Skip to content

Commit c07ae33

Browse files
joshelserjoshelser
committed
Break apart the client/server authP interfaces from each other
Common SaslAuthenticationProvider interface encapsulates generic logic that applies to both client and server, with separate SaslClientAP and SaslServerAP interfaces to prevent client from polluting server, and vice versa.
1 parent 270f5ba commit c07ae33

14 files changed

+216
-53
lines changed

‎hbase-client/src/main/java/org/apache/hadoop/hbase/security/provider/AuthenticationProviderSelector.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/**
1+
/*
22
* Licensed to the Apache Software Foundation (ASF) under one
33
* or more contributor license agreements. See the NOTICE file
44
* distributed with this work for additional information

‎hbase-client/src/main/java/org/apache/hadoop/hbase/security/provider/BuiltInSaslAuthenticationProvider.java‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
package org.apache.hadoop.hbase.security.provider;
19+
20+
import org.apache.hadoop.hbase.HBaseInterfaceAudience;
21+
import org.apache.hadoop.io.Text;
22+
import org.apache.yetus.audience.InterfaceAudience;
23+
import org.apache.yetus.audience.InterfaceStability;
24+
25+
/**
26+
* Base class for all Apache HBase, built-in {@link SaslAuthenticationProvider}'s to extend.
27+
*/
28+
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.AUTHENTICATION)
29+
@InterfaceStability.Evolving
30+
public abstract class BuiltInSaslAuthenticationProvider implements SaslAuthenticationProvider {
31+
32+
public static final Text AUTH_TOKEN_TYPE = new Text("HBASE_AUTH_TOKEN");
33+
34+
@Override
35+
public Text getTokenKind() {
36+
return AUTH_TOKEN_TYPE;
37+
}
38+
}

‎hbase-client/src/main/java/org/apache/hadoop/hbase/security/provider/DigestSaslAuthenticationProvider.java‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
package org.apache.hadoop.hbase.security.provider;
19+
20+
import org.apache.hadoop.hbase.HBaseInterfaceAudience;
21+
import org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod;
22+
import org.apache.yetus.audience.InterfaceAudience;
23+
import org.apache.yetus.audience.InterfaceStability;
24+
25+
/**
26+
* Base client for client/server implementations for the HBase delegation token auth'n method.
27+
*/
28+
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.AUTHENTICATION)
29+
@InterfaceStability.Evolving
30+
public class DigestSaslAuthenticationProvider extends BuiltInSaslAuthenticationProvider {
31+
32+
static final String MECHANISM = "DIGEST-MD5";
33+
static final SaslAuthMethod SASL_AUTH_METHOD = new SaslAuthMethod(
34+
"DIGEST", (byte)82, MECHANISM, AuthenticationMethod.TOKEN);
35+
36+
@Override
37+
public SaslAuthMethod getSaslAuthMethod() {
38+
return SASL_AUTH_METHOD;
39+
}
40+
}

‎hbase-client/src/main/java/org/apache/hadoop/hbase/security/provider/DigestSaslClientAuthenticationProvider.java‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,6 @@
3636
import org.apache.hadoop.hbase.security.SaslUtil;
3737
import org.apache.hadoop.hbase.security.SecurityInfo;
3838
import org.apache.hadoop.security.UserGroupInformation;
39-
import org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod;
4039
import org.apache.hadoop.security.token.Token;
4140
import org.apache.hadoop.security.token.TokenIdentifier;
4241
import org.apache.yetus.audience.InterfaceAudience;
@@ -48,16 +47,10 @@
4847

4948
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.AUTHENTICATION)
5049
@InterfaceStability.Evolving
51-
public class DigestSaslClientAuthenticationProvider extends
52-
AbstractSaslClientAuthenticationProvider {
50+
public class DigestSaslClientAuthenticationProvider extends DigestSaslAuthenticationProvider
51+
implements SaslClientAuthenticationProvider {
5352

5453
private static final String MECHANISM = "DIGEST-MD5";
55-
private static final SaslAuthMethod SASL_AUTH_METHOD = new SaslAuthMethod(
56-
"DIGEST", (byte)82, MECHANISM, AuthenticationMethod.TOKEN);
57-
58-
public static String getMechanism() {
59-
return MECHANISM;
60-
}
6154

6255
@Override
6356
public SaslClient createClient(Configuration conf, InetAddress serverAddr,
@@ -67,11 +60,6 @@ public SaslClient createClient(Configuration conf, InetAddress serverAddr,
6760
SaslUtil.SASL_DEFAULT_REALM, saslProps, new DigestSaslClientCallbackHandler(token));
6861
}
6962

70-
@Override
71-
public SaslAuthMethod getSaslAuthMethod() {
72-
return SASL_AUTH_METHOD;
73-
}
74-
7563
public static class DigestSaslClientCallbackHandler implements CallbackHandler {
7664
private static final Logger LOG =
7765
LoggerFactory.getLogger(DigestSaslClientCallbackHandler.class);

‎hbase-client/src/main/java/org/apache/hadoop/hbase/security/provider/GssSaslAuthenticationProvider.java‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
package org.apache.hadoop.hbase.security.provider;
19+
20+
import org.apache.hadoop.hbase.HBaseInterfaceAudience;
21+
import org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod;
22+
import org.apache.yetus.audience.InterfaceAudience;
23+
import org.apache.yetus.audience.InterfaceStability;
24+
25+
/**
26+
* Base client for client/server implementations for the "KERBEROS" HBase auth'n method.
27+
*/
28+
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.AUTHENTICATION)
29+
@InterfaceStability.Evolving
30+
public class GssSaslAuthenticationProvider extends BuiltInSaslAuthenticationProvider {
31+
32+
static final SaslAuthMethod SASL_AUTH_METHOD = new SaslAuthMethod(
33+
"KERBEROS", (byte)81, "GSSAPI", AuthenticationMethod.KERBEROS);
34+
35+
@Override
36+
public SaslAuthMethod getSaslAuthMethod() {
37+
return SASL_AUTH_METHOD;
38+
}
39+
}

‎hbase-client/src/main/java/org/apache/hadoop/hbase/security/provider/GssSaslClientAuthenticationProvider.java‎

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@
3030
import org.apache.hadoop.hbase.security.SecurityInfo;
3131
import org.apache.hadoop.security.SecurityUtil;
3232
import org.apache.hadoop.security.UserGroupInformation;
33-
import org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod;
3433
import org.apache.hadoop.security.token.Token;
3534
import org.apache.hadoop.security.token.TokenIdentifier;
3635
import org.apache.yetus.audience.InterfaceAudience;
@@ -42,12 +41,10 @@
4241

4342
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.AUTHENTICATION)
4443
@InterfaceStability.Evolving
45-
public class GssSaslClientAuthenticationProvider extends AbstractSaslClientAuthenticationProvider {
44+
public class GssSaslClientAuthenticationProvider extends GssSaslAuthenticationProvider
45+
implements SaslClientAuthenticationProvider {
4646
private static final Logger LOG = LoggerFactory.getLogger(
4747
GssSaslClientAuthenticationProvider.class);
48-
private static final String MECHANISM = "GSSAPI";
49-
private static final SaslAuthMethod SASL_AUTH_METHOD = new SaslAuthMethod(
50-
"KERBEROS", (byte)81, MECHANISM, AuthenticationMethod.KERBEROS);
5148

5249
String getServerPrincipal(Configuration conf, SecurityInfo securityInfo, InetAddress server)
5350
throws IOException {
@@ -70,13 +67,8 @@ public SaslClient createClient(Configuration conf, InetAddress serverAddr,
7067
throw new IOException("Kerberos principal '" + serverPrincipal
7168
+ "' does not have the expected format");
7269
}
73-
return Sasl.createSaslClient(new String[] { MECHANISM }, null, names[0], names[1], saslProps,
74-
null);
75-
}
76-
77-
@Override
78-
public SaslAuthMethod getSaslAuthMethod() {
79-
return SASL_AUTH_METHOD;
70+
return Sasl.createSaslClient(new String[] { getSaslAuthMethod().getSaslMechanism() }, null,
71+
names[0], names[1], saslProps, null);
8072
}
8173

8274
@Override

‎hbase-client/src/main/java/org/apache/hadoop/hbase/security/provider/SaslAuthenticationProvider.java‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
package org.apache.hadoop.hbase.security.provider;
19+
20+
import org.apache.hadoop.hbase.HBaseInterfaceAudience;
21+
import org.apache.hadoop.io.Text;
22+
import org.apache.yetus.audience.InterfaceAudience;
23+
import org.apache.yetus.audience.InterfaceStability;
24+
25+
/**
26+
* Encapsulation of client-side logic to authenticate to HBase via some means over SASL.
27+
* Implementations should not directly implement this interface, but instead extend
28+
* {@link AbstractSaslClientAuthenticationProvider}.
29+
*
30+
* Implementations of this interface must make an implementation of {@code hashCode()}
31+
* which returns the same value across multiple instances of the provider implementation.
32+
*/
33+
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.AUTHENTICATION)
34+
@InterfaceStability.Evolving
35+
public interface SaslAuthenticationProvider {
36+
37+
/**
38+
* Returns the attributes which identify how this provider authenticates.
39+
*/
40+
SaslAuthMethod getSaslAuthMethod();
41+
42+
/**
43+
* Returns the name of the type used by the TokenIdentifier.
44+
*/
45+
Text getTokenKind();
46+
}

‎hbase-client/src/main/java/org/apache/hadoop/hbase/security/provider/SaslClientAuthenticationProvider.java‎

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,14 @@
2626
import org.apache.hadoop.conf.Configuration;
2727
import org.apache.hadoop.hbase.HBaseInterfaceAudience;
2828
import org.apache.hadoop.hbase.security.SecurityInfo;
29-
import org.apache.hadoop.hbase.shaded.protobuf.generated.RPCProtos.UserInformation;
30-
import org.apache.hadoop.io.Text;
3129
import org.apache.hadoop.security.UserGroupInformation;
3230
import org.apache.hadoop.security.token.Token;
3331
import org.apache.hadoop.security.token.TokenIdentifier;
3432
import org.apache.yetus.audience.InterfaceAudience;
3533
import org.apache.yetus.audience.InterfaceStability;
3634

35+
import org.apache.hadoop.hbase.shaded.protobuf.generated.RPCProtos.UserInformation;
36+
3737
/**
3838
* Encapsulation of client-side logic to authenticate to HBase via some means over SASL.
3939
* Implementations should not directly implement this interface, but instead extend
@@ -44,7 +44,7 @@
4444
*/
4545
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.AUTHENTICATION)
4646
@InterfaceStability.Evolving
47-
public interface SaslClientAuthenticationProvider {
47+
public interface SaslClientAuthenticationProvider extends SaslAuthenticationProvider {
4848

4949
/**
5050
* Creates the SASL client instance for this auth'n method.
@@ -53,16 +53,6 @@ SaslClient createClient(Configuration conf, InetAddress serverAddr, SecurityInfo
5353
Token<? extends TokenIdentifier> token, boolean fallbackAllowed,
5454
Map<String, String> saslProps) throws IOException;
5555

56-
/**
57-
* Returns the attributes which identify how this provider authenticates.
58-
*/
59-
SaslAuthMethod getSaslAuthMethod();
60-
61-
/**
62-
* Returns the name of the type used by the TokenIdentifier.
63-
*/
64-
Text getTokenKind();
65-
6656
/**
6757
* Constructs a {@link UserInformation} from the given {@link UserGroupInformation}
6858
*/

‎hbase-client/src/main/java/org/apache/hadoop/hbase/security/provider/SimpleSaslAuthenticationProvider.java‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
package org.apache.hadoop.hbase.security.provider;
19+
20+
import org.apache.hadoop.hbase.HBaseInterfaceAudience;
21+
import org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod;
22+
import org.apache.yetus.audience.InterfaceAudience;
23+
import org.apache.yetus.audience.InterfaceStability;
24+
25+
/**
26+
* Base client for client/server implementations for the "SIMPLE" HBase auth'n method.
27+
*/
28+
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.AUTHENTICATION)
29+
@InterfaceStability.Evolving
30+
public class SimpleSaslAuthenticationProvider extends BuiltInSaslAuthenticationProvider {
31+
private static final SaslAuthMethod SASL_AUTH_METHOD = new SaslAuthMethod(
32+
"SIMPLE", (byte)80, "", AuthenticationMethod.SIMPLE);
33+
34+
@Override
35+
public SaslAuthMethod getSaslAuthMethod() {
36+
return SASL_AUTH_METHOD;
37+
}
38+
}

‎hbase-client/src/main/java/org/apache/hadoop/hbase/security/provider/SimpleSaslClientAuthenticationProvider.java‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
import org.apache.hadoop.hbase.HBaseInterfaceAudience;
2828
import org.apache.hadoop.hbase.security.SecurityInfo;
2929
import org.apache.hadoop.security.UserGroupInformation;
30-
import org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod;
3130
import org.apache.hadoop.security.token.Token;
3231
import org.apache.hadoop.security.token.TokenIdentifier;
3332
import org.apache.yetus.audience.InterfaceAudience;
@@ -38,9 +37,7 @@
3837
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.AUTHENTICATION)
3938
@InterfaceStability.Evolving
4039
public class SimpleSaslClientAuthenticationProvider extends
41-
AbstractSaslClientAuthenticationProvider {
42-
private static final SaslAuthMethod SASL_AUTH_METHOD = new SaslAuthMethod(
43-
"SIMPLE", (byte)80, "", AuthenticationMethod.SIMPLE);
40+
SimpleSaslAuthenticationProvider implements SaslClientAuthenticationProvider {
4441

4542
@Override
4643
public SaslClient createClient(Configuration conf, InetAddress serverAddress,
@@ -59,9 +56,4 @@ public UserInformation getUserInfo(UserGroupInformation user) {
5956
}
6057
return userInfoPB.build();
6158
}
62-
63-
@Override
64-
public SaslAuthMethod getSaslAuthMethod() {
65-
return SASL_AUTH_METHOD;
66-
}
6759
}

0 commit comments

Comments
 (0)