saslServer.getNegotiatedProperty(Sasl.QOP));
      }
      user = getAuthorizedUgi(saslServer.getAuthorizationID());
      if (LOG.isDebugEnabled()) {
        LOG.debug("SASL server successfully authenticated client: " + user);
      }
      rpcMetrics.incrAuthenticationSuccesses();
      AUDITLOG.info(AUTH_SUCCESSFUL_FOR + user);
      saslContextEstablished = true;
    }
  } catch (WrappedRpcServerException wrse) { // don't re-wrap
    throw wrse;
  } catch (IOException ioe) {
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_UNAUTHORIZED, ioe);
  }
  // send back response if any, may throw IOException
  if (saslResponse != null) {
    doSaslReply(saslResponse);
  }
  // do NOT enable wrapping until the last auth response is sent
  if (saslContextEstablished) {
    String qop = (String) saslServer.getNegotiatedProperty(Sasl.QOP);
    // SASL wrapping is only used if the connection has a QOP, and
    // the value is not auth.  ex. auth-int & auth-priv
    useWrap = (qop != null && !"auth".equalsIgnoreCase(qop));        
  }
}
 

private void saslProcess(RpcSaslProto saslMessage)
    throws WrappedRpcServerException, IOException, InterruptedException {
  if (saslContextEstablished) {
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_INVALID_RPC_HEADER,
        new SaslException("Negotiation is already complete"));
  }
  RpcSaslProto saslResponse = null;
  try {
    try {
      saslResponse = processSaslMessage(saslMessage);
    } catch (IOException e) {
      IOException sendToClient = e;
      Throwable cause = e;
      while (cause != null) {
        if (cause instanceof InvalidToken) {
          sendToClient = (InvalidToken) cause;
          break;
        }
        cause = cause.getCause();
      }
      rpcMetrics.incrAuthenticationFailures();
      String clientIP = this.toString();
      // attempting user could be null
      AUDITLOG.warn(AUTH_FAILED_FOR + clientIP + ":" + attemptingUser +
        " (" + e.getLocalizedMessage() + ")");
      throw sendToClient;
    }
    
    if (saslServer != null && saslServer.isComplete()) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("SASL server context established. Negotiated QoP is "
            + saslServer.getNegotiatedProperty(Sasl.QOP));
      }
      user = getAuthorizedUgi(saslServer.getAuthorizationID());
      if (LOG.isDebugEnabled()) {
        LOG.debug("SASL server successfully authenticated client: " + user);
      }
      rpcMetrics.incrAuthenticationSuccesses();
      AUDITLOG.info(AUTH_SUCCESSFUL_FOR + user);
      saslContextEstablished = true;
    }
  } catch (WrappedRpcServerException wrse) { // don't re-wrap
    throw wrse;
  } catch (IOException ioe) {
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_UNAUTHORIZED, ioe);
  }
  // send back response if any, may throw IOException
  if (saslResponse != null) {
    doSaslReply(saslResponse);
  }
  // do NOT enable wrapping until the last auth response is sent
  if (saslContextEstablished) {
    String qop = (String) saslServer.getNegotiatedProperty(Sasl.QOP);
    // SASL wrapping is only used if the connection has a QOP, and
    // the value is not auth.  ex. auth-int & auth-priv
    useWrap = (qop != null && !"auth".equalsIgnoreCase(qop));        
  }
}
 

private void saslProcess(RpcSaslProto saslMessage)
    throws RpcServerException, IOException, InterruptedException {
  if (saslContextEstablished) {
    throw new FatalRpcServerException(
        RpcErrorCodeProto.FATAL_INVALID_RPC_HEADER,
        new SaslException("Negotiation is already complete"));
  }
  RpcSaslProto saslResponse = null;
  try {
    try {
      saslResponse = processSaslMessage(saslMessage);
    } catch (IOException e) {
      rpcMetrics.incrAuthenticationFailures();
      if (LOG.isDebugEnabled()) {
        LOG.debug(StringUtils.stringifyException(e));
      }
      // attempting user could be null
      IOException tce = (IOException) getCauseForInvalidToken(e);
      AUDITLOG.warn(AUTH_FAILED_FOR + this.toString() + ":"
          + attemptingUser + " (" + e.getLocalizedMessage()
          + ") with true cause: (" + tce.getLocalizedMessage() + ")");
      throw tce;
    }
    
    if (saslServer != null && saslServer.isComplete()) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("SASL server context established. Negotiated QoP is "
            + saslServer.getNegotiatedProperty(Sasl.QOP));
      }
      user = getAuthorizedUgi(saslServer.getAuthorizationID());
      if (LOG.isDebugEnabled()) {
        LOG.debug("SASL server successfully authenticated client: " + user);
      }
      rpcMetrics.incrAuthenticationSuccesses();
      AUDITLOG.info(AUTH_SUCCESSFUL_FOR + user);
      saslContextEstablished = true;
    }
  } catch (RpcServerException rse) { // don't re-wrap
    throw rse;
  } catch (IOException ioe) {
    throw new FatalRpcServerException(
        RpcErrorCodeProto.FATAL_UNAUTHORIZED, ioe);
  }
  // send back response if any, may throw IOException
  if (saslResponse != null) {
    doSaslReply(saslResponse);
  }
  // do NOT enable wrapping until the last auth response is sent
  if (saslContextEstablished) {
    String qop = (String) saslServer.getNegotiatedProperty(Sasl.QOP);
    // SASL wrapping is only used if the connection has a QOP, and
    // the value is not auth.  ex. auth-int & auth-priv
    useWrap = (qop != null && !"auth".equalsIgnoreCase(qop));
    if (!useWrap) {
      disposeSasl();
    }
  }
}
 

/** Reads the connection context following the connection header
 * @param buffer - DataInputStream from which to read the header
 * @throws RpcServerException - if the header cannot be
 *         deserialized, or the user is not authorized
 */ 
private void processConnectionContext(RpcWritable.Buffer buffer)
    throws RpcServerException {
  // allow only one connection context during a session
  if (connectionContextRead) {
    throw new FatalRpcServerException(
        RpcErrorCodeProto.FATAL_INVALID_RPC_HEADER,
        "Connection context already processed");
  }
  connectionContext = getMessage(IpcConnectionContextProto.getDefaultInstance(), buffer);
  protocolName = connectionContext.hasProtocol() ? connectionContext
      .getProtocol() : null;

  UserGroupInformation protocolUser = ProtoUtil.getUgi(connectionContext);
  if (authProtocol == AuthProtocol.NONE) {
    user = protocolUser;
    authenticateSSLConnection(protocolUser);
  } else {
    // user is authenticated
    user.setAuthenticationMethod(authMethod);
    //Now we check if this is a proxy user case. If the protocol user is
    //different from the 'user', it is a proxy user scenario. However, 
    //this is not allowed if user authenticated with DIGEST.
    if ((protocolUser != null)
        && (!protocolUser.getUserName().equals(user.getUserName()))) {
      if (authMethod == AuthMethod.TOKEN) {
        // Not allowed to doAs if token authentication is used
        throw new FatalRpcServerException(
            RpcErrorCodeProto.FATAL_UNAUTHORIZED,
            new AccessControlException("Authenticated user (" + user
                + ") doesn't match what the client claims to be ("
                + protocolUser + ")"));
      } else {
        // Effective user can be different from authenticated user
        // for simple auth or kerberos auth
        // The user is the real user. Now we create a proxy user
        UserGroupInformation realUser = user;
        user = UserGroupInformation.createProxyUser(protocolUser
            .getUserName(), realUser);
      }
    }
  }
  authorizeConnection();
  // don't set until after authz because connection isn't established
  connectionContextRead = true;
  if (user != null) {
    connectionManager.incrUserConnections(user.getShortUserName());
  }
}
 

private void saslProcess(RpcSaslProto saslMessage)
    throws WrappedRpcServerException, IOException, InterruptedException {
  if (saslContextEstablished) {
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_INVALID_RPC_HEADER,
        new SaslException("Negotiation is already complete"));
  }
  RpcSaslProto saslResponse = null;
  try {
    try {
      saslResponse = processSaslMessage(saslMessage);
    } catch (IOException e) {
      IOException sendToClient = e;
      Throwable cause = e;
      while (cause != null) {
        if (cause instanceof InvalidToken) {
          // FIXME: hadoop method signatures are restricting the SASL
          // callbacks to only returning InvalidToken, but some services
          // need to throw other exceptions (ex. NN + StandyException),
          // so for now we'll tunnel the real exceptions via an
          // InvalidToken's cause which normally is not set 
          if (cause.getCause() != null) {
            cause = cause.getCause();
          }
          sendToClient = (IOException) cause;
          break;
        }
        cause = cause.getCause();
      }
      rpcMetrics.incrAuthenticationFailures();
      String clientIP = this.toString();
      // attempting user could be null
      AUDITLOG.warn(AUTH_FAILED_FOR + clientIP + ":" + attemptingUser +
        " (" + e.getLocalizedMessage() + ")");
      throw sendToClient;
    }
    
    if (saslServer != null && saslServer.isComplete()) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("SASL server context established. Negotiated QoP is "
            + saslServer.getNegotiatedProperty(Sasl.QOP));
      }
      user = getAuthorizedUgi(saslServer.getAuthorizationID());
      if (LOG.isDebugEnabled()) {
        LOG.debug("SASL server successfully authenticated client: " + user);
      }
      rpcMetrics.incrAuthenticationSuccesses();
      AUDITLOG.info(AUTH_SUCCESSFUL_FOR + user);
      saslContextEstablished = true;
    }
  } catch (WrappedRpcServerException wrse) { // don't re-wrap
    throw wrse;
  } catch (IOException ioe) {
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_UNAUTHORIZED, ioe);
  }
  // send back response if any, may throw IOException
  if (saslResponse != null) {
    doSaslReply(saslResponse);
  }
  // do NOT enable wrapping until the last auth response is sent
  if (saslContextEstablished) {
    String qop = (String) saslServer.getNegotiatedProperty(Sasl.QOP);
    // SASL wrapping is only used if the connection has a QOP, and
    // the value is not auth.  ex. auth-int & auth-priv
    useWrap = (qop != null && !"auth".equalsIgnoreCase(qop));        
  }
}