[ https://issues.apache.org/jira/browse/DRILL-4280?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15803146#comment-15803146 ]
ASF GitHub Bot commented on DRILL-4280: --------------------------------------- Github user sohami commented on a diff in the pull request: https://github.com/apache/drill/pull/578#discussion_r94700422 --- Diff: exec/java-exec/src/main/java/org/apache/drill/exec/rpc/user/UserAuthenticationUtil.java --- @@ -0,0 +1,255 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.drill.exec.rpc.user; + +import com.google.common.base.Function; +import com.google.common.base.Strings; +import com.google.common.collect.ImmutableSet; +import com.google.common.collect.Iterators; +import org.apache.drill.common.KerberosUtil; +import org.apache.drill.common.config.ConnectionParameters; +import org.apache.hadoop.conf.Configuration; +import org.apache.hadoop.fs.CommonConfigurationKeys; +import org.apache.hadoop.security.UserGroupInformation; + +import javax.annotation.Nullable; +import javax.security.auth.Subject; +import javax.security.auth.callback.Callback; +import javax.security.auth.callback.CallbackHandler; +import javax.security.auth.callback.NameCallback; +import javax.security.auth.callback.PasswordCallback; +import javax.security.auth.callback.UnsupportedCallbackException; +import javax.security.auth.login.LoginException; +import javax.security.sasl.Sasl; +import javax.security.sasl.SaslClient; +import javax.security.sasl.SaslException; +import java.io.IOException; +import java.lang.reflect.UndeclaredThrowableException; +import java.security.AccessController; +import java.security.PrivilegedExceptionAction; +import java.util.List; +import java.util.Set; + +public final class UserAuthenticationUtil { + private static final org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger(UserAuthenticationUtil.class); + + private static final String PLAIN_MECHANISM = "PLAIN"; + + private static final String DEFAULT_SERVICE_NAME = System.getProperty("service.name.primary", "drill"); + + private static final String DEFAULT_REALM_NAME = System.getProperty("service.name.realm", "default"); + + public enum ClientAuthenticationProvider { + + KERBEROS { + @Override + public UserGroupInformation login(final ConnectionParameters parameters) throws SaslException { + final Configuration conf = new Configuration(); + conf.set(CommonConfigurationKeys.HADOOP_SECURITY_AUTHENTICATION, + UserGroupInformation.AuthenticationMethod.KERBEROS.toString()); + UserGroupInformation.setConfiguration(conf); + + final String keytab = parameters.getParameter(ConnectionParameters.KEYTAB); + final boolean assumeSubject = parameters.getParameter(ConnectionParameters.KERBEROS_FROM_SUBJECT) != null && + Boolean.parseBoolean(parameters.getParameter(ConnectionParameters.KERBEROS_FROM_SUBJECT)); + try { + final UserGroupInformation ugi; + if (assumeSubject) { + ugi = UserGroupInformation.getUGIFromSubject(Subject.getSubject(AccessController.getContext())); + logger.debug("Assuming subject for {}.", ugi.getShortUserName()); + } else { + if (keytab != null) { + ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI( + parameters.getParameter(ConnectionParameters.USER), keytab); + logger.debug("Logged in {} using keytab.", ugi.getShortUserName()); + } else { + // includes Kerberos ticket login + ugi = UserGroupInformation.getCurrentUser(); + logger.debug("Logged in {} using ticket.", ugi.getShortUserName()); + } + } + return ugi; + } catch (final IOException e) { + logger.debug("Login failed.", e); + final Throwable cause = e.getCause(); + if (cause instanceof LoginException) { + throw new SaslException("Failed to login.", cause); + } + throw new SaslException("Unexpected failure trying to login.", cause); + } + } + + @Override + public SaslClient createSaslClient(final UserGroupInformation ugi, + final ConnectionParameters parameters) throws SaslException { + final String servicePrincipal = getServicePrincipal(parameters); + + final String parts[] = KerberosUtil.splitPrincipalIntoParts(servicePrincipal); + final String serviceName = parts[0]; + final String serviceHostName = parts[1]; + // ignore parts[2]; GSSAPI gets the realm info from the ticket + try { + final SaslClient saslClient = ugi.doAs(new PrivilegedExceptionAction<SaslClient>() { + + @Override + public SaslClient run() throws Exception { + return Sasl.createSaslClient(new String[]{KerberosUtil.KERBEROS_SASL_NAME}, + null /** authorization ID */, serviceName, serviceHostName, + null /** properties; default QOP is auth */, new CallbackHandler() { + @Override + public void handle(final Callback[] callbacks) + throws IOException, UnsupportedCallbackException { + throw new UnsupportedCallbackException(callbacks[0]); + } + }); + } + }); + logger.debug("GSSAPI SaslClient created to authenticate to {} running on {}", + serviceName, serviceHostName); + return saslClient; + } catch (final UndeclaredThrowableException e) { + throw new SaslException(String.format("Unexpected failure trying to authenticate to %s using GSSAPI", + serviceHostName), e.getCause()); + } catch (final IOException | InterruptedException e) { + if (e instanceof SaslException) { + throw (SaslException) e; + } + throw new SaslException(String.format("Unexpected failure trying to authenticate to %s using GSSAPI", + serviceHostName), e); + } + } + }, + + PLAIN { + @Override + public UserGroupInformation login(final ConnectionParameters parameters) throws SaslException { + try { + return UserGroupInformation.getCurrentUser(); + } catch (final IOException e) { + logger.debug("Login failed.", e); + final Throwable cause = e.getCause(); + if (cause instanceof LoginException) { + throw new SaslException("Failed to login.", cause); + } + throw new SaslException("Unexpected failure trying to login. ", cause); + } + } + + @Override + public SaslClient createSaslClient(final UserGroupInformation ugi, + final ConnectionParameters parameters) throws SaslException { + final String userName = parameters.getParameter(ConnectionParameters.USER); + final String password = parameters.getParameter(ConnectionParameters.PASSWORD); + + return Sasl.createSaslClient(new String[]{PLAIN_MECHANISM}, null /** authorization ID */, + null, null, null /** properties; default QOP is auth */, new CallbackHandler() { + @Override + public void handle(final Callback[] callbacks) throws IOException, UnsupportedCallbackException { + for (final Callback callback : callbacks) { + if (callback instanceof NameCallback) { + NameCallback.class.cast(callback).setName(userName); + continue; + } + if (callback instanceof PasswordCallback) { + PasswordCallback.class.cast(callback).setPassword(password.toCharArray()); + continue; + } + throw new UnsupportedCallbackException(callback); + } + } + }); + } + }; + + public abstract UserGroupInformation login(ConnectionParameters parameters) throws SaslException; + + public abstract SaslClient createSaslClient(UserGroupInformation ugi, ConnectionParameters parameters) --- End diff -- Can we change the signature to include input param - (Map<String, ?> properties) as in SaslServer ? For authentication case it will be null from caller. But for encryption it will contain proper QOP parameter which will be passed from caller. > Kerberos Authentication > ----------------------- > > Key: DRILL-4280 > URL: https://issues.apache.org/jira/browse/DRILL-4280 > Project: Apache Drill > Issue Type: Improvement > Reporter: Keys Botzum > Assignee: Sudheesh Katkam > Labels: security > > Drill should support Kerberos based authentication from clients. This means > that both the ODBC and JDBC drivers as well as the web/REST interfaces should > support inbound Kerberos. For Web this would most likely be SPNEGO while for > ODBC and JDBC this will be more generic Kerberos. > Since Hive and much of Hadoop supports Kerberos there is a potential for a > lot of reuse of ideas if not implementation. > Note that this is related to but not the same as > https://issues.apache.org/jira/browse/DRILL-3584 -- This message was sent by Atlassian JIRA (v6.3.4#6332)