org.apache.hadoop.security.authentication.server.PseudoAuthenticationHandler Maven / Gradle / Ivy
/**
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License. See accompanying LICENSE file.
*/
package org.apache.hadoop.security.authentication.server;
import org.apache.hadoop.security.authentication.client.AuthenticationException;
import org.apache.hadoop.security.authentication.client.PseudoAuthenticator;
import org.apache.http.client.utils.URLEncodedUtils;
import org.apache.http.NameValuePair;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.nio.charset.Charset;
import java.util.List;
import java.util.Properties;
/**
* The PseudoAuthenticationHandler provides a pseudo authentication mechanism that accepts
* the user name specified as a query string parameter.
*
* This mimics the model of Hadoop Simple authentication which trust the 'user.name' property provided in
* the configuration object.
*
* This handler can be configured to support anonymous users.
*
* The only supported configuration property is:
*
* - simple.anonymous.allowed:
true|false, default value is false
*
*/
public class PseudoAuthenticationHandler implements AuthenticationHandler {
/**
* Constant that identifies the authentication mechanism.
*/
public static final String TYPE = "simple";
/**
* Constant for the configuration property that indicates if anonymous users are allowed.
*/
public static final String ANONYMOUS_ALLOWED = TYPE + ".anonymous.allowed";
private static final Charset UTF8_CHARSET = Charset.forName("UTF-8");
private static final String PSEUDO_AUTH = "PseudoAuth";
private boolean acceptAnonymous;
private String type;
/**
* Creates a Hadoop pseudo authentication handler with the default auth-token
* type, simple.
*/
public PseudoAuthenticationHandler() {
this(TYPE);
}
/**
* Creates a Hadoop pseudo authentication handler with a custom auth-token
* type.
*
* @param type auth-token type.
*/
public PseudoAuthenticationHandler(String type) {
this.type = type;
}
/**
* Initializes the authentication handler instance.
*
* This method is invoked by the {@link AuthenticationFilter#init} method.
*
* @param config configuration properties to initialize the handler.
*
* @throws ServletException thrown if the handler could not be initialized.
*/
@Override
public void init(Properties config) throws ServletException {
acceptAnonymous = Boolean.parseBoolean(config.getProperty(ANONYMOUS_ALLOWED, "false"));
}
/**
* Returns if the handler is configured to support anonymous users.
*
* @return if the handler is configured to support anonymous users.
*/
protected boolean getAcceptAnonymous() {
return acceptAnonymous;
}
/**
* Releases any resources initialized by the authentication handler.
*
* This implementation does a NOP.
*/
@Override
public void destroy() {
}
/**
* Returns the authentication type of the authentication handler, 'simple'.
*
* @return the authentication type of the authentication handler, 'simple'.
*/
@Override
public String getType() {
return type;
}
/**
* This is an empty implementation, it always returns TRUE.
*
*
*
* @param token the authentication token if any, otherwise NULL.
* @param request the HTTP client request.
* @param response the HTTP client response.
*
* @return TRUE
* @throws IOException it is never thrown.
* @throws AuthenticationException it is never thrown.
*/
@Override
public boolean managementOperation(AuthenticationToken token,
HttpServletRequest request,
HttpServletResponse response)
throws IOException, AuthenticationException {
return true;
}
private String getUserName(HttpServletRequest request) {
String queryString = request.getQueryString();
if(queryString == null || queryString.length() == 0) {
return null;
}
List list = URLEncodedUtils.parse(queryString, UTF8_CHARSET);
if (list != null) {
for (NameValuePair nv : list) {
if (PseudoAuthenticator.USER_NAME.equals(nv.getName())) {
return nv.getValue();
}
}
}
return null;
}
/**
* Authenticates an HTTP client request.
*
* It extracts the {@link PseudoAuthenticator#USER_NAME} parameter from the query string and creates
* an {@link AuthenticationToken} with it.
*
* If the HTTP client request does not contain the {@link PseudoAuthenticator#USER_NAME} parameter and
* the handler is configured to allow anonymous users it returns the {@link AuthenticationToken#ANONYMOUS}
* token.
*
* If the HTTP client request does not contain the {@link PseudoAuthenticator#USER_NAME} parameter and
* the handler is configured to disallow anonymous users it throws an {@link AuthenticationException}.
*
* @param request the HTTP client request.
* @param response the HTTP client response.
*
* @return an authentication token if the HTTP client request is accepted and credentials are valid.
*
* @throws IOException thrown if an IO error occurred.
* @throws AuthenticationException thrown if HTTP client request was not accepted as an authentication request.
*/
@Override
public AuthenticationToken authenticate(HttpServletRequest request, HttpServletResponse response)
throws IOException, AuthenticationException {
AuthenticationToken token;
String userName = getUserName(request);
if (userName == null) {
if (getAcceptAnonymous()) {
token = AuthenticationToken.ANONYMOUS;
} else {
response.setStatus(HttpServletResponse.SC_FORBIDDEN);
response.setHeader(WWW_AUTHENTICATE, PSEUDO_AUTH);
token = null;
}
} else {
token = new AuthenticationToken(userName, userName, getType());
}
return token;
}
}