Java TSaslServerTransport.Factory方法代码示例

import org.apache.thrift.transport.TSaslServerTransport; //导入方法依赖的package包/类
private TTransportFactory getSASLTransportFactory() {
  String[] names;
  try {
    names = FlumeAuthenticationUtil.splitKerberosName(principal);
  } catch (IOException e) {
    throw new FlumeException(
            "Error while trying to resolve Principal name - " + principal, e);
  }
  Map<String, String> saslProperties = new HashMap<String, String>();
  saslProperties.put(Sasl.QOP, "auth");
  TSaslServerTransport.Factory saslTransportFactory =
          new TSaslServerTransport.Factory();
  saslTransportFactory.addServerDefinition(
          "GSSAPI", names[0], names[1], saslProperties,
          FlumeAuthenticationUtil.getSaslGssCallbackHandler());
  return saslTransportFactory;
}
 

import org.apache.thrift.transport.TSaslServerTransport; //导入方法依赖的package包/类
protected TTransportFactory getServerTransportFactory() throws IOException {
    // create an authentication callback handler
    CallbackHandler serer_callback_handler = new ServerCallbackHandler(login_conf);

    // create a transport factory that will invoke our auth callback for digest
    TSaslServerTransport.Factory factory = new TSaslServerTransport.Factory();
    factory.addServerDefinition(DIGEST, AuthUtils.SERVICE, "localhost", null, serer_callback_handler);

    LOG.info("SASL DIGEST-MD5 transport factory will be used");
    return factory;
}
 

import org.apache.thrift.transport.TSaslServerTransport; //导入方法依赖的package包/类
protected TTransportFactory getServerTransportFactory() throws IOException {        
    //create an authentication callback handler
    CallbackHandler serer_callback_handler = new ServerCallbackHandler(login_conf);

    //create a transport factory that will invoke our auth callback for digest
    TSaslServerTransport.Factory factory = new TSaslServerTransport.Factory();
    factory.addServerDefinition(DIGEST, AuthUtils.SERVICE, "localhost", null, serer_callback_handler);

    LOG.info("SASL DIGEST-MD5 transport factory will be used");
    return factory;
}
 

import org.apache.thrift.transport.TSaslServerTransport; //导入方法依赖的package包/类
public TTransportFactory getServerTransportFactory() throws IOException {
    // create an authentication callback handler
    CallbackHandler server_callback_handler = new ServerCallbackHandler(login_conf, storm_conf);

    // login our principal
    Subject subject = null;
    try {
        // specify a configuration object to be used
        Configuration.setConfiguration(login_conf);
        // now login
        Login login = new Login(AuthUtils.LOGIN_CONTEXT_SERVER, server_callback_handler);
        subject = login.getSubject();
    } catch (LoginException ex) {
        LOG.error("Server failed to login in principal:" + ex, ex);
        throw new RuntimeException(ex);
    }

    // check the credential of our principal
    if (subject.getPrivateCredentials(KerberosTicket.class).isEmpty()) {
        throw new RuntimeException("Fail to verify user principal with section \"" + AuthUtils.LOGIN_CONTEXT_SERVER + "\" in login configuration file "
                + login_conf);
    }

    String principal = AuthUtils.get(login_conf, AuthUtils.LOGIN_CONTEXT_SERVER, "principal");
    LOG.debug("principal:" + principal);
    KerberosName serviceKerberosName = new KerberosName(principal);
    String serviceName = serviceKerberosName.getServiceName();
    String hostName = serviceKerberosName.getHostName();
    Map<String, String> props = new TreeMap<String, String>();
    props.put(Sasl.QOP, "auth");
    props.put(Sasl.SERVER_AUTH, "false");

    // create a transport factory that will invoke our auth callback for digest
    TSaslServerTransport.Factory factory = new TSaslServerTransport.Factory();
    factory.addServerDefinition(KERBEROS, serviceName, hostName, props, server_callback_handler);

    // create a wrap transport factory so that we could apply user credential during connections
    TUGIAssumingTransportFactory wrapFactory = new TUGIAssumingTransportFactory(factory, subject);

    LOG.info("SASL GSSAPI transport factory will be used");
    return wrapFactory;
}
 

import org.apache.thrift.transport.TSaslServerTransport; //导入方法依赖的package包/类
public static void main(String[] args) throws Exception {
  Opts opts = new Opts();
  
  opts.parseArgs(Server.class, args);
  
  Configuration conf = new Configuration();
  FileSystem fs = FileSystem.get(conf);
  
  // Parse out the primary/[email protected] from the principal
  String principal = SecurityUtil.getServerPrincipal(opts.principal, InetAddress.getLocalHost().getCanonicalHostName());
  HadoopKerberosName name = new HadoopKerberosName(principal);
  String primary = name.getServiceName();
  String instance = name.getHostName();
  
  // Log in using the keytab
  UserGroupInformation.loginUserFromKeytab(principal, opts.keytab);
  
  // Get the info from our login
  UserGroupInformation serverUser = UserGroupInformation.getLoginUser();
  log.info("Current user: {}", serverUser);
  
  // Open the server using the provide dport
  TServerSocket serverTransport = new TServerSocket(opts.port);
  
  // Wrap our implementation with the interface's processor
  HdfsService.Processor<Iface> processor = new HdfsService.Processor<Iface>(new HdfsServiceImpl(fs));
  
  // Use authorization and confidentiality
  Map<String,String> saslProperties = new HashMap<String,String>();
  saslProperties.put(Sasl.QOP, "auth-conf");
  
  // Creating the server definition
  TSaslServerTransport.Factory saslTransportFactory = new TSaslServerTransport.Factory();
      saslTransportFactory.addServerDefinition("GSSAPI", // tell SASL to use GSSAPI, which supports Kerberos
      primary, // kerberos primary for server - "myprincipal" in myprincipal/[email protected]
      instance, // kerberos instance for server - "my.server.com" in myprincipal/[email protected]
      saslProperties, // Properties set, above
      new SaslRpcServer.SaslGssCallbackHandler()); // Ensures that authenticated user is the same as the authorized user
  
  // Make sure the TTransportFactory is performing a UGI.doAs
  TTransportFactory ugiTransportFactory = new TUGIAssumingTransportFactory(saslTransportFactory, serverUser);
  
  // Processor which takes the UGI for the RPC call, proxy that user on the server login, and then run as the proxied user
  TUGIAssumingProcessor ugiProcessor = new TUGIAssumingProcessor(processor);
  
  // Make a simple TTheadPoolServer with the processor and transport factory
  TServer server = new TThreadPoolServer(new TThreadPoolServer.Args(serverTransport).transportFactory(ugiTransportFactory).processor(ugiProcessor));
  
  // Start the thrift server
  server.serve();
}