Java AuthMethod.TOKEN属性代码示例

private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws InvalidToken, AccessControlException {
  if (authMethod == AuthMethod.TOKEN) {
    TokenIdentifier tokenId = SaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    UserGroupInformation ugi = tokenId.getUser();
    if (ugi == null) {
      throw new AccessControlException(
          "Can't retrieve username from tokenIdentifier.");
    }
    ugi.addTokenIdentifier(tokenId);
    return ugi;
  } else {
    return UserGroupInformation.createRemoteUser(authorizedId, authMethod);
  }
}
 

/**
 * Authorize proxy users to access this server
 * @throws WrappedRpcServerException - user is not allowed to proxy
 */
private void authorizeConnection() throws WrappedRpcServerException {
  try {
    // If auth method is TOKEN, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (user != null && user.getRealUser() != null
        && (authMethod != AuthMethod.TOKEN)) {
      ProxyUsers.authorize(user, this.getHostAddress());
    }
    authorize(user, protocolName, getHostInetAddress());
    if (LOG.isDebugEnabled()) {
      LOG.debug("Successfully authorized " + connectionContext);
    }
    rpcMetrics.incrAuthorizationSuccesses();
  } catch (AuthorizationException ae) {
    LOG.info("Connection from " + this
        + " for protocol " + connectionContext.getProtocol()
        + " is unauthorized for user " + user);
    rpcMetrics.incrAuthorizationFailures();
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_UNAUTHORIZED, ae);
  }
}
 

private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws InvalidToken, AccessControlException {
  if (authMethod == AuthMethod.TOKEN) {
    TokenIdentifier tokenId = SaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    UserGroupInformation ugi = tokenId.getUser();
    if (ugi == null) {
      throw new AccessControlException(
          "Can't retrieve username from tokenIdentifier.");
    }
    ugi.addTokenIdentifier(tokenId);
    return ugi;
  } else {
    return UserGroupInformation.createRemoteUser(authorizedId);
  }
}
 

/**
 * Authorize proxy users to access this server
 * @throws WrappedRpcServerException - user is not allowed to proxy
 */
private void authorizeConnection() throws WrappedRpcServerException {
  try {
    // If auth method is TOKEN, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (user != null && user.getRealUser() != null
        && (authMethod != AuthMethod.TOKEN)) {
      ProxyUsers.authorize(user, this.getHostAddress(), conf);
    }
    authorize(user, protocolName, getHostInetAddress());
    if (LOG.isDebugEnabled()) {
      LOG.debug("Successfully authorized " + connectionContext);
    }
    rpcMetrics.incrAuthorizationSuccesses();
  } catch (AuthorizationException ae) {
    LOG.info("Connection from " + this
        + " for protocol " + connectionContext.getProtocol()
        + " is unauthorized for user " + user);
    rpcMetrics.incrAuthorizationFailures();
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_UNAUTHORIZED, ae);
  }
}
 

/**
 * Authorize proxy users to access this server
 * @throws RpcServerException - user is not allowed to proxy
 */
private void authorizeConnection() throws RpcServerException {
  try {
    // If auth method is TOKEN, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (user != null && user.getRealUser() != null
        && (authMethod != AuthMethod.TOKEN)) {
      ProxyUsers.authorize(user, this.getHostAddress());
    }
    authorize(user, protocolName, getHostInetAddress());
    if (LOG.isDebugEnabled()) {
      LOG.debug("Successfully authorized " + connectionContext);
    }
    rpcMetrics.incrAuthorizationSuccesses();
  } catch (AuthorizationException ae) {
    LOG.info("Connection from " + this
        + " for protocol " + connectionContext.getProtocol()
        + " is unauthorized for user " + user);
    rpcMetrics.incrAuthorizationFailures();
    throw new FatalRpcServerException(
        RpcErrorCodeProto.FATAL_UNAUTHORIZED, ae);
  }
}
 

/** 
 * This method creates the connection context  using exactly the same logic
 * as the old connection context as was done for writable where
 * the effective and real users are set based on the auth method.
 *
 */
public static IpcConnectionContextProto makeIpcConnectionContext(
    final String protocol,
    final UserGroupInformation ugi, final AuthMethod authMethod) {
  IpcConnectionContextProto.Builder result = IpcConnectionContextProto.newBuilder();
  if (protocol != null) {
    result.setProtocol(protocol);
  }
  UserInformationProto.Builder ugiProto =  UserInformationProto.newBuilder();
  if (ugi != null) {
    /*
     * In the connection context we send only additional user info that
     * is not derived from the authentication done during connection setup.
     */
    if (authMethod == AuthMethod.KERBEROS) {
      // Real user was established as part of the connection.
      // Send effective user only.
      ugiProto.setEffectiveUser(ugi.getUserName());
    } else if (authMethod == AuthMethod.TOKEN) {
      // With token, the connection itself establishes 
      // both real and effective user. Hence send none in header.
    } else {  // Simple authentication
      // No user info is established as part of the connection.
      // Send both effective user and real user
      ugiProto.setEffectiveUser(ugi.getUserName());
      if (ugi.getRealUser() != null) {
        ugiProto.setRealUser(ugi.getRealUser().getUserName());
      }
    }
  }   
  result.setUserInfo(ugiProto);
  return result.build();
}
 

protected static AuthMethod convert(
    TestProtos.AuthMethodResponseProto authMethodResponse) {
  String mechanism = authMethodResponse.getMechanismName();
  if (mechanism.equals(AuthMethod.SIMPLE.getMechanismName())) {
    return AuthMethod.SIMPLE;
  } else if (mechanism.equals(AuthMethod.KERBEROS.getMechanismName())) {
    return AuthMethod.KERBEROS;
  } else if (mechanism.equals(AuthMethod.TOKEN.getMechanismName())) {
    return AuthMethod.TOKEN;
  }
  return null;
}
 

/**
 * Process a saslMessge.
 * @param saslMessage received SASL message
 * @return the sasl response to send back to client
 * @throws SaslException if authentication or generating response fails, 
 *                       or SASL protocol mixup
 * @throws IOException if a SaslServer cannot be created
 * @throws AccessControlException if the requested authentication type 
 *         is not supported or trying to re-attempt negotiation.
 * @throws InterruptedException
 */
private RpcSaslProto processSaslMessage(RpcSaslProto saslMessage)
    throws SaslException, IOException, AccessControlException,
    InterruptedException {
  final RpcSaslProto saslResponse;
  final SaslState state = saslMessage.getState(); // required      
  switch (state) {
    case NEGOTIATE: {
      if (sentNegotiate) {
        // FIXME shouldn't this be SaslException?
        throw new AccessControlException(
            "Client already attempted negotiation");
      }
      saslResponse = buildSaslNegotiateResponse();
      // simple-only server negotiate response is success which client
      // interprets as switch to simple
      if (saslResponse.getState() == SaslState.SUCCESS) {
        switchToSimple();
      }
      break;
    }
    case INITIATE: {
      if (saslMessage.getAuthsCount() != 1) {
        throw new SaslException("Client mechanism is malformed");
      }
      // verify the client requested an advertised authType
      SaslAuth clientSaslAuth = saslMessage.getAuths(0);
      if (!negotiateResponse.getAuthsList().contains(clientSaslAuth)) {
        if (sentNegotiate) {
          throw new AccessControlException(
              clientSaslAuth.getMethod() + " authentication is not enabled."
                  + "  Available:" + enabledAuthMethods);
        }
        saslResponse = buildSaslNegotiateResponse();
        break;
      }
      authMethod = AuthMethod.valueOf(clientSaslAuth.getMethod());
      // abort SASL for SIMPLE auth, server has already ensured that
      // SIMPLE is a legit option above.  we will send no response
      if (authMethod == AuthMethod.SIMPLE) {
        switchToSimple();
        saslResponse = null;
        break;
      }
      // sasl server for tokens may already be instantiated
      if (saslServer == null || authMethod != AuthMethod.TOKEN) {
        saslServer = createSaslServer(authMethod);
      }
      saslResponse = processSaslToken(saslMessage);
      break;
    }
    case RESPONSE: {
      saslResponse = processSaslToken(saslMessage);
      break;
    }
    default:
      throw new SaslException("Client sent unsupported state " + state);
  }
  return saslResponse;
}
 

/** Reads the connection context following the connection header
 * @param dis - DataInputStream from which to read the header 
 * @throws WrappedRpcServerException - if the header cannot be
 *         deserialized, or the user is not authorized
 */ 
private void processConnectionContext(DataInputStream dis)
    throws WrappedRpcServerException {
  // allow only one connection context during a session
  if (connectionContextRead) {
    throw new WrappedRpcServerException(
        RpcErrorCodeProto.FATAL_INVALID_RPC_HEADER,
        "Connection context already processed");
  }
  connectionContext = decodeProtobufFromStream(
      IpcConnectionContextProto.newBuilder(), dis);
  protocolName = connectionContext.hasProtocol() ? connectionContext
      .getProtocol() : null;

  UserGroupInformation protocolUser = ProtoUtil.getUgi(connectionContext);
  if (saslServer == null) {
    user = protocolUser;
  } else {
    // user is authenticated
    user.setAuthenticationMethod(authMethod);
    //Now we check if this is a proxy user case. If the protocol user is
    //different from the 'user', it is a proxy user scenario. However, 
    //this is not allowed if user authenticated with DIGEST.
    if ((protocolUser != null)
        && (!protocolUser.getUserName().equals(user.getUserName()))) {
      if (authMethod == AuthMethod.TOKEN) {
        // Not allowed to doAs if token authentication is used
        throw new WrappedRpcServerException(
            RpcErrorCodeProto.FATAL_UNAUTHORIZED,
            new AccessControlException("Authenticated user (" + user
                + ") doesn't match what the client claims to be ("
                + protocolUser + ")"));
      } else {
        // Effective user can be different from authenticated user
        // for simple auth or kerberos auth
        // The user is the real user. Now we create a proxy user
        UserGroupInformation realUser = user;
        user = UserGroupInformation.createProxyUser(protocolUser
            .getUserName(), realUser);
      }
    }
  }
  authorizeConnection();
  // don't set until after authz because connection isn't established
  connectionContextRead = true;
}
 

private RpcSaslProto processSaslMessage(RpcSaslProto saslMessage)
    throws IOException, InterruptedException {
  final RpcSaslProto saslResponse;
  final SaslState state = saslMessage.getState(); // required      
  switch (state) {
    case NEGOTIATE: {
      if (sentNegotiate) {
        throw new AccessControlException(
            "Client already attempted negotiation");
      }
      saslResponse = buildSaslNegotiateResponse();
      // simple-only server negotiate response is success which client
      // interprets as switch to simple
      if (saslResponse.getState() == SaslState.SUCCESS) {
        switchToSimple();
      }
      break;
    }
    case INITIATE: {
      if (saslMessage.getAuthsCount() != 1) {
        throw new SaslException("Client mechanism is malformed");
      }
      // verify the client requested an advertised authType
      SaslAuth clientSaslAuth = saslMessage.getAuths(0);
      if (!negotiateResponse.getAuthsList().contains(clientSaslAuth)) {
        if (sentNegotiate) {
          throw new AccessControlException(
              clientSaslAuth.getMethod() + " authentication is not enabled."
                  + "  Available:" + enabledAuthMethods);
        }
        saslResponse = buildSaslNegotiateResponse();
        break;
      }
      authMethod = AuthMethod.valueOf(clientSaslAuth.getMethod());
      // abort SASL for SIMPLE auth, server has already ensured that
      // SIMPLE is a legit option above.  we will send no response
      if (authMethod == AuthMethod.SIMPLE) {
        switchToSimple();
        saslResponse = null;
        break;
      }
      // sasl server for tokens may already be instantiated
      if (saslServer == null || authMethod != AuthMethod.TOKEN) {
        saslServer = createSaslServer(authMethod);
      }
      saslResponse = processSaslToken(saslMessage);
      break;
    }
    case RESPONSE: {
      saslResponse = processSaslToken(saslMessage);
      break;
    }
    default:
      throw new SaslException("Client sent unsupported state " + state);
  }
  return saslResponse;
}
 

private RpcSaslProto processSaslMessage(RpcSaslProto saslMessage)
    throws IOException, InterruptedException {
  RpcSaslProto saslResponse = null;
  final SaslState state = saslMessage.getState(); // required      
  switch (state) {
    case NEGOTIATE: {
      if (sentNegotiate) {
        throw new AccessControlException(
            "Client already attempted negotiation");
      }
      saslResponse = buildSaslNegotiateResponse();
      // simple-only server negotiate response is success which client
      // interprets as switch to simple
      if (saslResponse.getState() == SaslState.SUCCESS) {
        switchToSimple();
      }
      break;
    }
    case INITIATE: {
      if (saslMessage.getAuthsCount() != 1) {
        throw new SaslException("Client mechanism is malformed");
      }
      // verify the client requested an advertised authType
      SaslAuth clientSaslAuth = saslMessage.getAuths(0);
      if (!negotiateResponse.getAuthsList().contains(clientSaslAuth)) {
        if (sentNegotiate) {
          throw new AccessControlException(
              clientSaslAuth.getMethod() + " authentication is not enabled."
                  + "  Available:" + enabledAuthMethods);
        }
        saslResponse = buildSaslNegotiateResponse();
        break;
      }
      authMethod = AuthMethod.valueOf(clientSaslAuth.getMethod());
      // abort SASL for SIMPLE auth, server has already ensured that
      // SIMPLE is a legit option above.  we will send no response
      if (authMethod == AuthMethod.SIMPLE) {
        switchToSimple();
        break;
      }
      // sasl server for tokens may already be instantiated
      if (saslServer == null || authMethod != AuthMethod.TOKEN) {
        saslServer = createSaslServer(authMethod);
      }
      // fallthru to process sasl token
    }
    case RESPONSE: {
      if (!saslMessage.hasToken()) {
        throw new SaslException("Client did not send a token");
      }
      byte[] saslToken = saslMessage.getToken().toByteArray();
      if (LOG.isDebugEnabled()) {
        LOG.debug("Have read input token of size " + saslToken.length
            + " for processing by saslServer.evaluateResponse()");
      }
      saslToken = saslServer.evaluateResponse(saslToken);
      saslResponse = buildSaslResponse(
          saslServer.isComplete() ? SaslState.SUCCESS : SaslState.CHALLENGE,
          saslToken);
      break;
    }
    default:
      throw new SaslException("Client sent unsupported state " + state);
  }
  return saslResponse;
}
 

/** Reads the connection context following the connection header
 * @param buffer - DataInputStream from which to read the header
 * @throws RpcServerException - if the header cannot be
 *         deserialized, or the user is not authorized
 */ 
private void processConnectionContext(RpcWritable.Buffer buffer)
    throws RpcServerException {
  // allow only one connection context during a session
  if (connectionContextRead) {
    throw new FatalRpcServerException(
        RpcErrorCodeProto.FATAL_INVALID_RPC_HEADER,
        "Connection context already processed");
  }
  connectionContext = getMessage(IpcConnectionContextProto.getDefaultInstance(), buffer);
  protocolName = connectionContext.hasProtocol() ? connectionContext
      .getProtocol() : null;

  UserGroupInformation protocolUser = ProtoUtil.getUgi(connectionContext);
  if (authProtocol == AuthProtocol.NONE) {
    user = protocolUser;
    authenticateSSLConnection(protocolUser);
  } else {
    // user is authenticated
    user.setAuthenticationMethod(authMethod);
    //Now we check if this is a proxy user case. If the protocol user is
    //different from the 'user', it is a proxy user scenario. However, 
    //this is not allowed if user authenticated with DIGEST.
    if ((protocolUser != null)
        && (!protocolUser.getUserName().equals(user.getUserName()))) {
      if (authMethod == AuthMethod.TOKEN) {
        // Not allowed to doAs if token authentication is used
        throw new FatalRpcServerException(
            RpcErrorCodeProto.FATAL_UNAUTHORIZED,
            new AccessControlException("Authenticated user (" + user
                + ") doesn't match what the client claims to be ("
                + protocolUser + ")"));
      } else {
        // Effective user can be different from authenticated user
        // for simple auth or kerberos auth
        // The user is the real user. Now we create a proxy user
        UserGroupInformation realUser = user;
        user = UserGroupInformation.createProxyUser(protocolUser
            .getUserName(), realUser);
      }
    }
  }
  authorizeConnection();
  // don't set until after authz because connection isn't established
  connectionContextRead = true;
  if (user != null) {
    connectionManager.incrUserConnections(user.getShortUserName());
  }
}