Java SecurityProtocol.SASL_SSL属性代码示例

/**
 * @param securityProtocol the securityProtocol
 * @param contextType the contextType, it must be non-null if `securityProtocol` is SASL_*; it is ignored otherwise
 * @param config client config
 * @param listenerName the listenerName if contextType is SERVER or null otherwise
 * @param clientSaslMechanism SASL mechanism if mode is CLIENT, ignored otherwise
 * @param saslHandshakeRequestEnable flag to enable Sasl handshake requests; disabled only for SASL
 *             inter-broker connections with inter-broker protocol version < 0.10
 * @return the configured `ChannelBuilder`
 * @throws IllegalArgumentException if `mode` invariants described above is not maintained
 */
public static ChannelBuilder clientChannelBuilder(SecurityProtocol securityProtocol,
        JaasContext.Type contextType,
        AbstractConfig config,
        ListenerName listenerName,
        String clientSaslMechanism,
        boolean saslHandshakeRequestEnable) {

    if (securityProtocol == SecurityProtocol.SASL_PLAINTEXT || securityProtocol == SecurityProtocol.SASL_SSL) {
        if (contextType == null)
            throw new IllegalArgumentException("`contextType` must be non-null if `securityProtocol` is `" + securityProtocol + "`");
        if (clientSaslMechanism == null)
            throw new IllegalArgumentException("`clientSaslMechanism` must be non-null in client mode if `securityProtocol` is `" + securityProtocol + "`");
    }
    return create(securityProtocol, Mode.CLIENT, contextType, config, listenerName, clientSaslMechanism,
            saslHandshakeRequestEnable, null);
}
 

public NioEchoServer(ListenerName listenerName, SecurityProtocol securityProtocol, AbstractConfig config,
        String serverHost, ChannelBuilder channelBuilder) throws Exception {
    super("echoserver");
    setDaemon(true);
    serverSocketChannel = ServerSocketChannel.open();
    serverSocketChannel.configureBlocking(false);
    serverSocketChannel.socket().bind(new InetSocketAddress(serverHost, 0));
    this.port = serverSocketChannel.socket().getLocalPort();
    this.socketChannels = Collections.synchronizedList(new ArrayList<SocketChannel>());
    this.newChannels = Collections.synchronizedList(new ArrayList<SocketChannel>());
    this.credentialCache = new CredentialCache();
    if (securityProtocol == SecurityProtocol.SASL_PLAINTEXT || securityProtocol == SecurityProtocol.SASL_SSL)
        ScramCredentialUtils.createCache(credentialCache, ScramMechanism.mechanismNames());
    if (channelBuilder == null)
        channelBuilder = ChannelBuilders.serverChannelBuilder(listenerName, securityProtocol, config, credentialCache);
    this.selector = new Selector(5000, new Metrics(), new MockTime(), "MetricGroup", channelBuilder);
    acceptorThread = new AcceptorThread();
}
 

/**
 * Tests that SASL/PLAIN clients without valid username fail authentication.
 */
@Test
public void testMissingUsernameSaslPlain() throws Exception {
    String node = "0";
    TestJaasConfig jaasConfig = configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    jaasConfig.setPlainClientOptions(null, "mypassword");

    SecurityProtocol securityProtocol = SecurityProtocol.SASL_SSL;
    server = createEchoServer(securityProtocol);
    createSelector(securityProtocol, saslClientConfigs);
    InetSocketAddress addr = new InetSocketAddress("127.0.0.1", server.port());
    try {
        selector.connect(node, addr, BUFFER_SIZE, BUFFER_SIZE);
        fail("SASL/PLAIN channel created without username");
    } catch (IOException e) {
        // Expected exception
        assertTrue("Channels not closed", selector.channels().isEmpty());
        for (SelectionKey key : selector.keys())
            assertFalse("Key not cancelled", key.isValid());
    }
}
 

/**
 * Tests that SASL/PLAIN clients with missing password in JAAS configuration fail authentication.
 */
@Test
public void testMissingPasswordSaslPlain() throws Exception {
    String node = "0";
    TestJaasConfig jaasConfig = configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    jaasConfig.setPlainClientOptions("myuser", null);

    SecurityProtocol securityProtocol = SecurityProtocol.SASL_SSL;
    server = createEchoServer(securityProtocol);
    createSelector(securityProtocol, saslClientConfigs);
    InetSocketAddress addr = new InetSocketAddress("127.0.0.1", server.port());
    try {
        selector.connect(node, addr, BUFFER_SIZE, BUFFER_SIZE);
        fail("SASL/PLAIN channel created without password");
    } catch (IOException e) {
        // Expected exception
    }
}
 

/**
 * Tests that servers supporting multiple SASL mechanisms work with clients using
 * any of the enabled mechanisms.
 */
@Test
public void testMultipleServerMechanisms() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_SSL;
    configureMechanisms("DIGEST-MD5", Arrays.asList("DIGEST-MD5", "PLAIN", "SCRAM-SHA-256"));
    server = createEchoServer(securityProtocol);
    updateScramCredentialCache(TestJaasConfig.USERNAME, TestJaasConfig.PASSWORD);

    String node1 = "1";
    saslClientConfigs.put(SaslConfigs.SASL_MECHANISM, "PLAIN");
    createAndCheckClientConnection(securityProtocol, node1);

    String node2 = "2";
    saslClientConfigs.put(SaslConfigs.SASL_MECHANISM, "DIGEST-MD5");
    createSelector(securityProtocol, saslClientConfigs);
    InetSocketAddress addr = new InetSocketAddress("127.0.0.1", server.port());
    selector.connect(node2, addr, BUFFER_SIZE, BUFFER_SIZE);
    NetworkTestUtils.checkClientConnection(selector, node2, 100, 10);

    String node3 = "3";
    saslClientConfigs.put(SaslConfigs.SASL_MECHANISM, "SCRAM-SHA-256");
    createSelector(securityProtocol, saslClientConfigs);
    selector.connect(node3, new InetSocketAddress("127.0.0.1", server.port()), BUFFER_SIZE, BUFFER_SIZE);
    NetworkTestUtils.checkClientConnection(selector, node3, 100, 10);
}
 

/**
 * Tests that SASL/SCRAM clients fail authentication if credentials are not available for
 * the specific SCRAM mechanism.
 */
@Test
public void testUserCredentialsUnavailableForScramMechanism() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_SSL;
    configureMechanisms("SCRAM-SHA-256", new ArrayList<>(ScramMechanism.mechanismNames()));
    server = createEchoServer(securityProtocol);
    updateScramCredentialCache(TestJaasConfig.USERNAME, TestJaasConfig.PASSWORD);

    server.credentialCache().cache(ScramMechanism.SCRAM_SHA_256.mechanismName(), ScramCredential.class).remove(TestJaasConfig.USERNAME);
    String node = "1";
    saslClientConfigs.put(SaslConfigs.SASL_MECHANISM, "SCRAM-SHA-256");
    createAndCheckClientConnectionFailure(securityProtocol, node);

    saslClientConfigs.put(SaslConfigs.SASL_MECHANISM, "SCRAM-SHA-512");
    createAndCheckClientConnection(securityProtocol, "2");
}
 

/**
 * Tests SASL/SCRAM with username containing characters that need
 * to be encoded.
 */
@Test
public void testScramUsernameWithSpecialCharacters() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_SSL;
    String username = "special user= test,scram";
    String password = username + "-password";
    TestJaasConfig jaasConfig = configureMechanisms("SCRAM-SHA-256", Arrays.asList("SCRAM-SHA-256"));
    Map<String, Object> options = new HashMap<>();
    options.put("username", username);
    options.put("password", password);
    jaasConfig.createOrUpdateEntry(TestJaasConfig.LOGIN_CONTEXT_CLIENT, ScramLoginModule.class.getName(), options);

    server = createEchoServer(securityProtocol);
    updateScramCredentialCache(username, password);
    createAndCheckClientConnection(securityProtocol, "0");
}
 

/**
 * Tests that SASL/PLAIN clients without valid username fail authentication.
 */
@Test
public void testMissingUsernameSaslPlain() throws Exception {
    String node = "0";
    TestJaasConfig jaasConfig = configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    jaasConfig.setPlainClientOptions(null, "mypassword");

    SecurityProtocol securityProtocol = SecurityProtocol.SASL_SSL;
    server = NetworkTestUtils.createEchoServer(securityProtocol, saslServerConfigs);
    createSelector(securityProtocol, saslClientConfigs);
    InetSocketAddress addr = new InetSocketAddress("127.0.0.1", server.port());
    try {
        selector.connect(node, addr, BUFFER_SIZE, BUFFER_SIZE);
        fail("SASL/PLAIN channel created without username");
    } catch (KafkaException e) {
        // Expected exception
    }
}
 

/**
 * Tests that SASL/PLAIN clients with missing password in JAAS configuration fail authentication.
 */
@Test
public void testMissingPasswordSaslPlain() throws Exception {
    String node = "0";
    TestJaasConfig jaasConfig = configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    jaasConfig.setPlainClientOptions("myuser", null);

    SecurityProtocol securityProtocol = SecurityProtocol.SASL_SSL;
    server = NetworkTestUtils.createEchoServer(securityProtocol, saslServerConfigs);
    createSelector(securityProtocol, saslClientConfigs);
    InetSocketAddress addr = new InetSocketAddress("127.0.0.1", server.port());
    try {
        selector.connect(node, addr, BUFFER_SIZE, BUFFER_SIZE);
        fail("SASL/PLAIN channel created without password");
    } catch (KafkaException e) {
        // Expected exception
    }
}
 

/**
 * Tests that servers supporting multiple SASL mechanisms work with clients using
 * any of the enabled mechanisms.
 */
@Test
public void testMultipleServerMechanisms() throws Exception {
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_SSL;
    configureMechanisms("DIGEST-MD5", Arrays.asList("DIGEST-MD5", "PLAIN"));
    server = NetworkTestUtils.createEchoServer(securityProtocol, saslServerConfigs);

    String node1 = "1";
    saslClientConfigs.put(SaslConfigs.SASL_MECHANISM, "PLAIN");
    createAndCheckClientConnection(securityProtocol, node1);

    String node2 = "2";
    saslClientConfigs.put(SaslConfigs.SASL_MECHANISM, "DIGEST-MD5");
    createSelector(securityProtocol, saslClientConfigs);
    InetSocketAddress addr = new InetSocketAddress("127.0.0.1", server.port());
    selector.connect(node2, addr, BUFFER_SIZE, BUFFER_SIZE);
    NetworkTestUtils.checkClientConnection(selector, node2, 100, 10);
}
 

public void configure(Map<String, ?> configs) throws KafkaException {
    try {
        this.configs = configs;
        boolean hasKerberos;
        if (mode == Mode.SERVER) {
            List<String> enabledMechanisms = (List<String>) this.configs.get(SaslConfigs.SASL_ENABLED_MECHANISMS);
            hasKerberos = enabledMechanisms == null || enabledMechanisms.contains(SaslConfigs.GSSAPI_MECHANISM);
        } else {
            hasKerberos = clientSaslMechanism.equals(SaslConfigs.GSSAPI_MECHANISM);
        }

        if (hasKerberos) {
            String defaultRealm;
            try {
                defaultRealm = defaultKerberosRealm();
            } catch (Exception ke) {
                defaultRealm = "";
            }
            @SuppressWarnings("unchecked")
            List<String> principalToLocalRules = (List<String>) configs.get(SaslConfigs.SASL_KERBEROS_PRINCIPAL_TO_LOCAL_RULES);
            if (principalToLocalRules != null)
                kerberosShortNamer = KerberosShortNamer.fromUnparsedRules(defaultRealm, principalToLocalRules);
        }
        this.loginManager = LoginManager.acquireLoginManager(jaasContext, hasKerberos, configs);

        if (this.securityProtocol == SecurityProtocol.SASL_SSL) {
            // Disable SSL client authentication as we are using SASL authentication
            this.sslFactory = new SslFactory(mode, "none");
            this.sslFactory.configure(configs);
        }
    } catch (Exception e) {
        throw new KafkaException(e);
    }
}
 

protected TransportLayer buildTransportLayer(String id, SelectionKey key, SocketChannel socketChannel) throws IOException {
    if (this.securityProtocol == SecurityProtocol.SASL_SSL) {
        return SslTransportLayer.create(id, key,
            sslFactory.createSslEngine(socketChannel.socket().getInetAddress().getHostName(), socketChannel.socket().getPort()));
    } else {
        return new PlaintextTransportLayer(key);
    }
}
 

/**
 * Tests that SASL/PLAIN clients with invalid password fail authentication.
 */
@Test
public void testInvalidPasswordSaslPlain() throws Exception {
    String node = "0";
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_SSL;
    TestJaasConfig jaasConfig = configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    jaasConfig.setPlainClientOptions(TestJaasConfig.USERNAME, "invalidpassword");

    server = createEchoServer(securityProtocol);
    createAndCheckClientConnectionFailure(securityProtocol, node);
}
 

/**
 * Tests that SASL/PLAIN clients with invalid username fail authentication.
 */
@Test
public void testInvalidUsernameSaslPlain() throws Exception {
    String node = "0";
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_SSL;
    TestJaasConfig jaasConfig = configureMechanisms("PLAIN", Arrays.asList("PLAIN"));
    jaasConfig.setPlainClientOptions("invaliduser", TestJaasConfig.PASSWORD);

    server = createEchoServer(securityProtocol);
    createAndCheckClientConnectionFailure(securityProtocol, node);
}
 

/**
 * Tests that mechanisms that are not supported in Kafka can be plugged in without modifying
 * Kafka code if Sasl client and server providers are available.
 */
@Test
public void testMechanismPluggability() throws Exception {
    String node = "0";
    SecurityProtocol securityProtocol = SecurityProtocol.SASL_SSL;
    configureMechanisms("DIGEST-MD5", Arrays.asList("DIGEST-MD5"));

    server = createEchoServer(securityProtocol);
    createAndCheckClientConnection(securityProtocol, node);
}