org.apache.pulsar.common.sasl.SaslConstants Maven / Gradle / Ivy

Go to download
/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
package org.apache.pulsar.common.sasl;

import javax.security.auth.login.AppConfigurationEntry;
import javax.security.auth.login.Configuration;

/**
 * SASL Constants.
 */
public class SaslConstants {

    public static final String AUTH_METHOD_NAME = "sasl";

    // service section name, this is broker or proxy Principal
    public static final String JAAS_SERVER_SECTION_NAME = "saslJaasServerSectionName";
    public static final String JAAS_DEFAULT_BROKER_SECTION_NAME = "PulsarBroker";
    public static final String JAAS_DEFAULT_PROXY_SECTION_NAME = "PulsarProxy";
    public static final String JAAS_DEFAULT_FUNCTION_SECTION_NAME = "PulsarFunction";

    // Client principal
    public static final String JAAS_CLIENT_SECTION_NAME = "saslJaasClientSectionName";
    public static final String JAAS_DEFAULT_CLIENT_SECTION_NAME = "PulsarClient";

    /**
     * This is a regexp which limits the range of possible ids which can connect to the Broker using SASL.
     * By default only clients whose id contains 'pulsar' are allowed to connect.
     */
    public static final String JAAS_CLIENT_ALLOWED_IDS = "saslJaasClientAllowedIds";
    public static final String JAAS_CLIENT_ALLOWED_IDS_DEFAULT = ".*pulsar.*";

    public static final String KINIT_COMMAND_DEFAULT = "/usr/bin/kinit";

    public static final String KINIT_COMMAND = "kerberos.kinit";

    // The sasl server type that client will connect to. default value broker, could also be proxy.
    public static final String SASL_SERVER_TYPE = "serverType";
    // The non-null string name of the protocol for which the authentication is being performed (e.g., "ldap").
    public static final String SASL_BROKER_PROTOCOL = "broker";
    public static final String SASL_PROXY_PROTOCOL = "proxy";
    // The non-null fully-qualified host name of the server to authenticate to.
    public static final String SASL_PULSAR_REALM = "EXAMPLE.COM";

    // Stand for the start of mutual auth between Client and Broker
    public static final String INIT_PROVIDER_DATA = "isInit";


    // Sasl token name that contained auth role
    public static final String SASL_AUTH_ROLE_TOKEN = "SaslAuthRoleToken";
    public static final String SASL_AUTH_ROLE_TOKEN_EXPIRED = "SaslAuthRoleTokenExpired";

    /**
     * HTTP header used by the SASL client/server during an authentication sequence.
     */
    // auth type
    public static final String SASL_HEADER_TYPE = "SASL-Type";
    public static final String SASL_TYPE_VALUE = "Kerberos";

    // header name for token auth between client and server
    public static final String SASL_AUTH_TOKEN = "SASL-Token";

    // header name for state
    public static final String SASL_HEADER_STATE = "State";
    // header value for state
    public static final String SASL_STATE_CLIENT_INIT = "Init";
    public static final String SASL_STATE_NEGOTIATE = "ING";
    public static final String SASL_STATE_COMPLETE = "Done";
    public static final String SASL_STATE_SERVER_CHECK_TOKEN = "ServerCheckToken";

    // server side track the server
    public static final String SASL_STATE_SERVER = "SASL-Server-ID";

    public static boolean isUsingTicketCache(String configurationEntry) {
        AppConfigurationEntry[] entries = Configuration.getConfiguration()
            .getAppConfigurationEntry(configurationEntry);
        if (entries == null) {
            return false;
        }
        for (AppConfigurationEntry entry : entries) {
            // there will only be a single entry, so this for() loop will only be iterated through once.
            if (entry.getOptions().get("useTicketCache") != null) {
                String val = (String) entry.getOptions().get("useTicketCache");
                if (val.equals("true")) {
                    return true;
                }
            }
        }
        return false;
    }

    public static String getPrincipal(String configurationEntry) {

        AppConfigurationEntry[] entries = Configuration.getConfiguration()
            .getAppConfigurationEntry(configurationEntry);
        if (entries == null) {
            return null;
        }
        for (AppConfigurationEntry entry : entries) {
            if (entry.getOptions().get("principal") != null) {
                return (String) entry.getOptions().get("principal");
            }
        }
        return null;
    }
}