001/* 002 * Licensed to the Apache Software Foundation (ASF) under one 003 * or more contributor license agreements. See the NOTICE file 004 * distributed with this work for additional information 005 * regarding copyright ownership. The ASF licenses this file 006 * to you under the Apache License, Version 2.0 (the 007 * "License"); you may not use this file except in compliance 008 * with the License. You may obtain a copy of the License at 009 * 010 * http://www.apache.org/licenses/LICENSE-2.0 011 * 012 * Unless required by applicable law or agreed to in writing, software 013 * distributed under the License is distributed on an "AS IS" BASIS, 014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 015 * See the License for the specific language governing permissions and 016 * limitations under the License. 017 */ 018package org.apache.hadoop.hbase.security.provider; 019 020import java.io.IOException; 021import java.net.InetAddress; 022import java.util.Map; 023 024import javax.security.auth.callback.Callback; 025import javax.security.auth.callback.CallbackHandler; 026import javax.security.auth.callback.NameCallback; 027import javax.security.auth.callback.PasswordCallback; 028import javax.security.auth.callback.UnsupportedCallbackException; 029import javax.security.sasl.RealmCallback; 030import javax.security.sasl.RealmChoiceCallback; 031import javax.security.sasl.Sasl; 032import javax.security.sasl.SaslClient; 033 034import org.apache.hadoop.conf.Configuration; 035import org.apache.hadoop.hbase.security.SaslUtil; 036import org.apache.hadoop.hbase.security.SecurityInfo; 037import org.apache.hadoop.hbase.security.User; 038import org.apache.hadoop.security.token.Token; 039import org.apache.hadoop.security.token.TokenIdentifier; 040import org.apache.yetus.audience.InterfaceAudience; 041import org.slf4j.Logger; 042import org.slf4j.LoggerFactory; 043 044import org.apache.hadoop.hbase.shaded.protobuf.generated.RPCProtos.UserInformation; 045 046@InterfaceAudience.Private 047public class DigestSaslClientAuthenticationProvider extends DigestSaslAuthenticationProvider 048 implements SaslClientAuthenticationProvider { 049 050 @Override 051 public SaslClient createClient(Configuration conf, InetAddress serverAddr, 052 SecurityInfo securityInfo, Token<? extends TokenIdentifier> token, boolean fallbackAllowed, 053 Map<String, String> saslProps) throws IOException { 054 return Sasl.createSaslClient(new String[] { getSaslAuthMethod().getSaslMechanism() }, null, 055 null, SaslUtil.SASL_DEFAULT_REALM, saslProps, new DigestSaslClientCallbackHandler(token)); 056 } 057 058 public static class DigestSaslClientCallbackHandler implements CallbackHandler { 059 private static final Logger LOG = 060 LoggerFactory.getLogger(DigestSaslClientCallbackHandler.class); 061 private final String userName; 062 private final char[] userPassword; 063 064 public DigestSaslClientCallbackHandler(Token<? extends TokenIdentifier> token) { 065 this.userName = SaslUtil.encodeIdentifier(token.getIdentifier()); 066 this.userPassword = SaslUtil.encodePassword(token.getPassword()); 067 } 068 069 @Override 070 public void handle(Callback[] callbacks) throws UnsupportedCallbackException { 071 NameCallback nc = null; 072 PasswordCallback pc = null; 073 RealmCallback rc = null; 074 for (Callback callback : callbacks) { 075 if (callback instanceof RealmChoiceCallback) { 076 continue; 077 } else if (callback instanceof NameCallback) { 078 nc = (NameCallback) callback; 079 } else if (callback instanceof PasswordCallback) { 080 pc = (PasswordCallback) callback; 081 } else if (callback instanceof RealmCallback) { 082 rc = (RealmCallback) callback; 083 } else { 084 throw new UnsupportedCallbackException(callback, "Unrecognized SASL client callback"); 085 } 086 } 087 if (nc != null) { 088 LOG.debug("SASL client callback: setting username: {}", userName); 089 nc.setName(userName); 090 } 091 if (pc != null) { 092 LOG.debug("SASL client callback: setting userPassword"); 093 pc.setPassword(userPassword); 094 } 095 if (rc != null) { 096 LOG.debug("SASL client callback: setting realm: {}", rc.getDefaultText()); 097 rc.setText(rc.getDefaultText()); 098 } 099 } 100 } 101 102 @Override 103 public UserInformation getUserInfo(User user) { 104 // Don't send user for token auth. Copied from RpcConnection. 105 return null; 106 } 107}