src/main/java/org/apache/hadoop/hdfs/server/namenode/analytics/security/SecurityContext.java
public void handleAuthentication(HttpServletRequest request, HttpServletResponse response)
      throws AuthenticationException, HttpAction {
    if (!init) {
      LOG.info("Request occurred before initialized from: {}", request.getRemoteAddr());
      throw new AuthenticationException("Please wait for initialization.");
    }

    if (isLoginAttempt(request)) {
      return;
    }

    boolean authenticationEnabled = isAuthenticationEnabled();
    if (!authenticationEnabled) {
      String proxyUsername = request.getParameter("proxy");
      if (proxyUsername != null && !proxyUsername.isEmpty()) {
        currentUser.set(proxyUsername);
      }
      return;
    }

    // Allow basic authentication for simple applications.
    String basic = request.getHeader("Authorization");
    if (basic != null && basic.startsWith("Basic ")) {
      String b64Credentials = basic.substring("Basic ".length()).trim();
      String nameAndPassword =
          new String(Base64.getDecoder().decode(b64Credentials), Charset.defaultCharset());
      String[] split = nameAndPassword.split(":");
      String username = split[0];
      String password = (split.length == 1) ? "" : split[1];
      // Perform local authentication if found.
      if (localLogin(request, response, username, password)) {
        return;
      }
      // Perform LDAP authentication if found.
      if (ldapLogin(request, response, username, password)) {
        return;
      }
      LOG.info("Login failed via [BASIC] for: {}", request.getRemoteAddr());
      throw new AuthenticationException("Authentication required.");
    }

    // JWT authentication for end users whom have logged in.
    String token = null;
    Cookie[] cookies = request.getCookies();
    if (cookies != null) {
      for (Cookie cookie : cookies) {
        if (cookie.getName().equals("nna-jwt-token")) {
          token = cookie.getValue();
          break;
        }
      }
    }

    ProfileManager<CommonProfile> manager = new ProfileManager<>(new J2EContext(request, response));
    CommonProfile userProfile;
    if (token != null) {
      try {
        userProfile = jwtAuthenticator.validateToken(token);

        userProfile.removeAttribute("iat");
        String generate = jwtGenerator.generate(userProfile);
        response.addHeader("Set-Cookie", "nna-jwt-token=" + generate);

        manager.save(true, userProfile, false);
        String profileId = userProfile.getId();
        LOG.debug("Login success via [TOKEN] for: {} at {}", profileId, request.getRemoteAddr());
        currentUser.set(profileId);
        return;
      } catch (Exception e) {
        LOG.info("Login failed via [TOKEN] for: {}", request.getRemoteAddr());
        throw new AuthenticationException(e);
      }
    }

    LOG.info("Login failed via [NULL] for: {}", request.getRemoteAddr());
    throw new AuthenticationException("Authentication required.");
  }
/**
   * Ensures that user request has proper authentication token / credentials.
   *
   * @param request the HTTP request
   * @param response the HTTP response
   * @throws AuthenticationException error with authentication
   * @throws HttpAction error with HTTP call
   */
Ensures that user request has proper authentication token / credentials.
@param request the HTTP request
@param response the HTTP response
@throws AuthenticationException error with authentication
@throws HttpAction error with HTTP call
Ensures that user request has proper authentication token / credentials . @param request the HTTP request @param response the HTTP response @throws AuthenticationException error with authentication @throws HttpAction error with HTTP call
public void handleAuthentication(HttpServletRequest request, HttpServletResponse response)
      throws AuthenticationException, HttpAction {
    if (!init) {
      LOG.info("Request occurred before initialized from: {}", request.getRemoteAddr());
      throw new AuthenticationException("Please wait for initialization.");
    }
    if (isLoginAttempt(request)) {
      return;
    }
    boolean authenticationEnabled = isAuthenticationEnabled();
    if (!authenticationEnabled) {
      String proxyUsername = request.getParameter("proxy");
      if (proxyUsername != null && !proxyUsername.isEmpty()) {
        currentUser.set(proxyUsername);
      }
      return;
    }
    String basic = request.getHeader("Authorization");
    if (basic != null && basic.startsWith("Basic ")) {
      String b64Credentials = basic.substring("Basic ".length()).trim();
      String nameAndPassword =
          new String(Base64.getDecoder().decode(b64Credentials), Charset.defaultCharset());
      String[] split = nameAndPassword.split(":");
      String username = split[0];
      String password = (split.length == 1) ? "" : split[1];
      if (localLogin(request, response, username, password)) {
        return;
      }
      if (ldapLogin(request, response, username, password)) {
        return;
      }
      LOG.info("Login failed via [BASIC] for: {}", request.getRemoteAddr());
      throw new AuthenticationException("Authentication required.");
    }
    String token = null;
    Cookie[] cookies = request.getCookies();
    if (cookies != null) {
      for (Cookie cookie : cookies) {
        if (cookie.getName().equals("nna-jwt-token")) {
          token = cookie.getValue();
          break;
        }
      }
    }
    ProfileManager<CommonProfile> manager = new ProfileManager<>(new J2EContext(request, response));
    CommonProfile userProfile;
    if (token != null) {
      try {
        userProfile = jwtAuthenticator.validateToken(token);
        userProfile.removeAttribute("iat");
        String generate = jwtGenerator.generate(userProfile);
        response.addHeader("Set-Cookie", "nna-jwt-token=" + generate);
        manager.save(true, userProfile, false);
        String profileId = userProfile.getId();
        LOG.debug("Login success via [TOKEN] for: {} at {}", profileId, request.getRemoteAddr());
        currentUser.set(profileId);
        return;
      } catch (Exception e) {
        LOG.info("Login failed via [TOKEN] for: {}", request.getRemoteAddr());
        throw new AuthenticationException(e);
      }
    }
    LOG.info("Login failed via [NULL] for: {}", request.getRemoteAddr());
    throw new AuthenticationException("Authentication required.");
  }
public void handleAuthentication ( HttpServletRequest request , HttpServletResponse response ) throws AuthenticationException , HttpAction { if ( ! init ) { LOG . info ( "Request occurred before initialized from: {}" , request . getRemoteAddr ( ) ) ; throw new AuthenticationException ( "Please wait for initialization." ) ; } if ( isLoginAttempt ( request ) ) { return ; } boolean authenticationEnabled = isAuthenticationEnabled ( ) ; if ( ! authenticationEnabled ) { String proxyUsername = request . getParameter ( "proxy" ) ; if ( proxyUsername != null && ! proxyUsername . isEmpty ( ) ) { currentUser . set ( proxyUsername ) ; } return ; } String basic = request . getHeader ( "Authorization" ) ; if ( basic != null && basic . startsWith ( "Basic " ) ) { String b64Credentials = basic . substring ( "Basic " . length ( ) ) . trim ( ) ; String nameAndPassword = new String ( Base64 . getDecoder ( ) . decode ( b64Credentials ) , Charset . defaultCharset ( ) ) ; String [ ] split = nameAndPassword . split ( ":" ) ; String username = split [ 0 ] ; String password = ( split . length == 1 ) ? "" : split [ 1 ] ; if ( localLogin ( request , response , username , password ) ) { return ; } if ( ldapLogin ( request , response , username , password ) ) { return ; } LOG . info ( "Login failed via [BASIC] for: {}" , request . getRemoteAddr ( ) ) ; throw new AuthenticationException ( "Authentication required." ) ; } String token = null ; Cookie [ ] cookies = request . getCookies ( ) ; if ( cookies != null ) { for ( Cookie cookie : cookies ) { if ( cookie . getName ( ) . equals ( "nna-jwt-token" ) ) { token = cookie . getValue ( ) ; break ; } } } ProfileManager < CommonProfile > manager = new ProfileManager < > ( new J2EContext ( request , response ) ) ; CommonProfile userProfile ; if ( token != null ) { try { userProfile = jwtAuthenticator . validateToken ( token ) ; userProfile . removeAttribute ( "iat" ) ; String generate = jwtGenerator . generate ( userProfile ) ; response . addHeader ( "Set-Cookie" , "nna-jwt-token=" + generate ) ; manager . save ( true , userProfile , false ) ; String profileId = userProfile . getId ( ) ; LOG . debug ( "Login success via [TOKEN] for: {} at {}" , profileId , request . getRemoteAddr ( ) ) ; currentUser . set ( profileId ) ; return ; } catch ( Exception e ) { LOG . info ( "Login failed via [TOKEN] for: {}" , request . getRemoteAddr ( ) ) ; throw new AuthenticationException ( e ) ; } } LOG . info ( "Login failed via [NULL] for: {}" , request . getRemoteAddr ( ) ) ; throw new AuthenticationException ( "Authentication required." ) ; }
Ensures that user request has proper authentication token / credentials.
Ensures that user request has proper authentication token / credentials .
// Allow basic authentication for simple applications. // Perform local authentication if found. // Perform LDAP authentication if found. // JWT authentication for end users whom have logged in.