[
https://issues.apache.org/jira/browse/DRILL-4280?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15877149#comment-15877149
]
ASF GitHub Bot commented on DRILL-4280:
---------------------------------------
Github user laurentgo commented on a diff in the pull request:
https://github.com/apache/drill/pull/578#discussion_r101598598
--- Diff: contrib/native/client/src/clientlib/saslAuthenticatorImpl.cpp ---
@@ -0,0 +1,211 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <vector>
+#include <boost/algorithm/string.hpp>
+#include <boost/assign.hpp>
+#include "saslAuthenticatorImpl.hpp"
+
+#include "drillClientImpl.hpp"
+#include "logger.hpp"
+
+namespace Drill {
+
+#define DEFAULT_SERVICE_NAME "drill"
+
+#define KERBEROS_SIMPLE_NAME "kerberos"
+#define KERBEROS_SASL_NAME "gssapi"
+#define PLAIN_NAME "plain"
+
+const std::map<std::string, std::string>
SaslAuthenticatorImpl::MECHANISM_MAPPING = boost::assign::map_list_of
+ (KERBEROS_SIMPLE_NAME, KERBEROS_SASL_NAME)
+ (PLAIN_NAME, PLAIN_NAME)
+;
+
+boost::mutex SaslAuthenticatorImpl::s_mutex;
+bool SaslAuthenticatorImpl::s_initialized = false;
+
+SaslAuthenticatorImpl::SaslAuthenticatorImpl(const DrillUserProperties*
const properties) :
+ m_properties(properties), m_pConnection(NULL), m_pwd_secret(NULL) {
+
+ if (!s_initialized) {
+ boost::lock_guard<boost::mutex>
lock(SaslAuthenticatorImpl::s_mutex);
+ if (!s_initialized) {
+ // set plugin path if provided
+ if (DrillClientConfig::getSaslPluginPath()) {
+ char *saslPluginPath = const_cast<char
*>(DrillClientConfig::getSaslPluginPath());
+ sasl_set_path(0, saslPluginPath);
+ }
+
+ // loads all the available mechanism and factories in the
sasl_lib referenced by the path
+ const int err = sasl_client_init(NULL);
+ if (0 != err) {
+ std::stringstream errMsg;
+ errMsg << "Failed to load authentication libraries. code:
" << err;
+ DRILL_MT_LOG(DRILL_LOG(LOG_TRACE) << errMsg << std::endl;)
+ throw std::runtime_error(errMsg.str().c_str());
+ }
+ { // for debugging purposes
+ const char **mechanisms = sasl_global_listmech();
+ int i = 0;
+ DRILL_MT_LOG(DRILL_LOG(LOG_TRACE) << "SASL mechanisms
available on client: " << std::endl;)
+ while (mechanisms[i] != NULL) {
+ DRILL_MT_LOG(DRILL_LOG(LOG_TRACE) << i << " : " <<
mechanisms[i] << std::endl;)
+ i++;
+ }
+ }
+ s_initialized = true;
+ }
+ }
+}
+
+SaslAuthenticatorImpl::~SaslAuthenticatorImpl() {
+ if (m_pwd_secret) {
+ free(m_pwd_secret);
+ }
+ // may be used to negotiated security layers before disposing in the
future
+ if (m_pConnection) {
+ sasl_dispose(&m_pConnection);
+ }
+ m_pConnection = NULL;
+}
+
+typedef int (*sasl_callback_proc_t)(void); // see sasl_callback_ft
+
+int SaslAuthenticatorImpl::userNameCallback(void *context, int id, const
char **result, unsigned *len) {
+ const std::string* const username = static_cast<const std::string*
const>(context);
+
+ if ((SASL_CB_USER == id || SASL_CB_AUTHNAME == id)
+ && username != NULL) {
+ *result = username->c_str();
+ // *len = (unsigned int) username->length();
+ }
+ return SASL_OK;
+}
+
+int SaslAuthenticatorImpl::passwordCallback(sasl_conn_t *conn, void
*context, int id, sasl_secret_t **psecret) {
+ const SaslAuthenticatorImpl* const authenticator = static_cast<const
SaslAuthenticatorImpl* const>(context);
+
+ if (SASL_CB_PASS == id) {
+ *psecret = authenticator->m_pwd_secret;
+ }
+ return SASL_OK;
+}
+
+int SaslAuthenticatorImpl::init(const std::vector<std::string>&
mechanisms, exec::shared::SaslMessage& response) {
+ // find and set parameters
+ std::string authMechanismToUse;
+ std::string serviceName;
+ std::string serviceHost;
+ for (size_t i = 0; i < m_properties->size(); i++) {
+ const std::string key = m_properties->keyAt(i);
+ const std::string value = m_properties->valueAt(i);
+
+ if (USERPROP_SERVICE_HOST == key) {
+ serviceHost = value;
+ } else if (USERPROP_SERVICE_NAME == key) {
+ serviceName = value;
+ } else if (USERPROP_PASSWORD == key) {
+ const size_t length = value.length();
+ m_pwd_secret = (sasl_secret_t *) malloc(sizeof(sasl_secret_t)
+ length);
+ std::memcpy(m_pwd_secret->data, value.c_str(), length);
+ m_pwd_secret->len = length;
+ authMechanismToUse = PLAIN_NAME;
+ } else if (USERPROP_USERNAME == key) {
+ m_username = value;
+ } else if (USERPROP_AUTH_MECHANISM == key) {
+ authMechanismToUse = value;
+ }
+ }
+ if (authMechanismToUse.empty()) return SASL_NOMECH;
+
+ // check if requested mechanism is supported by server
+ boost::algorithm::to_lower(authMechanismToUse);
+ bool isSupportedByServer = false;
+ for (size_t i = 0; i < mechanisms.size(); i++) {
--- End diff --
assuming that the mechanisms are already lower case, we can use
std::vector::find instead...
> Kerberos Authentication
> -----------------------
>
> Key: DRILL-4280
> URL: https://issues.apache.org/jira/browse/DRILL-4280
> Project: Apache Drill
> Issue Type: Improvement
> Reporter: Keys Botzum
> Assignee: Sudheesh Katkam
> Labels: security
>
> Drill should support Kerberos based authentication from clients. This means
> that both the ODBC and JDBC drivers as well as the web/REST interfaces should
> support inbound Kerberos. For Web this would most likely be SPNEGO while for
> ODBC and JDBC this will be more generic Kerberos.
> Since Hive and much of Hadoop supports Kerberos there is a potential for a
> lot of reuse of ideas if not implementation.
> Note that this is related to but not the same as
> https://issues.apache.org/jira/browse/DRILL-3584
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
