patrik-marton commented on code in PR #12846:
URL: https://github.com/apache/kafka/pull/12846#discussion_r1024987213
##########
connect/basic-auth-extension/src/main/java/org/apache/kafka/connect/rest/basic/auth/extension/JaasBasicAuthFilter.java:
##########
@@ -174,4 +153,84 @@ public void handle(Callback[] callbacks) throws
UnsupportedCallbackException {
));
}
}
+
+ private void setSecurityContextForRequest(ContainerRequestContext
requestContext, BasicAuthenticationCredential credential) {
+ requestContext.setSecurityContext(new SecurityContext() {
+ @Override
+ public Principal getUserPrincipal() {
+ return () -> credential.getUsername();
+ }
+
+ @Override
+ public boolean isUserInRole(String role) {
+ return false;
+ }
+
+ @Override
+ public boolean isSecure() {
+ return
requestContext.getUriInfo().getRequestUri().getScheme().equalsIgnoreCase("https");
+ }
+
+ @Override
+ public String getAuthenticationScheme() {
+ return BASIC_AUTH;
+ }
+ });
+ }
+
+
+ public static class BasicAuthenticationCredential {
+ private String username;
+ private String password;
+
+ public BasicAuthenticationCredential(String authorizationHeader) {
+ final char colon = ':';
+ final char space = ' ';
+ final String authType = "basic";
+
+ initializeEmptyCredentials();
+
+ if (authorizationHeader == null) {
+ log.trace("No credentials were provided with the request");
+ return;
+ }
+
+ int spaceIndex = authorizationHeader.indexOf(space);
+ if (spaceIndex <= 0) {
+ log.trace("Request credentials were malformed; no space
present in value for authorization header");
+ return;
+ }
+
+ String method = authorizationHeader.substring(0, spaceIndex);
+ if (!authType.equalsIgnoreCase(method)) {
+ log.trace("Request credentials used {} authentication, but
only {} supported; ignoring", method, authType);
+ return;
+ }
+
+ authorizationHeader = authorizationHeader.substring(spaceIndex +
1);
+ authorizationHeader = new
String(Base64.getDecoder().decode(authorizationHeader),
+ StandardCharsets.UTF_8);
+ int i = authorizationHeader.indexOf(colon);
+ if (i <= 0) {
+ log.trace("Request credentials were malformed; no colon
present between username and password");
+ return;
+ }
+
+ this.username = authorizationHeader.substring(0, i);
+ this.password = authorizationHeader.substring(i + 1);
+ }
+
+ private void initializeEmptyCredentials() {
+ this.username = "";
+ this.password = "";
+ }
Review Comment:
I modified it to avoid null checks where the `BasicAuthenticationCredential`
is used. I know the `BasicAuthCallBackHandler` would be fine with null, but
setting the user in the security context would require additional null check. (
Theoretically it cannot be null there after the successful login, but I just
felt like it is safer to have a default value) What do you think?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscr...@kafka.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
