001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software
013 * distributed under the License is distributed on an "AS IS" BASIS,
014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
015 * See the License for the specific language governing permissions and
016 * limitations under the License.
017 */
018package org.apache.hadoop.hbase.http;
019
020import static org.junit.Assert.assertEquals;
021
022import java.io.IOException;
023import java.net.HttpURLConnection;
024import java.net.URL;
025import org.apache.commons.codec.binary.Base64;
026import org.apache.directory.server.annotations.CreateLdapServer;
027import org.apache.directory.server.annotations.CreateTransport;
028import org.apache.directory.server.core.annotations.ApplyLdifs;
029import org.apache.directory.server.core.annotations.ContextEntry;
030import org.apache.directory.server.core.annotations.CreateDS;
031import org.apache.directory.server.core.annotations.CreatePartition;
032import org.apache.directory.server.core.integ.CreateLdapServerRule;
033import org.apache.hadoop.conf.Configuration;
034import org.apache.hadoop.hbase.HBaseClassTestRule;
035import org.apache.hadoop.hbase.http.resource.JerseyResource;
036import org.apache.hadoop.hbase.testclassification.MiscTests;
037import org.apache.hadoop.hbase.testclassification.SmallTests;
038import org.junit.AfterClass;
039import org.junit.BeforeClass;
040import org.junit.ClassRule;
041import org.junit.Test;
042import org.junit.experimental.categories.Category;
043import org.slf4j.Logger;
044import org.slf4j.LoggerFactory;
045
046/**
047 * Test class for LDAP authentication on the HttpServer.
048 */
049@Category({ MiscTests.class, SmallTests.class })
050@CreateLdapServer(
051    transports = { @CreateTransport(protocol = "LDAP", address = LdapConstants.LDAP_SERVER_ADDR), })
052@CreateDS(allowAnonAccess = true,
053    partitions = { @CreatePartition(name = "Test_Partition", suffix = LdapConstants.LDAP_BASE_DN,
054        contextEntry = @ContextEntry(entryLdif = "dn: " + LdapConstants.LDAP_BASE_DN + " \n"
055          + "dc: example\n" + "objectClass: top\n" + "objectClass: domain\n\n")) })
056@ApplyLdifs({ "dn: uid=bjones," + LdapConstants.LDAP_BASE_DN, "cn: Bob Jones", "sn: Jones",
057  "objectClass: inetOrgPerson", "uid: bjones", "userPassword: p@ssw0rd" })
058public class TestLdapHttpServer extends HttpServerFunctionalTest {
059
060  @ClassRule
061  public static final HBaseClassTestRule CLASS_RULE =
062    HBaseClassTestRule.forClass(TestLdapHttpServer.class);
063  @ClassRule
064  public static CreateLdapServerRule serverRule = new CreateLdapServerRule();
065
066  private static final Logger LOG = LoggerFactory.getLogger(TestLdapHttpServer.class);
067
068  private static HttpServer server;
069  private static URL baseUrl;
070
071  @BeforeClass
072  public static void setupServer() throws Exception {
073    Configuration conf = new Configuration();
074    buildLdapConfiguration(conf);
075    server = createTestServer(conf);
076    server.addUnprivilegedServlet("echo", "/echo", TestHttpServer.EchoServlet.class);
077    server.addJerseyResourcePackage(JerseyResource.class.getPackage().getName(), "/jersey/*");
078    server.start();
079    baseUrl = getServerURL(server);
080
081    LOG.info("HTTP server started: " + baseUrl);
082  }
083
084  @AfterClass
085  public static void stopServer() throws Exception {
086    try {
087      if (null != server) {
088        server.stop();
089      }
090    } catch (Exception e) {
091      LOG.info("Failed to stop info server", e);
092    }
093  }
094
095  private static Configuration buildLdapConfiguration(Configuration conf) {
096
097    conf.setInt(HttpServer.HTTP_MAX_THREADS, TestHttpServer.MAX_THREADS);
098
099    // Enable LDAP (pre-req)
100    conf.set(HttpServer.HTTP_UI_AUTHENTICATION, "ldap");
101    conf.set(HttpServer.FILTER_INITIALIZERS_PROPERTY,
102      "org.apache.hadoop.hbase.http.lib.AuthenticationFilterInitializer");
103    conf.set("hadoop.http.authentication.type", "ldap");
104    conf.set("hadoop.http.authentication.ldap.providerurl", String.format("ldap://%s:%s",
105      LdapConstants.LDAP_SERVER_ADDR, serverRule.getLdapServer().getPort()));
106    conf.set("hadoop.http.authentication.ldap.enablestarttls", "false");
107    conf.set("hadoop.http.authentication.ldap.basedn", LdapConstants.LDAP_BASE_DN);
108    return conf;
109  }
110
111  @Test
112  public void testUnauthorizedClientsDisallowed() throws IOException {
113    URL url = new URL(getServerURL(server), "/echo?a=b");
114    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
115    assertEquals(HttpURLConnection.HTTP_UNAUTHORIZED, conn.getResponseCode());
116  }
117
118  @Test
119  public void testAllowedClient() throws IOException {
120    URL url = new URL(getServerURL(server), "/echo?a=b");
121    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
122    final Base64 base64 = new Base64(0);
123    String userCredentials = "bjones:p@ssw0rd";
124    String basicAuth = "Basic " + base64.encodeToString(userCredentials.getBytes());
125    conn.setRequestProperty("Authorization", basicAuth);
126    assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
127  }
128
129  @Test
130  public void testWrongAuthClientsDisallowed() throws IOException {
131    URL url = new URL(getServerURL(server), "/echo?a=b");
132    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
133    final Base64 base64 = new Base64(0);
134    String userCredentials = "bjones:password";
135    String basicAuth = "Basic " + base64.encodeToString(userCredentials.getBytes());
136    conn.setRequestProperty("Authorization", basicAuth);
137    assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode());
138  }
139
140}