001/* 002 * Licensed to the Apache Software Foundation (ASF) under one 003 * or more contributor license agreements. See the NOTICE file 004 * distributed with this work for additional information 005 * regarding copyright ownership. The ASF licenses this file 006 * to you under the Apache License, Version 2.0 (the 007 * "License"); you may not use this file except in compliance 008 * with the License. You may obtain a copy of the License at 009 * 010 * http://www.apache.org/licenses/LICENSE-2.0 011 * 012 * Unless required by applicable law or agreed to in writing, software 013 * distributed under the License is distributed on an "AS IS" BASIS, 014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 015 * See the License for the specific language governing permissions and 016 * limitations under the License. 017 */ 018package org.apache.hadoop.hbase.security.provider; 019 020import java.io.IOException; 021import java.net.InetAddress; 022import java.util.Map; 023import javax.security.auth.callback.Callback; 024import javax.security.auth.callback.CallbackHandler; 025import javax.security.auth.callback.NameCallback; 026import javax.security.auth.callback.PasswordCallback; 027import javax.security.auth.callback.UnsupportedCallbackException; 028import javax.security.sasl.RealmCallback; 029import javax.security.sasl.RealmChoiceCallback; 030import javax.security.sasl.Sasl; 031import javax.security.sasl.SaslClient; 032import org.apache.hadoop.conf.Configuration; 033import org.apache.hadoop.hbase.security.SaslUtil; 034import org.apache.hadoop.hbase.security.User; 035import org.apache.hadoop.security.token.Token; 036import org.apache.hadoop.security.token.TokenIdentifier; 037import org.apache.yetus.audience.InterfaceAudience; 038import org.slf4j.Logger; 039import org.slf4j.LoggerFactory; 040 041import org.apache.hadoop.hbase.shaded.protobuf.generated.RPCProtos.UserInformation; 042 043@InterfaceAudience.Private 044public class DigestSaslClientAuthenticationProvider extends DigestSaslAuthenticationProvider 045 implements SaslClientAuthenticationProvider { 046 047 @Override 048 public SaslClient createClient(Configuration conf, InetAddress serverAddr, String serverPrincipal, 049 Token<? extends TokenIdentifier> token, boolean fallbackAllowed, Map<String, String> saslProps) 050 throws IOException { 051 return Sasl.createSaslClient(new String[] { getSaslAuthMethod().getSaslMechanism() }, null, 052 null, SaslUtil.SASL_DEFAULT_REALM, saslProps, new DigestSaslClientCallbackHandler(token)); 053 } 054 055 public static class DigestSaslClientCallbackHandler implements CallbackHandler { 056 private static final Logger LOG = 057 LoggerFactory.getLogger(DigestSaslClientCallbackHandler.class); 058 private final String userName; 059 private final char[] userPassword; 060 061 public DigestSaslClientCallbackHandler(Token<? extends TokenIdentifier> token) { 062 this.userName = SaslUtil.encodeIdentifier(token.getIdentifier()); 063 this.userPassword = SaslUtil.encodePassword(token.getPassword()); 064 } 065 066 @Override 067 public void handle(Callback[] callbacks) throws UnsupportedCallbackException { 068 NameCallback nc = null; 069 PasswordCallback pc = null; 070 RealmCallback rc = null; 071 for (Callback callback : callbacks) { 072 if (callback instanceof RealmChoiceCallback) { 073 continue; 074 } else if (callback instanceof NameCallback) { 075 nc = (NameCallback) callback; 076 } else if (callback instanceof PasswordCallback) { 077 pc = (PasswordCallback) callback; 078 } else if (callback instanceof RealmCallback) { 079 rc = (RealmCallback) callback; 080 } else { 081 throw new UnsupportedCallbackException(callback, "Unrecognized SASL client callback"); 082 } 083 } 084 if (nc != null) { 085 LOG.debug("SASL client callback: setting username: {}", userName); 086 nc.setName(userName); 087 } 088 if (pc != null) { 089 LOG.debug("SASL client callback: setting userPassword"); 090 pc.setPassword(userPassword); 091 } 092 if (rc != null) { 093 LOG.debug("SASL client callback: setting realm: {}", rc.getDefaultText()); 094 rc.setText(rc.getDefaultText()); 095 } 096 } 097 } 098 099 @Override 100 public UserInformation getUserInfo(User user) { 101 // Don't send user for token auth. Copied from RpcConnection. 102 return null; 103 } 104}