1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 package org.apache.hadoop.hbase.security;
20
21 import org.apache.commons.codec.binary.Base64;
22 import org.apache.hadoop.hbase.classification.InterfaceAudience;
23
24 import java.util.Map;
25 import java.util.TreeMap;
26
27 import javax.security.sasl.Sasl;
28
29 import org.apache.commons.codec.binary.Base64;
30 import org.apache.commons.logging.Log;
31 import org.apache.commons.logging.LogFactory;
32 import org.apache.hadoop.hbase.classification.InterfaceAudience;
33
34 @InterfaceAudience.Private
35 public class SaslUtil {
36 private static final Log log = LogFactory.getLog(SaslUtil.class);
37 public static final String SASL_DEFAULT_REALM = "default";
38 public static final Map<String, String> SASL_PROPS =
39 new TreeMap<String, String>();
40 public static final int SWITCH_TO_SIMPLE_AUTH = -88;
41
42 public static enum QualityOfProtection {
43 AUTHENTICATION("auth"),
44 INTEGRITY("auth-int"),
45 PRIVACY("auth-conf");
46
47 public final String saslQop;
48
49 private QualityOfProtection(String saslQop) {
50 this.saslQop = saslQop;
51 }
52
53 public String getSaslQop() {
54 return saslQop;
55 }
56 }
57
58
59 public static String[] splitKerberosName(String fullName) {
60 return fullName.split("[/@]");
61 }
62
63 static String encodeIdentifier(byte[] identifier) {
64 return new String(Base64.encodeBase64(identifier));
65 }
66
67 static byte[] decodeIdentifier(String identifier) {
68 return Base64.decodeBase64(identifier.getBytes());
69 }
70
71 static char[] encodePassword(byte[] password) {
72 return new String(Base64.encodeBase64(password)).toCharArray();
73 }
74
75
76
77
78
79
80 public static QualityOfProtection getQop(String stringQop) {
81 QualityOfProtection qop = null;
82 if (QualityOfProtection.AUTHENTICATION.name().toLowerCase().equals(stringQop)
83 || QualityOfProtection.AUTHENTICATION.saslQop.equals(stringQop)) {
84 qop = QualityOfProtection.AUTHENTICATION;
85 } else if (QualityOfProtection.INTEGRITY.name().toLowerCase().equals(stringQop)
86 || QualityOfProtection.INTEGRITY.saslQop.equals(stringQop)) {
87 qop = QualityOfProtection.INTEGRITY;
88 } else if (QualityOfProtection.PRIVACY.name().toLowerCase().equals(stringQop)
89 || QualityOfProtection.PRIVACY.saslQop.equals(stringQop)) {
90 qop = QualityOfProtection.PRIVACY;
91 }
92 if (qop == null) {
93 throw new IllegalArgumentException("Invalid qop: " + stringQop
94 + ". It must be one of 'authentication', 'integrity', 'privacy'.");
95 }
96 if (QualityOfProtection.AUTHENTICATION.saslQop.equals(stringQop)
97 || QualityOfProtection.INTEGRITY.saslQop.equals(stringQop)
98 || QualityOfProtection.PRIVACY.saslQop.equals(stringQop)) {
99 log.warn("Use authentication/integrity/privacy as value for rpc protection "
100 + "configurations instead of auth/auth-int/auth-conf.");
101 }
102 return qop;
103 }
104
105 static void initSaslProperties(String rpcProtection) {
106 QualityOfProtection saslQOP = getQop(rpcProtection);
107 if (saslQOP == null) {
108 saslQOP = QualityOfProtection.AUTHENTICATION;
109 }
110 SaslUtil.SASL_PROPS.put(Sasl.QOP, saslQOP.getSaslQop());
111 SaslUtil.SASL_PROPS.put(Sasl.SERVER_AUTH, "true");
112 }
113 }