[ https://issues.apache.org/jira/browse/DRILL-4280?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15623249#comment-15623249 ]
ASF GitHub Bot commented on DRILL-4280: --------------------------------------- Github user laurentgo commented on a diff in the pull request: https://github.com/apache/drill/pull/578#discussion_r85798863 --- Diff: contrib/native/client/src/clientlib/drillClientImpl.cpp --- @@ -1849,4 +2048,150 @@ void ZookeeperImpl:: debugPrint(){ } } +typedef int (*sasl_callback_proc_t)(void); // see sasl_callback_ft + +static int SaslAuthenticatorImpl::userNameCallback(void *context, int id, const char **result, unsigned *len) { + const std::string* const username = (const std::string* const) context; + + if ((SASL_CB_USER == id || SASL_CB_AUTHNAME == id) + && username != NULL) { + *result = username->c_str(); +// *len = (unsigned int) username->length(); + } + return SASL_OK; +} + +static int SaslAuthenticatorImpl::passwordCallback(sasl_conn_t *conn, void *context, int id, sasl_secret_t **psecret) { + const SaslAuthenticatorImpl* const authenticator = (const SaslAuthenticatorImpl* const) context; + + if (SASL_CB_PASS == id) { + const std::string password = authenticator->m_password; + const size_t length = password.length(); + authenticator->m_secret->len = length; + std::memcpy(authenticator->m_secret->data, password.c_str(), length); + *psecret = authenticator->m_secret; + } + return SASL_OK; +} + +SaslAuthenticatorImpl::SaslAuthenticatorImpl(const DrillUserProperties* const properties) : + m_properties(properties), m_pConnection(NULL), m_secret(NULL), m_servicename(NULL), m_servicehost(NULL) { +} + +SaslAuthenticatorImpl::~SaslAuthenticatorImpl() { + if (m_secret) { + free(m_secret); + } + // may be to use negotiated security layers before disposing in the future + if (m_pConnection) { + sasl_dispose(&m_pConnection); + } + m_pConnection = NULL; +} + +int SaslAuthenticatorImpl::init(std::vector<std::string> mechanisms, + std::string &chosenMech, + const char **out, + unsigned *outlen) { + // set params + std::string authMechanismToUse = NULL; + for (size_t i = 0; i < m_properties->size(); i++) { + const std::map<std::string, uint32_t>::const_iterator it = + DrillUserProperties::USER_PROPERTIES.find(m_properties->keyAt(i)); + if (it == DrillUserProperties::USER_PROPERTIES.end()) { + continue; + } + if (IS_BITSET((*it).second, USERPROP_FLAGS_USERNAME)) { + DRILL_MT_LOG(DRILL_LOG(LOG_TRACE) << "Setting name" << std::endl;) + m_username = m_properties->valueAt(i); + continue; + } + if (IS_BITSET((*it).second, USERPROP_FLAGS_PASSWORD)) { + DRILL_MT_LOG(DRILL_LOG(LOG_TRACE) << "Setting password" << std::endl;) + m_password = m_properties->valueAt(i); + m_secret = (sasl_secret_t *) malloc(sizeof(sasl_secret_t) + m_password.length()); + authMechanismToUse = "plain"; + continue; + } + if (IS_BITSET((*it).second, USERPROP_FLAGS_AUTH_MECHANISM)) { + DRILL_MT_LOG(DRILL_LOG(LOG_TRACE) << "Setting service name" << std::endl;) + authMechanismToUse = m_properties->valueAt(i); + continue; + } + if (IS_BITSET((*it).second, USERPROP_FLAGS_SERVICE_NAME)) { + DRILL_MT_LOG(DRILL_LOG(LOG_TRACE) << "Setting service name" << std::endl;) + m_servicename = m_properties->valueAt(i); + continue; + } + if (IS_BITSET((*it).second, USERPROP_FLAGS_SERVICE_HOST)) { + DRILL_MT_LOG(DRILL_LOG(LOG_TRACE) << "Setting service host" << std::endl;) + m_servicehost = m_properties->valueAt(i); + } + } + if (authMechanismToUse == NULL) { + return SASL_NOMECH; + } + + bool isSupportedByServer = false; + for (size_t i = 0; i < mechanisms.size(); i++) { + std::string mechanism = mechanisms[i]; --- End diff -- you can use a const reference > Kerberos Authentication > ----------------------- > > Key: DRILL-4280 > URL: https://issues.apache.org/jira/browse/DRILL-4280 > Project: Apache Drill > Issue Type: Improvement > Reporter: Keys Botzum > Assignee: Chunhui Shi > Labels: security > > Drill should support Kerberos based authentication from clients. This means > that both the ODBC and JDBC drivers as well as the web/REST interfaces should > support inbound Kerberos. For Web this would most likely be SPNEGO while for > ODBC and JDBC this will be more generic Kerberos. > Since Hive and much of Hadoop supports Kerberos there is a potential for a > lot of reuse of ideas if not implementation. > Note that this is related to but not the same as > https://issues.apache.org/jira/browse/DRILL-3584 -- This message was sent by Atlassian JIRA (v6.3.4#6332)