org.apache.thrift.transport.TSaslClientTransport Maven / Gradle / Ivy

Go to download
Show more of this group Show more artifacts with this name
Show all versions of libthrift Show documentation
Thrift is a software framework for scalable cross-language services development.
There is a newer version: 0.21.0
/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements. See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership. The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License. You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied. See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

package org.apache.thrift.transport;

import java.nio.charset.StandardCharsets;
import java.util.Map;
import javax.security.auth.callback.CallbackHandler;
import javax.security.sasl.Sasl;
import javax.security.sasl.SaslClient;
import javax.security.sasl.SaslException;
import org.apache.thrift.transport.sasl.NegotiationStatus;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

/**
 * Wraps another Thrift TTransport, but performs SASL client negotiation on the call to
 * open(). This class will wrap ensuing communication over it, if a SASL QOP is
 * negotiated with the other party.
 */
public class TSaslClientTransport extends TSaslTransport {

  private static final Logger LOGGER = LoggerFactory.getLogger(TSaslClientTransport.class);

  /** The name of the mechanism this client supports. */
  private final String mechanism;

  /**
   * Uses the given SaslClient.
   *
   * @param saslClient The SaslClient to use for the subsequent SASL negotiation.
   * @param transport Transport underlying this one.
   */
  public TSaslClientTransport(SaslClient saslClient, TTransport transport)
      throws TTransportException {
    super(saslClient, transport);
    mechanism = saslClient.getMechanismName();
  }

  /**
   * Creates a SaslClient using the given SASL-specific parameters. See the Java
   * documentation for Sasl.createSaslClient for the details of the parameters.
   *
   * @param transport The underlying Thrift transport.
   * @throws SaslException
   */
  public TSaslClientTransport(
      String mechanism,
      String authorizationId,
      String protocol,
      String serverName,
      Map props,
      CallbackHandler cbh,
      TTransport transport)
      throws SaslException, TTransportException {
    super(
        Sasl.createSaslClient(
            new String[] {mechanism}, authorizationId, protocol, serverName, props, cbh),
        transport);
    this.mechanism = mechanism;
  }

  @Override
  protected SaslRole getRole() {
    return SaslRole.CLIENT;
  }

  /**
   * Performs the client side of the initial portion of the Thrift SASL protocol. Generates and
   * sends the initial response to the server, including which mechanism this client wants to use.
   */
  @Override
  protected void handleSaslStartMessage() throws TTransportException, SaslException {
    SaslClient saslClient = getSaslClient();

    byte[] initialResponse = new byte[0];
    if (saslClient.hasInitialResponse())
      initialResponse = saslClient.evaluateChallenge(initialResponse);

    LOGGER.debug(
        "Sending mechanism name {} and initial response of length {}",
        mechanism,
        initialResponse.length);

    byte[] mechanismBytes = mechanism.getBytes(StandardCharsets.UTF_8);
    sendSaslMessage(NegotiationStatus.START, mechanismBytes);
    // Send initial response
    sendSaslMessage(
        saslClient.isComplete() ? NegotiationStatus.COMPLETE : NegotiationStatus.OK,
        initialResponse);
    underlyingTransport.flush();
  }
}