001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software
013 * distributed under the License is distributed on an "AS IS" BASIS,
014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
015 * See the License for the specific language governing permissions and
016 * limitations under the License.
017 */
018package org.apache.hadoop.hbase.http;
019
020import static org.junit.jupiter.api.Assertions.assertEquals;
021import static org.junit.jupiter.api.Assertions.assertFalse;
022import static org.junit.jupiter.api.Assertions.assertNotNull;
023import static org.junit.jupiter.api.Assertions.assertTrue;
024
025import java.io.File;
026import java.net.HttpURLConnection;
027import java.net.URL;
028import java.security.Principal;
029import java.security.PrivilegedExceptionAction;
030import java.util.Set;
031import javax.security.auth.Subject;
032import javax.security.auth.kerberos.KerberosTicket;
033import org.apache.hadoop.conf.Configuration;
034import org.apache.hadoop.hbase.HBaseCommonTestingUtil;
035import org.apache.hadoop.hbase.http.TestHttpServer.EchoServlet;
036import org.apache.hadoop.hbase.http.resource.JerseyResource;
037import org.apache.hadoop.hbase.testclassification.MiscTests;
038import org.apache.hadoop.hbase.testclassification.SmallTests;
039import org.apache.hadoop.hbase.util.SimpleKdcServerUtil;
040import org.apache.hadoop.security.authentication.util.KerberosName;
041import org.apache.hadoop.security.authorize.AccessControlList;
042import org.apache.http.HttpHost;
043import org.apache.http.HttpResponse;
044import org.apache.http.auth.AuthSchemeProvider;
045import org.apache.http.auth.AuthScope;
046import org.apache.http.auth.KerberosCredentials;
047import org.apache.http.client.HttpClient;
048import org.apache.http.client.config.AuthSchemes;
049import org.apache.http.client.methods.HttpGet;
050import org.apache.http.client.protocol.HttpClientContext;
051import org.apache.http.config.Lookup;
052import org.apache.http.config.RegistryBuilder;
053import org.apache.http.impl.auth.SPNegoSchemeFactory;
054import org.apache.http.impl.client.BasicCredentialsProvider;
055import org.apache.http.impl.client.HttpClients;
056import org.apache.http.util.EntityUtils;
057import org.apache.kerby.kerberos.kerb.KrbException;
058import org.apache.kerby.kerberos.kerb.client.JaasKrbUtil;
059import org.apache.kerby.kerberos.kerb.server.SimpleKdcServer;
060import org.ietf.jgss.GSSCredential;
061import org.ietf.jgss.GSSManager;
062import org.ietf.jgss.GSSName;
063import org.ietf.jgss.Oid;
064import org.junit.jupiter.api.AfterAll;
065import org.junit.jupiter.api.BeforeAll;
066import org.junit.jupiter.api.Tag;
067import org.junit.jupiter.api.Test;
068import org.slf4j.Logger;
069import org.slf4j.LoggerFactory;
070
071/**
072 * Test class for SPNEGO Proxyuser authentication on the HttpServer. Uses Kerby's MiniKDC and Apache
073 * HttpComponents to verify that the doas= mechanicsm works, and that the proxyuser settings are
074 * observed.
075 */
076@Tag(MiscTests.TAG)
077@Tag(SmallTests.TAG)
078public class TestProxyUserSpnegoHttpServer extends HttpServerFunctionalTest {
079
080  private static final Logger LOG = LoggerFactory.getLogger(TestProxyUserSpnegoHttpServer.class);
081  private static final String KDC_SERVER_HOST = "localhost";
082  private static final String WHEEL_PRINCIPAL = "wheel";
083  private static final String UNPRIVILEGED_PRINCIPAL = "unprivileged";
084  private static final String PRIVILEGED_PRINCIPAL = "privileged";
085  private static final String PRIVILEGED2_PRINCIPAL = "privileged2";
086
087  private static HttpServer server;
088  private static URL baseUrl;
089  private static SimpleKdcServer kdc;
090  private static File infoServerKeytab;
091  private static File wheelKeytab;
092  private static File unprivilegedKeytab;
093  private static File privilegedKeytab;
094  private static File privileged2Keytab;
095
096  @BeforeAll
097  public static void setupServer() throws Exception {
098    Configuration conf = new Configuration();
099    HBaseCommonTestingUtil htu = new HBaseCommonTestingUtil(conf);
100
101    final String serverPrincipal = "HTTP/" + KDC_SERVER_HOST;
102
103    kdc = SimpleKdcServerUtil.getRunningSimpleKdcServer(new File(htu.getDataTestDir().toString()),
104      HBaseCommonTestingUtil::randomFreePort);
105    File keytabDir = new File(htu.getDataTestDir("keytabs").toString());
106    if (keytabDir.exists()) {
107      deleteRecursively(keytabDir);
108    }
109    keytabDir.mkdirs();
110
111    infoServerKeytab = new File(keytabDir, serverPrincipal.replace('/', '_') + ".keytab");
112    wheelKeytab = new File(keytabDir, WHEEL_PRINCIPAL + ".keytab");
113    unprivilegedKeytab = new File(keytabDir, UNPRIVILEGED_PRINCIPAL + ".keytab");
114    privilegedKeytab = new File(keytabDir, PRIVILEGED_PRINCIPAL + ".keytab");
115    privileged2Keytab = new File(keytabDir, PRIVILEGED2_PRINCIPAL + ".keytab");
116
117    setupUser(kdc, wheelKeytab, WHEEL_PRINCIPAL);
118    setupUser(kdc, unprivilegedKeytab, UNPRIVILEGED_PRINCIPAL);
119    setupUser(kdc, privilegedKeytab, PRIVILEGED_PRINCIPAL);
120    setupUser(kdc, privileged2Keytab, PRIVILEGED2_PRINCIPAL);
121
122    setupUser(kdc, infoServerKeytab, serverPrincipal);
123
124    buildSpnegoConfiguration(conf, serverPrincipal, infoServerKeytab);
125    AccessControlList acl = InfoServer.buildAdminAcl(conf);
126
127    server = createTestServerWithSecurityAndAcl(conf, acl);
128    server.addPrivilegedServlet("echo", "/echo", EchoServlet.class);
129    server.addJerseyResourcePackage(JerseyResource.class.getPackage().getName(), "/jersey/*");
130    server.start();
131    baseUrl = getServerURL(server);
132
133    LOG.info("HTTP server started: " + baseUrl);
134  }
135
136  @AfterAll
137  public static void stopServer() throws Exception {
138    try {
139      if (null != server) {
140        server.stop();
141      }
142    } catch (Exception e) {
143      LOG.info("Failed to stop info server", e);
144    }
145    try {
146      if (null != kdc) {
147        kdc.stop();
148      }
149    } catch (Exception e) {
150      LOG.info("Failed to stop mini KDC", e);
151    }
152  }
153
154  private static void setupUser(SimpleKdcServer kdc, File keytab, String principal)
155    throws KrbException {
156    kdc.createPrincipal(principal);
157    kdc.exportPrincipal(principal, keytab);
158  }
159
160  protected static Configuration buildSpnegoConfiguration(Configuration conf,
161    String serverPrincipal, File serverKeytab) {
162    KerberosName.setRules("DEFAULT");
163
164    conf.setInt(HttpServer.HTTP_MAX_THREADS, TestHttpServer.MAX_THREADS);
165
166    // Enable Kerberos (pre-req)
167    conf.set("hbase.security.authentication", "kerberos");
168    conf.set(HttpServer.HTTP_UI_AUTHENTICATION, "kerberos");
169    conf.set(HttpServer.HTTP_SPNEGO_AUTHENTICATION_PRINCIPAL_KEY, serverPrincipal);
170    conf.set(HttpServer.HTTP_SPNEGO_AUTHENTICATION_KEYTAB_KEY, serverKeytab.getAbsolutePath());
171
172    conf.set(HttpServer.HTTP_SPNEGO_AUTHENTICATION_ADMIN_USERS_KEY, PRIVILEGED_PRINCIPAL);
173    conf.set(HttpServer.HTTP_SPNEGO_AUTHENTICATION_PROXYUSER_ENABLE_KEY, "true");
174    conf.set("hadoop.security.authorization", "true");
175
176    conf.set("hadoop.proxyuser.wheel.hosts", "*");
177    conf.set("hadoop.proxyuser.wheel.users", PRIVILEGED_PRINCIPAL + "," + UNPRIVILEGED_PRINCIPAL);
178    return conf;
179  }
180
181  @Test
182  public void testProxyAllowed() throws Exception {
183    testProxy(WHEEL_PRINCIPAL, PRIVILEGED_PRINCIPAL, HttpURLConnection.HTTP_OK, null);
184  }
185
186  @Test
187  public void testProxyDisallowedForUnprivileged() throws Exception {
188    testProxy(WHEEL_PRINCIPAL, UNPRIVILEGED_PRINCIPAL, HttpURLConnection.HTTP_FORBIDDEN,
189      "403 User unprivileged is unauthorized to access this page.");
190  }
191
192  @Test
193  public void testProxyDisallowedForNotSudoAble() throws Exception {
194    testProxy(WHEEL_PRINCIPAL, PRIVILEGED2_PRINCIPAL, HttpURLConnection.HTTP_FORBIDDEN,
195      "403 Forbidden");
196  }
197
198  public void testProxy(String clientPrincipal, String doAs, int responseCode, String statusLine)
199    throws Exception {
200    // Create the subject for the client
201    final Subject clientSubject = JaasKrbUtil.loginUsingKeytab(WHEEL_PRINCIPAL, wheelKeytab);
202    final Set<Principal> clientPrincipals = clientSubject.getPrincipals();
203    // Make sure the subject has a principal
204    assertFalse(clientPrincipals.isEmpty());
205
206    // Get a TGT for the subject (might have many, different encryption types). The first should
207    // be the default encryption type.
208    Set<KerberosTicket> privateCredentials =
209      clientSubject.getPrivateCredentials(KerberosTicket.class);
210    assertFalse(privateCredentials.isEmpty());
211    KerberosTicket tgt = privateCredentials.iterator().next();
212    assertNotNull(tgt);
213
214    // The name of the principal
215    final String principalName = clientPrincipals.iterator().next().getName();
216
217    // Run this code, logged in as the subject (the client)
218    HttpResponse resp = Subject.doAs(clientSubject, new PrivilegedExceptionAction<HttpResponse>() {
219      @Override
220      public HttpResponse run() throws Exception {
221        // Logs in with Kerberos via GSS
222        GSSManager gssManager = GSSManager.getInstance();
223        // jGSS Kerberos login constant
224        Oid oid = new Oid("1.2.840.113554.1.2.2");
225        GSSName gssClient = gssManager.createName(principalName, GSSName.NT_USER_NAME);
226        GSSCredential credential = gssManager.createCredential(gssClient,
227          GSSCredential.DEFAULT_LIFETIME, oid, GSSCredential.INITIATE_ONLY);
228
229        HttpClientContext context = HttpClientContext.create();
230        Lookup<AuthSchemeProvider> authRegistry = RegistryBuilder.<AuthSchemeProvider> create()
231          .register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory(true, true)).build();
232
233        HttpClient client = HttpClients.custom().setDefaultAuthSchemeRegistry(authRegistry).build();
234        BasicCredentialsProvider credentialsProvider = new BasicCredentialsProvider();
235        credentialsProvider.setCredentials(AuthScope.ANY, new KerberosCredentials(credential));
236
237        URL url = new URL(getServerURL(server), "/echo?doAs=" + doAs + "&a=b");
238        context.setTargetHost(new HttpHost(url.getHost(), url.getPort()));
239        context.setCredentialsProvider(credentialsProvider);
240        context.setAuthSchemeRegistry(authRegistry);
241
242        HttpGet get = new HttpGet(url.toURI());
243        return client.execute(get, context);
244      }
245    });
246
247    assertNotNull(resp);
248    assertEquals(responseCode, resp.getStatusLine().getStatusCode());
249    if (responseCode == HttpURLConnection.HTTP_OK) {
250      assertTrue(EntityUtils.toString(resp.getEntity()).trim().contains("a:b"));
251    } else {
252      assertTrue(resp.getStatusLine().toString().contains(statusLine)
253        || EntityUtils.toString(resp.getEntity()).contains(statusLine));
254    }
255  }
256
257}