com.datastax.driver.auth.KerberosAuthenticator Maven / Gradle / Ivy

Go to download
/*
 *      Copyright (C) 2012-2014 DataStax Inc.
 *
 *   Licensed under the Apache License, Version 2.0 (the "License");
 *   you may not use this file except in compliance with the License.
 *   You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *   Unless required by applicable law or agreed to in writing, software
 *   distributed under the License is distributed on an "AS IS" BASIS,
 *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *   See the License for the specific language governing permissions and
 *   limitations under the License.
 */
package com.datastax.driver.auth;

import com.datastax.driver.core.Authenticator;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import javax.security.auth.Subject;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import java.net.InetSocketAddress;

/**
 * Responsible for authenticating with secured DSE services using Kerberos
 * over GSSAPI & SASL. The actual SASL negotiation is delegated to a
 * PrivilegedSaslClient which performs the priviledged actions on behalf
 * of the logged in user.
 */
public class KerberosAuthenticator implements Authenticator
{
    private static final Logger logger = LoggerFactory.getLogger(KerberosAuthenticator.class);

    public static final String JAAS_CONFIG_ENTRY = "DseClient";
    public static final String[] SUPPORTED_MECHANISMS = new String[]{"GSSAPI"};
    public static final String SASL_PROTOCOL_NAME = "dse";
    public static final String SASL_PROTOCOL_NAME_PROPERTY = "dse.sasl.protocol";

    private final PrivilegedSaslClient saslClient;

    public KerberosAuthenticator(InetSocketAddress host)
    {
        saslClient = new PrivilegedSaslClient(loginSubject(),
                SUPPORTED_MECHANISMS,
                null,
                System.getProperty(SASL_PROTOCOL_NAME_PROPERTY, SASL_PROTOCOL_NAME),
                host.getAddress().getCanonicalHostName(),
                PrivilegedSaslClient.DEFAULT_PROPERTIES,
                null);
    }

    private Subject loginSubject()
    {
        Subject subject = new Subject();
        try
        {
            LoginContext login = new LoginContext(JAAS_CONFIG_ENTRY, subject);
            login.login();
            return subject;
        } catch (LoginException e)
        {
            throw new RuntimeException(e);
        }
    }

    @Override
    public byte[] initialResponse()
    {
        return saslClient.getInitialResponse();
    }

    @Override
    public byte[] evaluateChallenge(byte[] challenge)
    {
        byte[] response = saslClient.evaluateChallenge(challenge);
        if (response == null)
        {
            // If we generate a null response, then authentication has completed (if
            // not, warn), and return without sending a response back to the server.
            logger.trace("Response to server is null: authentication should now be complete.");
            if (!saslClient.isComplete()) {
                String error = "Client generated a null sasl response, but authentication is not complete.";
                logger.error(error);
                throw new RuntimeException(error);
            }
        }
        return response;
    }

    @Override
    public void onAuthenticationSuccess(byte[] token)
    {
        // no-op
    }
}