You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ambari.apache.org by lp...@apache.org on 2017/08/08 16:02:52 UTC
[36/50] [abbrv] ambari git commit: AMBARI-21670. Log Search cleanup:
all configurations should be spring managed (oleewere)
http://git-wip-us.apache.org/repos/asf/ambari/blob/555f241c/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/configurer/SslConfigurer.java
----------------------------------------------------------------------
diff --git a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/configurer/SslConfigurer.java b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/configurer/SslConfigurer.java
new file mode 100644
index 0000000..f4e2947
--- /dev/null
+++ b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/configurer/SslConfigurer.java
@@ -0,0 +1,363 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ambari.logsearch.configurer;
+
+import javax.inject.Inject;
+import javax.inject.Named;
+import javax.net.ssl.SSLContext;
+
+import org.apache.ambari.logsearch.conf.LogSearchSslConfig;
+import org.apache.ambari.logsearch.util.FileUtil;
+import org.apache.commons.io.FileUtils;
+import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.ArrayUtils;
+import org.apache.hadoop.conf.Configuration;
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.DefaultDigestAlgorithmIdentifierFinder;
+import org.bouncycastle.operator.DefaultSignatureAlgorithmIdentifierFinder;
+import org.bouncycastle.operator.OperatorCreationException;
+import org.bouncycastle.operator.bc.BcContentSignerBuilder;
+import org.bouncycastle.operator.bc.BcRSAContentSignerBuilder;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.cert.X509v3CertificateBuilder;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
+import org.bouncycastle.crypto.params.RSAKeyParameters;
+import org.eclipse.jetty.util.ssl.SslContextFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.math.BigInteger;
+import java.net.InetAddress;
+import java.security.InvalidKeyException;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.KeyStore;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.SecureRandom;
+import java.security.Security;
+import java.security.SignatureException;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.security.interfaces.RSAPrivateKey;
+import java.security.interfaces.RSAPublicKey;
+import java.util.Date;
+
+import static org.apache.ambari.logsearch.conf.LogSearchSslConfig.CREDENTIAL_STORE_PROVIDER_PATH;
+import static org.apache.ambari.logsearch.conf.LogSearchSslConfig.LOGSEARCH_CERT_DEFAULT_FOLDER;
+
+@Named
+public class SslConfigurer {
+ private static final Logger LOG = LoggerFactory.getLogger(SslConfigurer.class);
+
+ private static final String KEYSTORE_LOCATION_ARG = "javax.net.ssl.keyStore";
+ private static final String KEYSTORE_PASSWORD_ARG = "javax.net.ssl.keyStorePassword";
+ private static final String KEYSTORE_TYPE_ARG = "javax.net.ssl.keyStoreType";
+ private static final String DEFAULT_KEYSTORE_TYPE = "JKS";
+ private static final String TRUSTSTORE_LOCATION_ARG = "javax.net.ssl.trustStore";
+ private static final String TRUSTSTORE_PASSWORD_ARG = "javax.net.ssl.trustStorePassword";
+ private static final String TRUSTSTORE_TYPE_ARG = "javax.net.ssl.trustStoreType";
+ private static final String DEFAULT_TRUSTSTORE_TYPE = "JKS";
+ private static final String KEYSTORE_PASSWORD_PROPERTY_NAME = "logsearch_keystore_password";
+ private static final String TRUSTSTORE_PASSWORD_PROPERTY_NAME = "logsearch_truststore_password";
+ private static final String KEYSTORE_PASSWORD_FILE = "ks_pass.txt";
+ private static final String TRUSTSTORE_PASSWORD_FILE = "ts_pass.txt";
+
+ private static final String LOGSEARCH_CERT_FILENAME = "logsearch.crt";
+ private static final String LOGSEARCH_KEYSTORE_FILENAME = "logsearch.jks";
+ private static final String LOGSEARCH_KEYSTORE_PRIVATE_KEY = "logsearch.private.key";
+ private static final String LOGSEARCH_KEYSTORE_PUBLIC_KEY = "logsearch.public.key";
+
+ private static final String LOGSEARCH_KEYSTORE_DEFAULT_PASSWORD = "bigdata";
+
+ @Inject
+ private LogSearchSslConfig logSearchSslConfig;
+
+ private String getKeyStoreLocation() {
+ return System.getProperty(KEYSTORE_LOCATION_ARG);
+ }
+
+ private String getKeyStorePassword() {
+ return System.getProperty(KEYSTORE_PASSWORD_ARG);
+ }
+
+ private String getKeyStoreType() {
+ return System.getProperty(KEYSTORE_TYPE_ARG, DEFAULT_KEYSTORE_TYPE);
+ }
+
+ private String getTrustStoreLocation() {
+ return System.getProperty(TRUSTSTORE_LOCATION_ARG);
+ }
+
+ private String getTrustStorePassword() {
+ return System.getProperty(TRUSTSTORE_PASSWORD_ARG);
+ }
+
+ private String getTrustStoreType() {
+ return System.getProperty(TRUSTSTORE_TYPE_ARG, DEFAULT_TRUSTSTORE_TYPE);
+ }
+
+ public boolean isKeyStoreSpecified() {
+ return StringUtils.isNotEmpty(getKeyStoreLocation());
+ }
+
+ private boolean isTrustStoreSpecified() {
+ return StringUtils.isNotEmpty(getTrustStoreLocation());
+ }
+
+ public SslContextFactory getSslContextFactory() {
+ SslContextFactory sslContextFactory = new SslContextFactory();
+ sslContextFactory.setKeyStorePath(getKeyStoreLocation());
+ sslContextFactory.setKeyStorePassword(getKeyStorePassword());
+ sslContextFactory.setKeyStoreType(getKeyStoreType());
+ if (isTrustStoreSpecified()) {
+ sslContextFactory.setTrustStorePath(getTrustStoreLocation());
+ sslContextFactory.setTrustStorePassword(getTrustStorePassword());
+ sslContextFactory.setTrustStoreType(getTrustStoreType());
+ }
+
+ return sslContextFactory;
+ }
+
+ public SSLContext getSSLContext() {
+ SslContextFactory sslContextFactory = getSslContextFactory();
+
+ try {
+ sslContextFactory.start();
+ return sslContextFactory.getSslContext();
+ } catch (Exception e) {
+ LOG.error("Could not create SSL Context", e);
+ return null;
+ } finally {
+ try {
+ sslContextFactory.stop();
+ } catch (Exception e) {
+ LOG.error("Could not stop sslContextFactory", e);
+ }
+ }
+ }
+
+ private String getPasswordFromFile(String fileName) {
+ try {
+ File pwdFile = new File(LOGSEARCH_CERT_DEFAULT_FOLDER, fileName);
+ if (!pwdFile.exists()) {
+ FileUtils.writeStringToFile(pwdFile, LOGSEARCH_KEYSTORE_DEFAULT_PASSWORD);
+ return LOGSEARCH_KEYSTORE_DEFAULT_PASSWORD;
+ } else {
+ return FileUtils.readFileToString(pwdFile);
+ }
+ } catch (Exception e) {
+ LOG.warn("Exception occurred during read/write password file for keystore/truststore.", e);
+ return null;
+ }
+ }
+
+ private String getPasswordFromCredentialStore(String propertyName) {
+ try {
+ String providerPath = logSearchSslConfig.getCredentialStoreProviderPath();
+ if (StringUtils.isEmpty(providerPath)) {
+ return null;
+ }
+
+ Configuration config = new Configuration();
+ config.set(CREDENTIAL_STORE_PROVIDER_PATH, providerPath);
+ char[] passwordChars = config.getPassword(propertyName);
+ return (ArrayUtils.isNotEmpty(passwordChars)) ? new String(passwordChars) : null;
+ } catch (Exception e) {
+ LOG.warn(String.format("Could not load password %s from credential store, using default password", propertyName), e);
+ return null;
+ }
+ }
+
+ private String getPassword(String propertyName, String fileName) {
+ String credentialStorePassword = getPasswordFromCredentialStore(propertyName);
+ if (credentialStorePassword != null) {
+ return credentialStorePassword;
+ }
+
+ String filePassword = getPasswordFromFile(fileName);
+ if (filePassword != null) {
+ return filePassword;
+ }
+
+ return LOGSEARCH_KEYSTORE_DEFAULT_PASSWORD;
+ }
+
+ /**
+ * Put private key into in-memory keystore and write it to a file (JKS file)
+ */
+ private void setKeyAndCertInKeystore(X509Certificate cert, KeyPair keyPair, KeyStore keyStore, String keyStoreLocation, char[] password)
+ throws Exception {
+ Certificate[] certChain = new Certificate[1];
+ certChain[0] = cert;
+ try (FileOutputStream fos = new FileOutputStream(keyStoreLocation)) {
+ keyStore.setKeyEntry("logsearch.alias", keyPair.getPrivate(), password, certChain);
+ keyStore.store(fos, password);
+ } catch (Exception e) {
+ LOG.error("Could not write certificate to Keystore", e);
+ throw e;
+ }
+ }
+
+ /**
+ * Create in-memory keypair with bouncy castle
+ */
+ private KeyPair createKeyPair(String encryptionType, int byteCount)
+ throws NoSuchProviderException, NoSuchAlgorithmException {
+ Security.addProvider(new BouncyCastleProvider());
+ KeyPairGenerator keyPairGenerator = createKeyPairGenerator(encryptionType, byteCount);
+ return keyPairGenerator.genKeyPair();
+ }
+
+ /**
+ * Generate X509 certificate if it does not exist
+ */
+ private X509Certificate generateCertificate(String certificateLocation, KeyPair keyPair, String algorithm) throws Exception {
+ try {
+ File certFile = new File(certificateLocation);
+ if (certFile.exists()) {
+ LOG.info("Certificate file exists ({}), skip the generation.", certificateLocation);
+ return getCertFile(certificateLocation);
+ } else {
+ Security.addProvider(new BouncyCastleProvider());
+ X509Certificate cert = createCert(keyPair, algorithm, InetAddress.getLocalHost().getCanonicalHostName());
+ FileUtils.writeByteArrayToFile(certFile, cert.getEncoded());
+ return cert;
+ }
+ } catch (Exception e) {
+ LOG.error("Could not create certificate.", e);
+ throw e;
+ }
+ }
+
+ private void ensureStorePassword(String locationArg, String pwdArg, String propertyName, String fileName) {
+ if (StringUtils.isNotEmpty(System.getProperty(locationArg)) && StringUtils.isEmpty(System.getProperty(pwdArg))) {
+ String password = getPassword(propertyName, fileName);
+ System.setProperty(pwdArg, password);
+ }
+ }
+
+ public void ensureStorePasswords() {
+ ensureStorePassword(KEYSTORE_LOCATION_ARG, KEYSTORE_PASSWORD_ARG, KEYSTORE_PASSWORD_PROPERTY_NAME, KEYSTORE_PASSWORD_FILE);
+ ensureStorePassword(TRUSTSTORE_LOCATION_ARG, TRUSTSTORE_PASSWORD_ARG, TRUSTSTORE_PASSWORD_PROPERTY_NAME, TRUSTSTORE_PASSWORD_FILE);
+ }
+
+ private X509Certificate getCertFile(String location) throws Exception {
+ try (FileInputStream fos = new FileInputStream(location)) {
+ CertificateFactory factory = CertificateFactory.getInstance("X.509");
+ return (X509Certificate) factory.generateCertificate(fos);
+ } catch (Exception e) {
+ LOG.error("Cannot read cert file. ('" + location + "')", e);
+ throw e;
+ }
+ }
+
+ private X509Certificate createCert(KeyPair keyPair, String signatureAlgoritm, String domainName)
+ throws NoSuchAlgorithmException, InvalidKeyException, SignatureException, OperatorCreationException, CertificateException, IOException {
+
+ RSAPublicKey rsaPublicKey = (RSAPublicKey) keyPair.getPublic();
+ RSAPrivateKey rsaPrivateKey = (RSAPrivateKey) keyPair.getPrivate();
+
+ AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find(signatureAlgoritm);
+ AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
+ BcContentSignerBuilder sigGen = new BcRSAContentSignerBuilder(sigAlgId, digAlgId);
+
+ ASN1InputStream publicKeyStream = new ASN1InputStream(rsaPublicKey.getEncoded());
+ SubjectPublicKeyInfo pubKey = SubjectPublicKeyInfo.getInstance(publicKeyStream.readObject());
+ publicKeyStream.close();
+
+ X509v3CertificateBuilder v3CertBuilder = new X509v3CertificateBuilder(
+ new X500Name("CN=" + domainName + ", OU=None, O=None L=None, C=None"),
+ BigInteger.valueOf(Math.abs(new SecureRandom().nextInt())),
+ new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30),
+ new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 365*10)),
+ new X500Name("CN=" + domainName + ", OU=None, O=None L=None, C=None"),
+ pubKey);
+
+ RSAKeyParameters keyParams = new RSAKeyParameters(true, rsaPrivateKey.getPrivateExponent(), rsaPrivateKey.getModulus());
+ ContentSigner contentSigner = sigGen.build(keyParams);
+
+ X509CertificateHolder certificateHolder = v3CertBuilder.build(contentSigner);
+
+ JcaX509CertificateConverter certConverter = new JcaX509CertificateConverter().setProvider("BC");
+ return certConverter.getCertificate(certificateHolder);
+ }
+
+ private KeyPairGenerator createKeyPairGenerator(String algorithmIdentifier, int bitCount)
+ throws NoSuchProviderException, NoSuchAlgorithmException {
+ KeyPairGenerator kpg = KeyPairGenerator.getInstance(algorithmIdentifier, BouncyCastleProvider.PROVIDER_NAME);
+ kpg.initialize(bitCount);
+ return kpg;
+ }
+
+ /**
+ * Create keystore with keys and certificate (only if the keystore does not exist or if you have no permissions on the keystore file)
+ */
+ public void loadKeystore() {
+ try {
+ String certFolder = logSearchSslConfig.getCertFolder();
+ String certAlgorithm = logSearchSslConfig.getCertAlgorithm();
+ String certLocation = String.format("%s/%s", LOGSEARCH_CERT_DEFAULT_FOLDER, LOGSEARCH_CERT_FILENAME);
+ String keyStoreLocation = StringUtils.isNotEmpty(getKeyStoreLocation()) ? getKeyStoreLocation()
+ : String.format("%s/%s", LOGSEARCH_CERT_DEFAULT_FOLDER, LOGSEARCH_KEYSTORE_FILENAME);
+ char[] password = StringUtils.isNotEmpty(getKeyStorePassword()) ?
+ getKeyStorePassword().toCharArray() : LOGSEARCH_KEYSTORE_DEFAULT_PASSWORD.toCharArray();
+ boolean keyStoreFileExists = new File(keyStoreLocation).exists();
+ if (!keyStoreFileExists) {
+ FileUtil.createDirectory(certFolder);
+ LOG.warn("Keystore file ('{}') does not exist, creating new one. " +
+ "If the file exists, make sure you have proper permissions on that.", keyStoreLocation);
+ if (isKeyStoreSpecified() && !"JKS".equalsIgnoreCase(getKeyStoreType())) {
+ throw new RuntimeException(String.format("Keystore does not exist. Only JKS keystore can be auto generated. (%s)", keyStoreLocation));
+ }
+ LOG.info("SSL keystore is not specified. Generating it with certificate ... (using default format: JKS)");
+ Security.addProvider(new BouncyCastleProvider());
+ KeyPair keyPair = createKeyPair("RSA", 2048);
+ File privateKeyFile = new File(String.format("%s/%s", certFolder, LOGSEARCH_KEYSTORE_PRIVATE_KEY));
+ if (!privateKeyFile.exists()) {
+ FileUtils.writeByteArrayToFile(privateKeyFile, keyPair.getPrivate().getEncoded());
+ }
+ File file = new File(String.format("%s/%s", certFolder, LOGSEARCH_KEYSTORE_PUBLIC_KEY));
+ if (!file.exists()) {
+ FileUtils.writeByteArrayToFile(file, keyPair.getPublic().getEncoded());
+ }
+ X509Certificate cert = generateCertificate(certLocation, keyPair, certAlgorithm);
+ KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
+ keyStore.load(null, password);
+ setKeyAndCertInKeystore(cert, keyPair, keyStore, keyStoreLocation, password);
+ FileUtil.setPermissionOnDirectory(certFolder, "600");
+ }
+ } catch (Exception e) {
+ throw new RuntimeException(e);
+ }
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/ambari/blob/555f241c/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/util/SSLUtil.java
----------------------------------------------------------------------
diff --git a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/util/SSLUtil.java b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/util/SSLUtil.java
deleted file mode 100644
index b0b893f..0000000
--- a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/util/SSLUtil.java
+++ /dev/null
@@ -1,388 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.ambari.logsearch.util;
-
-import javax.net.ssl.SSLContext;
-
-import org.apache.ambari.logsearch.common.PropertiesHelper;
-import org.apache.ambari.logsearch.config.api.LogSearchPropertyDescription;
-import org.apache.commons.io.FileUtils;
-import org.apache.commons.lang.StringUtils;
-import org.apache.commons.lang3.ArrayUtils;
-import org.apache.hadoop.conf.Configuration;
-import org.bouncycastle.asn1.ASN1InputStream;
-import org.bouncycastle.asn1.x500.X500Name;
-import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
-import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
-import org.bouncycastle.jce.provider.BouncyCastleProvider;
-import org.bouncycastle.operator.ContentSigner;
-import org.bouncycastle.operator.DefaultDigestAlgorithmIdentifierFinder;
-import org.bouncycastle.operator.DefaultSignatureAlgorithmIdentifierFinder;
-import org.bouncycastle.operator.OperatorCreationException;
-import org.bouncycastle.operator.bc.BcContentSignerBuilder;
-import org.bouncycastle.operator.bc.BcRSAContentSignerBuilder;
-import org.bouncycastle.cert.X509CertificateHolder;
-import org.bouncycastle.cert.X509v3CertificateBuilder;
-import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
-import org.bouncycastle.crypto.params.RSAKeyParameters;
-import org.eclipse.jetty.util.ssl.SslContextFactory;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.math.BigInteger;
-import java.net.InetAddress;
-import java.security.InvalidKeyException;
-import java.security.KeyPair;
-import java.security.KeyPairGenerator;
-import java.security.KeyStore;
-import java.security.NoSuchAlgorithmException;
-import java.security.NoSuchProviderException;
-import java.security.SecureRandom;
-import java.security.Security;
-import java.security.SignatureException;
-import java.security.cert.Certificate;
-import java.security.cert.CertificateException;
-import java.security.cert.CertificateFactory;
-import java.security.cert.X509Certificate;
-import java.security.interfaces.RSAPrivateKey;
-import java.security.interfaces.RSAPublicKey;
-import java.util.Date;
-
-import static org.apache.ambari.logsearch.common.LogSearchConstants.LOGSEARCH_PROPERTIES_FILE;
-
-public class SSLUtil {
- private static final Logger LOG = LoggerFactory.getLogger(SSLUtil.class);
-
- private static final String KEYSTORE_LOCATION_ARG = "javax.net.ssl.keyStore";
- private static final String KEYSTORE_PASSWORD_ARG = "javax.net.ssl.keyStorePassword";
- private static final String KEYSTORE_TYPE_ARG = "javax.net.ssl.keyStoreType";
- private static final String DEFAULT_KEYSTORE_TYPE = "JKS";
- private static final String TRUSTSTORE_LOCATION_ARG = "javax.net.ssl.trustStore";
- private static final String TRUSTSTORE_PASSWORD_ARG = "javax.net.ssl.trustStorePassword";
- private static final String TRUSTSTORE_TYPE_ARG = "javax.net.ssl.trustStoreType";
- private static final String DEFAULT_TRUSTSTORE_TYPE = "JKS";
- private static final String KEYSTORE_PASSWORD_PROPERTY_NAME = "logsearch_keystore_password";
- private static final String TRUSTSTORE_PASSWORD_PROPERTY_NAME = "logsearch_truststore_password";
- private static final String KEYSTORE_PASSWORD_FILE = "ks_pass.txt";
- private static final String TRUSTSTORE_PASSWORD_FILE = "ts_pass.txt";
-
- @LogSearchPropertyDescription(
- name = "hadoop.security.credential.provider.path",
- description = "Path to interrogate for protected credentials. (see: https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-common/CredentialProviderAPI.html)",
- examples = {"localjceks://file/home/mypath/my.jceks"},
- sources = {LOGSEARCH_PROPERTIES_FILE}
- )
- private static final String CREDENTIAL_STORE_PROVIDER_PATH = "hadoop.security.credential.provider.path";
-
- @LogSearchPropertyDescription(
- name = "logsearch.cert.folder.location",
- description = "Folder where the generated certificates (SSL) will be located. Make sure the user of Log Search Server can access it.",
- examples = {"/etc/mypath/keys"},
- defaultValue = "/etc/ambari-logsearch-portal/conf/keys",
- sources = {LOGSEARCH_PROPERTIES_FILE}
- )
- private static final String LOGSEARCH_CERT_FOLDER_LOCATION = "logsearch.cert.folder.location";
-
- @LogSearchPropertyDescription(
- name = "logsearch.cert.algorithm",
- description = "Algorithm to generate certificates for SSL (if needed).",
- examples = {"sha256WithRSA"},
- defaultValue = "sha256WithRSA",
- sources = {LOGSEARCH_PROPERTIES_FILE}
- )
- private static final String LOGSEARCH_CERT_ALGORITHM = "logsearch.cert.algorithm";
-
- private static final String LOGSEARCH_CERT_FILENAME = "logsearch.crt";
- private static final String LOGSEARCH_KEYSTORE_FILENAME = "logsearch.jks";
- private static final String LOGSEARCH_KEYSTORE_PRIVATE_KEY = "logsearch.private.key";
- private static final String LOGSEARCH_KEYSTORE_PUBLIC_KEY = "logsearch.public.key";
- private static final String LOGSEARCH_CERT_DEFAULT_ALGORITHM = "sha256WithRSA";
-
- private static final String LOGSEARCH_CERT_DEFAULT_FOLDER = "/etc/ambari-logsearch-portal/conf/keys";
- private static final String LOGSEARCH_KEYSTORE_DEFAULT_PASSWORD = "bigdata";
-
- private SSLUtil() {
- throw new UnsupportedOperationException();
- }
-
- public static String getKeyStoreLocation() {
- return System.getProperty(KEYSTORE_LOCATION_ARG);
- }
-
- public static String getKeyStorePassword() {
- return System.getProperty(KEYSTORE_PASSWORD_ARG);
- }
-
- public static String getKeyStoreType() {
- return System.getProperty(KEYSTORE_TYPE_ARG, DEFAULT_KEYSTORE_TYPE);
- }
-
- public static String getTrustStoreLocation() {
- return System.getProperty(TRUSTSTORE_LOCATION_ARG);
- }
-
- public static String getTrustStorePassword() {
- return System.getProperty(TRUSTSTORE_PASSWORD_ARG);
- }
-
- public static String getTrustStoreType() {
- return System.getProperty(TRUSTSTORE_TYPE_ARG, DEFAULT_TRUSTSTORE_TYPE);
- }
-
- public static boolean isKeyStoreSpecified() {
- return StringUtils.isNotEmpty(getKeyStoreLocation());
- }
-
- private static boolean isTrustStoreSpecified() {
- return StringUtils.isNotEmpty(getTrustStoreLocation());
- }
-
- public static SslContextFactory getSslContextFactory() {
- SslContextFactory sslContextFactory = new SslContextFactory();
- sslContextFactory.setKeyStorePath(getKeyStoreLocation());
- sslContextFactory.setKeyStorePassword(getKeyStorePassword());
- sslContextFactory.setKeyStoreType(getKeyStoreType());
- if (isTrustStoreSpecified()) {
- sslContextFactory.setTrustStorePath(getTrustStoreLocation());
- sslContextFactory.setTrustStorePassword(getTrustStorePassword());
- sslContextFactory.setTrustStoreType(getTrustStoreType());
- }
-
- return sslContextFactory;
- }
-
- public static SSLContext getSSLContext() {
- SslContextFactory sslContextFactory = getSslContextFactory();
-
- try {
- sslContextFactory.start();
- return sslContextFactory.getSslContext();
- } catch (Exception e) {
- LOG.error("Could not create SSL Context", e);
- return null;
- } finally {
- try {
- sslContextFactory.stop();
- } catch (Exception e) {
- LOG.error("Could not stop sslContextFactory", e);
- }
- }
- }
-
- private static String getPasswordFromFile(String fileName) {
- try {
- File pwdFile = new File(LOGSEARCH_CERT_DEFAULT_FOLDER, fileName);
- if (!pwdFile.exists()) {
- FileUtils.writeStringToFile(pwdFile, LOGSEARCH_KEYSTORE_DEFAULT_PASSWORD);
- return LOGSEARCH_KEYSTORE_DEFAULT_PASSWORD;
- } else {
- return FileUtils.readFileToString(pwdFile);
- }
- } catch (Exception e) {
- LOG.warn("Exception occurred during read/write password file for keystore/truststore.", e);
- return null;
- }
- }
-
- private static String getPasswordFromCredentialStore(String propertyName) {
- try {
- String providerPath = PropertiesHelper.getProperty(CREDENTIAL_STORE_PROVIDER_PATH);
- if (providerPath == null) {
- return null;
- }
-
- Configuration config = new Configuration();
- config.set(CREDENTIAL_STORE_PROVIDER_PATH, providerPath);
- char[] passwordChars = config.getPassword(propertyName);
- return (ArrayUtils.isNotEmpty(passwordChars)) ? new String(passwordChars) : null;
- } catch (Exception e) {
- LOG.warn(String.format("Could not load password %s from credential store, using default password", propertyName), e);
- return null;
- }
- }
-
- private static String getPassword(String propertyName, String fileName) {
- String credentialStorePassword = getPasswordFromCredentialStore(propertyName);
- if (credentialStorePassword != null) {
- return credentialStorePassword;
- }
-
- String filePassword = getPasswordFromFile(fileName);
- if (filePassword != null) {
- return filePassword;
- }
-
- return LOGSEARCH_KEYSTORE_DEFAULT_PASSWORD;
- }
-
- /**
- * Put private key into in-memory keystore and write it to a file (JKS file)
- */
- private static void setKeyAndCertInKeystore(X509Certificate cert, KeyPair keyPair, KeyStore keyStore, String keyStoreLocation, char[] password)
- throws Exception {
- Certificate[] certChain = new Certificate[1];
- certChain[0] = cert;
- try (FileOutputStream fos = new FileOutputStream(keyStoreLocation)) {
- keyStore.setKeyEntry("logsearch.alias", keyPair.getPrivate(), password, certChain);
- keyStore.store(fos, password);
- } catch (Exception e) {
- LOG.error("Could not write certificate to Keystore", e);
- throw e;
- }
- }
-
- /**
- * Create in-memory keypair with bouncy castle
- */
- private static KeyPair createKeyPair(String encryptionType, int byteCount)
- throws NoSuchProviderException, NoSuchAlgorithmException {
- Security.addProvider(new BouncyCastleProvider());
- KeyPairGenerator keyPairGenerator = createKeyPairGenerator(encryptionType, byteCount);
- return keyPairGenerator.genKeyPair();
- }
-
- /**
- * Generate X509 certificate if it does not exist
- */
- private static X509Certificate generateCertificate(String certificateLocation, KeyPair keyPair, String algorithm) throws Exception {
- try {
- File certFile = new File(certificateLocation);
- if (certFile.exists()) {
- LOG.info("Certificate file exists ({}), skip the generation.", certificateLocation);
- return getCertFile(certificateLocation);
- } else {
- Security.addProvider(new BouncyCastleProvider());
- X509Certificate cert = createCert(keyPair, algorithm, InetAddress.getLocalHost().getCanonicalHostName());
- FileUtils.writeByteArrayToFile(certFile, cert.getEncoded());
- return cert;
- }
- } catch (Exception e) {
- LOG.error("Could not create certificate.", e);
- throw e;
- }
- }
-
- private static void ensureStorePassword(String locationArg, String pwdArg, String propertyName, String fileName) {
- if (StringUtils.isNotEmpty(System.getProperty(locationArg)) && StringUtils.isEmpty(System.getProperty(pwdArg))) {
- String password = getPassword(propertyName, fileName);
- System.setProperty(pwdArg, password);
- }
- }
-
- public static void ensureStorePasswords() {
- ensureStorePassword(KEYSTORE_LOCATION_ARG, KEYSTORE_PASSWORD_ARG, KEYSTORE_PASSWORD_PROPERTY_NAME, KEYSTORE_PASSWORD_FILE);
- ensureStorePassword(TRUSTSTORE_LOCATION_ARG, TRUSTSTORE_PASSWORD_ARG, TRUSTSTORE_PASSWORD_PROPERTY_NAME, TRUSTSTORE_PASSWORD_FILE);
- }
-
- private static X509Certificate getCertFile(String location) throws Exception {
- try (FileInputStream fos = new FileInputStream(location)) {
- CertificateFactory factory = CertificateFactory.getInstance("X.509");
- return (X509Certificate) factory.generateCertificate(fos);
- } catch (Exception e) {
- LOG.error("Cannot read cert file. ('" + location + "')", e);
- throw e;
- }
- }
-
- private static X509Certificate createCert(KeyPair keyPair, String signatureAlgoritm, String domainName)
- throws NoSuchAlgorithmException, InvalidKeyException, SignatureException, OperatorCreationException, CertificateException, IOException {
-
- RSAPublicKey rsaPublicKey = (RSAPublicKey) keyPair.getPublic();
- RSAPrivateKey rsaPrivateKey = (RSAPrivateKey) keyPair.getPrivate();
-
- AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find(signatureAlgoritm);
- AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
- BcContentSignerBuilder sigGen = new BcRSAContentSignerBuilder(sigAlgId, digAlgId);
-
- ASN1InputStream publicKeyStream = new ASN1InputStream(rsaPublicKey.getEncoded());
- SubjectPublicKeyInfo pubKey = SubjectPublicKeyInfo.getInstance(publicKeyStream.readObject());
- publicKeyStream.close();
-
- X509v3CertificateBuilder v3CertBuilder = new X509v3CertificateBuilder(
- new X500Name("CN=" + domainName + ", OU=None, O=None L=None, C=None"),
- BigInteger.valueOf(Math.abs(new SecureRandom().nextInt())),
- new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30),
- new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 365*10)),
- new X500Name("CN=" + domainName + ", OU=None, O=None L=None, C=None"),
- pubKey);
-
- RSAKeyParameters keyParams = new RSAKeyParameters(true, rsaPrivateKey.getPrivateExponent(), rsaPrivateKey.getModulus());
- ContentSigner contentSigner = sigGen.build(keyParams);
-
- X509CertificateHolder certificateHolder = v3CertBuilder.build(contentSigner);
-
- JcaX509CertificateConverter certConverter = new JcaX509CertificateConverter().setProvider("BC");
- return certConverter.getCertificate(certificateHolder);
- }
-
- private static KeyPairGenerator createKeyPairGenerator(String algorithmIdentifier, int bitCount)
- throws NoSuchProviderException, NoSuchAlgorithmException {
- KeyPairGenerator kpg = KeyPairGenerator.getInstance(algorithmIdentifier, BouncyCastleProvider.PROVIDER_NAME);
- kpg.initialize(bitCount);
- return kpg;
- }
-
- /**
- * Create keystore with keys and certificate (only if the keystore does not exist or if you have no permissions on the keystore file)
- */
- public static void loadKeystore() {
- try {
- String certFolder = PropertiesHelper.getProperty(LOGSEARCH_CERT_FOLDER_LOCATION, LOGSEARCH_CERT_DEFAULT_FOLDER);
- String certAlgorithm = PropertiesHelper.getProperty(LOGSEARCH_CERT_ALGORITHM, LOGSEARCH_CERT_DEFAULT_ALGORITHM);
- String certLocation = String.format("%s/%s", LOGSEARCH_CERT_DEFAULT_FOLDER, LOGSEARCH_CERT_FILENAME);
- String keyStoreLocation = StringUtils.isNotEmpty(getKeyStoreLocation()) ? getKeyStoreLocation()
- : String.format("%s/%s", LOGSEARCH_CERT_DEFAULT_FOLDER, LOGSEARCH_KEYSTORE_FILENAME);
- char[] password = StringUtils.isNotEmpty(getKeyStorePassword()) ?
- getKeyStorePassword().toCharArray() : LOGSEARCH_KEYSTORE_DEFAULT_PASSWORD.toCharArray();
- boolean keyStoreFileExists = new File(keyStoreLocation).exists();
- if (!keyStoreFileExists) {
- FileUtil.createDirectory(certFolder);
- LOG.warn("Keystore file ('{}') does not exist, creating new one. " +
- "If the file exists, make sure you have proper permissions on that.", keyStoreLocation);
- if (isKeyStoreSpecified() && !"JKS".equalsIgnoreCase(getKeyStoreType())) {
- throw new RuntimeException(String.format("Keystore does not exist. Only JKS keystore can be auto generated. (%s)", keyStoreLocation));
- }
- LOG.info("SSL keystore is not specified. Generating it with certificate ... (using default format: JKS)");
- Security.addProvider(new BouncyCastleProvider());
- KeyPair keyPair = createKeyPair("RSA", 2048);
- File privateKeyFile = new File(String.format("%s/%s", certFolder, LOGSEARCH_KEYSTORE_PRIVATE_KEY));
- if (!privateKeyFile.exists()) {
- FileUtils.writeByteArrayToFile(privateKeyFile, keyPair.getPrivate().getEncoded());
- }
- File file = new File(String.format("%s/%s", certFolder, LOGSEARCH_KEYSTORE_PUBLIC_KEY));
- if (!file.exists()) {
- FileUtils.writeByteArrayToFile(file, keyPair.getPublic().getEncoded());
- }
- X509Certificate cert = generateCertificate(certLocation, keyPair, certAlgorithm);
- KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
- keyStore.load(null, password);
- setKeyAndCertInKeystore(cert, keyPair, keyStore, keyStoreLocation, password);
- FileUtil.setPermissionOnDirectory(certFolder, "600");
- }
- } catch (Exception e) {
- throw new RuntimeException(e);
- }
- }
-
-}
http://git-wip-us.apache.org/repos/asf/ambari/blob/555f241c/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/util/WebUtil.java
----------------------------------------------------------------------
diff --git a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/util/WebUtil.java b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/util/WebUtil.java
deleted file mode 100644
index 36865ad..0000000
--- a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/util/WebUtil.java
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.ambari.logsearch.util;
-
-import java.io.IOException;
-import java.net.ServerSocket;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.net.URL;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class WebUtil {
- private static final Logger LOG = LoggerFactory.getLogger(WebUtil.class);
-
- private static final String WEB_RESOURCE_FOLDER = "webapps/app";
-
- private WebUtil() {
- throw new UnsupportedOperationException();
- }
-
- public static URI findWebResourceBase() {
- URL fileCompleteUrl = Thread.currentThread().getContextClassLoader().getResource(WEB_RESOURCE_FOLDER);
- String errorMessage = "Web Resource Folder " + WEB_RESOURCE_FOLDER + " not found in classpath";
- if (fileCompleteUrl != null) {
- try {
- return fileCompleteUrl.toURI().normalize();
- } catch (URISyntaxException e) {
- LOG.error(errorMessage, e);
- System.exit(1);
- }
- } else {
- LOG.error(errorMessage);
- System.exit(1);
- }
- throw new IllegalStateException(errorMessage);
- }
-
- public static void checkPort(int port) {
- try (ServerSocket serverSocket = new ServerSocket(port)) {
- } catch (IOException ex) {
- LOG.error(ex.getLocalizedMessage() + " PORT :" + port);
- System.exit(1);
- }
- }
-
-}
http://git-wip-us.apache.org/repos/asf/ambari/blob/555f241c/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/filters/LogsearchKRBAuthenticationFilter.java
----------------------------------------------------------------------
diff --git a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/filters/LogsearchKRBAuthenticationFilter.java b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/filters/LogsearchKRBAuthenticationFilter.java
index ec3075c..e50fab5 100644
--- a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/filters/LogsearchKRBAuthenticationFilter.java
+++ b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/filters/LogsearchKRBAuthenticationFilter.java
@@ -30,6 +30,8 @@ import java.util.Map;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
+import javax.annotation.PostConstruct;
+import javax.inject.Inject;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletContext;
@@ -40,7 +42,7 @@ import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import org.apache.ambari.logsearch.config.api.LogSearchPropertyDescription;
+import org.apache.ambari.logsearch.conf.LogSearchSpnegoConfig;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.authentication.AbstractAuthenticationToken;
@@ -54,7 +56,6 @@ import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.context.SecurityContextImpl;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
-import org.apache.ambari.logsearch.common.PropertiesHelper;
import org.apache.commons.collections.iterators.IteratorEnumeration;
import org.apache.commons.lang.StringEscapeUtils;
import org.apache.commons.lang.StringUtils;
@@ -63,83 +64,12 @@ import org.apache.hadoop.security.authentication.server.PseudoAuthenticationHand
import org.apache.hadoop.security.authentication.util.KerberosName;
import org.springframework.security.web.authentication.WebAuthenticationDetails;
-import static org.apache.ambari.logsearch.common.LogSearchConstants.LOGSEARCH_PROPERTIES_FILE;
public class LogsearchKRBAuthenticationFilter extends LogsearchKrbFilter {
private static final Logger logger = LoggerFactory.getLogger(LogsearchKRBAuthenticationFilter.class);
- @LogSearchPropertyDescription(
- name = "logsearch.hadoop.security.auth_to_local",
- description = "Rules that will be applied on authentication names and map them into local usernames.",
- examples = {"RULE:[1:$1@$0](.*@EXAMPLE.COM)s/@.*//", "DEFAULT"},
- defaultValue = "DEFAULT",
- sources = {LOGSEARCH_PROPERTIES_FILE}
- )
- private static final String NAME_RULES = "logsearch.hadoop.security.auth_to_local";
-
- @LogSearchPropertyDescription(
- name = "logsearch.admin.kerberos.token.valid.seconds",
- description = "Kerberos token validity in seconds.",
- examples = {"30"},
- defaultValue = "30",
- sources = {LOGSEARCH_PROPERTIES_FILE}
- )
- private static final String TOKEN_VALID = "logsearch.admin.kerberos.token.valid.seconds";
-
- @LogSearchPropertyDescription(
- name = "logsearch.admin.kerberos.cookie.domain",
- description = "Domain for Kerberos cookie.",
- examples = {"c6401.ambari.apache.org", "localhost"},
- defaultValue = "localhost",
- sources = {LOGSEARCH_PROPERTIES_FILE}
- )
- private static final String COOKIE_DOMAIN = "logsearch.admin.kerberos.cookie.domain";
-
- @LogSearchPropertyDescription(
- name = "logsearch.admin.kerberos.cookie.path",
- description = "Cookie path of the kerberos cookie",
- examples = {"/"},
- defaultValue = "/",
- sources = {LOGSEARCH_PROPERTIES_FILE}
- )
- private static final String COOKIE_PATH = "logsearch.admin.kerberos.cookie.path";
-
- @LogSearchPropertyDescription(
- name = "logsearch.spnego.kerberos.principal",
- description = "Principal for SPNEGO authentication for Http requests",
- examples = {"myuser@EXAMPLE.COM"},
- defaultValue = "",
- sources = {LOGSEARCH_PROPERTIES_FILE}
- )
- private static final String PRINCIPAL = "logsearch.spnego.kerberos.principal";
-
- @LogSearchPropertyDescription(
- name = "logsearch.spnego.kerberos.keytab",
- description = "Keytab for SPNEGO authentication for Http requests.",
- examples = {"/etc/security/keytabs/mykeytab.keytab"},
- defaultValue = "",
- sources = {LOGSEARCH_PROPERTIES_FILE}
- )
- private static final String KEYTAB = "logsearch.spnego.kerberos.keytab";
-
- @LogSearchPropertyDescription(
- name = "logsearch.spnego.kerberos.host",
- description = "",
- examples = {"c6401.ambari.apache.org", "localhost"},
- defaultValue = "localhost",
- sources = {LOGSEARCH_PROPERTIES_FILE}
- )
- private static final String HOST_NAME = "logsearch.spnego.kerberos.host";
-
- @LogSearchPropertyDescription(
- name = "logsearch.spnego.kerberos.enabled",
- description = "Enable SPNEGO based authentication for Log Search Server.",
- examples = {"true", "false"},
- defaultValue = "false",
- sources = {LOGSEARCH_PROPERTIES_FILE}
- )
- private static final String KERBEROS_ENABLED = "logsearch.spnego.kerberos.enabled";
-
+ @Inject
+ private LogSearchSpnegoConfig logSearchSpnegoConfig;
private static final String NAME_RULES_PARAM = "kerberos.name.rules";
private static final String TOKEN_VALID_PARAM = "token.validity";
@@ -157,7 +87,8 @@ public class LogsearchKRBAuthenticationFilter extends LogsearchKrbFilter {
private String authType = PseudoAuthenticationHandler.TYPE;
private static boolean spnegoEnable = false;
- public LogsearchKRBAuthenticationFilter() {
+ @PostConstruct
+ public void postConstruct() {
try {
isSpnegoEnable();
init(null);
@@ -169,18 +100,18 @@ public class LogsearchKRBAuthenticationFilter extends LogsearchKrbFilter {
@Override
public void init(FilterConfig conf) throws ServletException {
final FilterConfig globalConf = conf;
- String hostName = PropertiesHelper.getProperty(HOST_NAME, "localhost");
+ String hostName = logSearchSpnegoConfig.getHostName();
final Map<String, String> params = new HashMap<String, String>();
if (spnegoEnable) {
authType = KerberosAuthenticationHandler.TYPE;
}
params.put(AUTH_TYPE,authType);
- params.put(NAME_RULES_PARAM,PropertiesHelper.getProperty(NAME_RULES, "DEFAULT"));
- params.put(TOKEN_VALID_PARAM, PropertiesHelper.getProperty(TOKEN_VALID, "30"));
- params.put(COOKIE_DOMAIN_PARAM, PropertiesHelper.getProperty(COOKIE_DOMAIN, hostName));
- params.put(COOKIE_PATH_PARAM, PropertiesHelper.getProperty(COOKIE_PATH, "/"));
- params.put(PRINCIPAL_PARAM,PropertiesHelper.getProperty(PRINCIPAL,""));
- params.put(KEYTAB_PARAM,PropertiesHelper.getProperty(KEYTAB,""));
+ params.put(NAME_RULES_PARAM, logSearchSpnegoConfig.getNameRules());
+ params.put(TOKEN_VALID_PARAM, logSearchSpnegoConfig.getTokenValid());
+ params.put(COOKIE_DOMAIN_PARAM, logSearchSpnegoConfig.getCookieDomain());
+ params.put(COOKIE_PATH_PARAM, logSearchSpnegoConfig.getCookiePath());
+ params.put(PRINCIPAL_PARAM, logSearchSpnegoConfig.getPrincipal());
+ params.put(KEYTAB_PARAM, logSearchSpnegoConfig.getKeyTab());
FilterConfig myConf = new FilterConfig() {
@Override
public ServletContext getServletContext() {
@@ -263,7 +194,7 @@ public class LogsearchKRBAuthenticationFilter extends LogsearchKrbFilter {
}
if (!isLoginRequest(httpRequest) && spnegoEnable
&& (existingAuth == null || !existingAuth.isAuthenticated())) {
- KerberosName.setRules(PropertiesHelper.getProperty(NAME_RULES, "DEFAULT"));
+ KerberosName.setRules(logSearchSpnegoConfig.getNameRules());
String userName = getUsernameFromRequest(httpRequest);
if ((existingAuth == null || !existingAuth.isAuthenticated())
&& (StringUtils.isNotEmpty(userName))) {
@@ -297,12 +228,12 @@ public class LogsearchKRBAuthenticationFilter extends LogsearchKrbFilter {
}
private void isSpnegoEnable() {
- spnegoEnable = PropertiesHelper.getBooleanProperty(KERBEROS_ENABLED, false);
+ spnegoEnable = logSearchSpnegoConfig.isKerberosEnabled();
if (spnegoEnable) {
spnegoEnable = false;
- String keytab = PropertiesHelper.getProperty(KEYTAB);
- String principal = PropertiesHelper.getProperty(PRINCIPAL);
- String hostname = PropertiesHelper.getProperty(HOST_NAME);
+ String keytab = logSearchSpnegoConfig.getKeyTab();
+ String principal = logSearchSpnegoConfig.getPrincipal();
+ String hostname = logSearchSpnegoConfig.getHostName();
if (StringUtils.isNotEmpty(keytab) && StringUtils.isNotEmpty(principal)
&& StringUtils.isNotEmpty(hostname)) {
spnegoEnable = true;
http://git-wip-us.apache.org/repos/asf/ambari/blob/555f241c/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/listener/LogSearchSessionListener.java
----------------------------------------------------------------------
diff --git a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/listener/LogSearchSessionListener.java b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/listener/LogSearchSessionListener.java
index 9fa5c80..55101db 100644
--- a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/listener/LogSearchSessionListener.java
+++ b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/listener/LogSearchSessionListener.java
@@ -35,7 +35,7 @@ public class LogSearchSessionListener implements HttpSessionListener {
synchronized (this) {
numberOfSessions++;
}
- LOG.debug(String.format("New session is created (Id: %s). Number of sessions: %d", event.getSession().getId(), numberOfSessions));
+ LOG.info(String.format("New session is created (Id: %s). Number of sessions: %d", event.getSession().getId(), numberOfSessions));
}
@Override
@@ -43,6 +43,6 @@ public class LogSearchSessionListener implements HttpSessionListener {
synchronized (this) {
numberOfSessions--;
}
- LOG.debug(String.format("Session destroyed (Id: %s). Number of sessions: %d", event.getSession().getId(), numberOfSessions));
+ LOG.info(String.format("Session destroyed (Id: %s). Number of sessions: %d", event.getSession().getId(), numberOfSessions));
}
}
http://git-wip-us.apache.org/repos/asf/ambari/blob/555f241c/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LdapProperties.java
----------------------------------------------------------------------
diff --git a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LdapProperties.java b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LdapProperties.java
deleted file mode 100644
index 82e71fe..0000000
--- a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LdapProperties.java
+++ /dev/null
@@ -1,365 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.ambari.logsearch.web.security;
-
-import org.apache.commons.lang.StringUtils;
-
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-
-/**
- * Describes LDAP Server connection parameters
- */
-public class LdapProperties {
- private String primaryUrl;
- private String secondaryUrl;
- private boolean useSsl;
- private boolean anonymousBind;
- private String managerDn;
- private String managerPassword;
- private String baseDN;
- private String dnAttribute;
- private String referralMethod;
-
- // LDAP group properties
- private String groupBase;
- private String groupObjectClass;
- private String groupMembershipAttr;
- private String groupNamingAttr;
- private String adminGroupMappingRules;
- private boolean groupMappingEnabled;
-
- // LDAP user properties
- private String userBase;
- private String userObjectClass;
- private String usernameAttribute;
- private String userSearchBase = "";
-
- private String groupSearchFilter;
- private static final String userSearchFilter = "({attribute}={0})";
-
- public List<String> getLdapUrls() {
- String protocol = useSsl ? "ldaps://" : "ldap://";
-
- if (StringUtils.isEmpty(primaryUrl) || primaryUrl.equalsIgnoreCase("none")) {
- return Collections.emptyList();
- } else {
- List<String> list = new ArrayList<String>();
- list.add(protocol + primaryUrl);
- if (StringUtils.isNotEmpty(secondaryUrl)) {
- list.add(protocol + secondaryUrl);
- }
- return list;
- }
- }
-
- public String getPrimaryUrl() {
- return primaryUrl;
- }
-
- public void setPrimaryUrl(String primaryUrl) {
- this.primaryUrl = primaryUrl;
- }
-
- public String getSecondaryUrl() {
- return secondaryUrl;
- }
-
- public void setSecondaryUrl(String secondaryUrl) {
- this.secondaryUrl = secondaryUrl;
- }
-
- public boolean isUseSsl() {
- return useSsl;
- }
-
- public void setUseSsl(boolean useSsl) {
- this.useSsl = useSsl;
- }
-
- public boolean isAnonymousBind() {
- return anonymousBind;
- }
-
- public void setAnonymousBind(boolean anonymousBind) {
- this.anonymousBind = anonymousBind;
- }
-
- public String getManagerDn() {
- return managerDn;
- }
-
- public void setManagerDn(String managerDn) {
- this.managerDn = managerDn;
- }
-
- public String getManagerPassword() {
- return managerPassword;
- }
-
- public void setManagerPassword(String managerPassword) {
- this.managerPassword = managerPassword;
- }
-
- public String getBaseDN() {
- return baseDN;
- }
-
- public void setBaseDN(String baseDN) {
- this.baseDN = baseDN;
- }
-
- public String getUserSearchBase() {
- return userSearchBase;
- }
-
- public void setUserSearchBase(String userSearchBase) {
- this.userSearchBase = userSearchBase;
- }
-
- public String getUserSearchFilter() {
- return userSearchFilter.replace("{attribute}", usernameAttribute);
- }
-
- public String getUsernameAttribute() {
- return usernameAttribute;
- }
-
- public void setUsernameAttribute(String usernameAttribute) {
- this.usernameAttribute = usernameAttribute;
- }
-
- public String getGroupBase() {
- return groupBase;
- }
-
- public void setGroupBase(String groupBase) {
- this.groupBase = groupBase;
- }
-
- public String getGroupObjectClass() {
- return groupObjectClass;
- }
-
- public void setGroupObjectClass(String groupObjectClass) {
- this.groupObjectClass = groupObjectClass;
- }
-
- public String getGroupMembershipAttr() {
- return groupMembershipAttr;
- }
-
- public void setGroupMembershipAttr(String groupMembershipAttr) {
- this.groupMembershipAttr = groupMembershipAttr;
- }
-
- public String getGroupNamingAttr() {
- return groupNamingAttr;
- }
-
- public void setGroupNamingAttr(String groupNamingAttr) {
- this.groupNamingAttr = groupNamingAttr;
- }
-
- public String getAdminGroupMappingRules() {
- return adminGroupMappingRules;
- }
-
- public void setAdminGroupMappingRules(String adminGroupMappingRules) {
- this.adminGroupMappingRules = adminGroupMappingRules;
- }
-
- public String getGroupSearchFilter() {
- return groupSearchFilter;
- }
-
- public void setGroupSearchFilter(String groupSearchFilter) {
- this.groupSearchFilter = groupSearchFilter;
- }
-
- public boolean isGroupMappingEnabled() {
- return groupMappingEnabled;
- }
-
- public void setGroupMappingEnabled(boolean groupMappingEnabled) {
- this.groupMappingEnabled = groupMappingEnabled;
- }
-
- public void setUserBase(String userBase) {
- this.userBase = userBase;
- }
-
- public void setUserObjectClass(String userObjectClass) {
- this.userObjectClass = userObjectClass;
- }
-
- public String getUserBase() {
- return userBase;
- }
-
- public String getUserObjectClass() {
- return userObjectClass;
- }
-
- public String getDnAttribute() {
- return dnAttribute;
- }
-
- public void setDnAttribute(String dnAttribute) {
- this.dnAttribute = dnAttribute;
- }
-
- public void setReferralMethod(String referralMethod) {
- this.referralMethod = referralMethod;
- }
-
- public String getReferralMethod() {
- return referralMethod;
- }
-
- @Override
- public boolean equals(Object obj) {
- if (this == obj)
- return true;
- if (obj == null || getClass() != obj.getClass())
- return false;
-
- LdapProperties that = (LdapProperties) obj;
-
- if (primaryUrl != null ? !primaryUrl.equals(that.primaryUrl)
- : that.primaryUrl != null)
- return false;
- if (secondaryUrl != null ? !secondaryUrl.equals(that.secondaryUrl)
- : that.secondaryUrl != null)
- return false;
- if (useSsl != that.useSsl)
- return false;
- if (anonymousBind != that.anonymousBind)
- return false;
- if (managerDn != null ? !managerDn.equals(that.managerDn)
- : that.managerDn != null)
- return false;
- if (managerPassword != null ? !managerPassword
- .equals(that.managerPassword) : that.managerPassword != null)
- return false;
- if (baseDN != null ? !baseDN.equals(that.baseDN) : that.baseDN != null)
- return false;
- if (userBase != null ? !userBase.equals(that.userBase)
- : that.userBase != null)
- return false;
- if (userObjectClass != null ? !userObjectClass
- .equals(that.userObjectClass) : that.userObjectClass != null)
- return false;
- if (usernameAttribute != null ? !usernameAttribute
- .equals(that.usernameAttribute)
- : that.usernameAttribute != null)
- return false;
- if (groupBase != null ? !groupBase.equals(that.groupBase)
- : that.groupBase != null)
- return false;
- if (groupObjectClass != null ? !groupObjectClass
- .equals(that.groupObjectClass) : that.groupObjectClass != null)
- return false;
- if (groupMembershipAttr != null ? !groupMembershipAttr
- .equals(that.groupMembershipAttr)
- : that.groupMembershipAttr != null)
- return false;
- if (groupNamingAttr != null ? !groupNamingAttr
- .equals(that.groupNamingAttr) : that.groupNamingAttr != null)
- return false;
- if (adminGroupMappingRules != null ? !adminGroupMappingRules
- .equals(that.adminGroupMappingRules)
- : that.adminGroupMappingRules != null)
- return false;
- if (groupSearchFilter != null ? !groupSearchFilter
- .equals(that.groupSearchFilter)
- : that.groupSearchFilter != null)
- return false;
- if (dnAttribute != null ? !dnAttribute.equals(that.dnAttribute)
- : that.dnAttribute != null)
- return false;
- if (referralMethod != null ? !referralMethod
- .equals(that.referralMethod) : that.referralMethod != null)
- return false;
-
- return true;
- }
-
- @Override
- public int hashCode() {
- int result = primaryUrl != null ? primaryUrl.hashCode() : 0;
- result = 31 * result
- + (secondaryUrl != null ? secondaryUrl.hashCode() : 0);
- result = 31 * result + (useSsl ? 1 : 0);
- result = 31 * result + (anonymousBind ? 1 : 0);
- result = 31 * result + (managerDn != null ? managerDn.hashCode() : 0);
- result = 31 * result
- + (managerPassword != null ? managerPassword.hashCode() : 0);
- result = 31 * result + (baseDN != null ? baseDN.hashCode() : 0);
- result = 31 * result + (userBase != null ? userBase.hashCode() : 0);
- result = 31 * result
- + (userObjectClass != null ? userObjectClass.hashCode() : 0);
- result = 31
- * result
- + (usernameAttribute != null ? usernameAttribute.hashCode() : 0);
- result = 31 * result + (groupBase != null ? groupBase.hashCode() : 0);
- result = 31 * result
- + (groupObjectClass != null ? groupObjectClass.hashCode() : 0);
- result = 31
- * result
- + (groupMembershipAttr != null ? groupMembershipAttr.hashCode()
- : 0);
- result = 31 * result
- + (groupNamingAttr != null ? groupNamingAttr.hashCode() : 0);
- result = 31
- * result
- + (adminGroupMappingRules != null ? adminGroupMappingRules
- .hashCode() : 0);
- result = 31
- * result
- + (groupSearchFilter != null ? groupSearchFilter.hashCode() : 0);
- result = 31 * result
- + (dnAttribute != null ? dnAttribute.hashCode() : 0);
- result = 31 * result
- + (referralMethod != null ? referralMethod.hashCode() : 0);
- return result;
- }
-
- @Override
- public String toString() {
- return "LdapProperties [primaryUrl=" + primaryUrl + ", secondaryUrl="
- + secondaryUrl + ", useSsl=" + useSsl + ", anonymousBind="
- + anonymousBind + ", managerDn=" + managerDn
- + ", managerPassword=" + managerPassword == null ? "null"
- : "****" + ", baseDN=" + baseDN + ", dnAttribute="
- + dnAttribute + ", referralMethod=" + referralMethod
- + ", groupBase=" + groupBase + ", groupObjectClass="
- + groupObjectClass + ", groupMembershipAttr="
- + groupMembershipAttr + ", groupNamingAttr="
- + groupNamingAttr + ", adminGroupMappingRules="
- + adminGroupMappingRules + ", groupMappingEnabled="
- + groupMappingEnabled + ", userBase=" + userBase
- + ", userObjectClass=" + userObjectClass
- + ", usernameAttribute=" + usernameAttribute
- + ", userSearchBase=" + userSearchBase
- + ", groupSearchFilter=" + groupSearchFilter + "]";
- }
-
-}
http://git-wip-us.apache.org/repos/asf/ambari/blob/555f241c/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LdapPropertyName.java
----------------------------------------------------------------------
diff --git a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LdapPropertyName.java b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LdapPropertyName.java
deleted file mode 100644
index 370c94b..0000000
--- a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LdapPropertyName.java
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.ambari.logsearch.web.security;
-
-public class LdapPropertyName {
-
- public static final String LDAP_USE_SSL_KEY = "authentication.ldap.useSSL";
- public static final String LDAP_PRIMARY_URL_KEY = "authentication.ldap.primaryUrl";
- public static final String LDAP_SECONDARY_URL_KEY = "authentication.ldap.secondaryUrl";
- public static final String LDAP_BASE_DN_KEY = "authentication.ldap.baseDn";
- public static final String LDAP_BIND_ANONYMOUSLY_KEY = "authentication.ldap.bindAnonymously";
- public static final String LDAP_MANAGER_DN_KEY = "authentication.ldap.managerDn";
- public static final String LDAP_MANAGER_PASSWORD_KEY = "authentication.ldap.managerPassword";
- public static final String LDAP_DN_ATTRIBUTE_KEY = "authentication.ldap.dnAttribute";
- public static final String LDAP_USERNAME_ATTRIBUTE_KEY = "authentication.ldap.usernameAttribute";
- public static final String LDAP_USER_BASE_KEY = "authentication.ldap.userBase";
- public static final String LDAP_USER_OBJECT_CLASS_KEY = "authentication.ldap.userObjectClass";
- public static final String LDAP_GROUP_BASE_KEY = "authentication.ldap.groupBase";
- public static final String LDAP_GROUP_OBJECT_CLASS_KEY = "authentication.ldap.groupObjectClass";
- public static final String LDAP_GROUP_NAMING_ATTR_KEY = "authentication.ldap.groupNamingAttr";
- public static final String LDAP_GROUP_MEMEBERSHIP_ATTR_KEY = "authentication.ldap.groupMembershipAttr";
- public static final String LDAP_ADMIN_GROUP_MAPPING_RULES_KEY = "authorization.ldap.adminGroupMappingRules";
- public static final String LDAP_GROUP_SEARCH_FILTER_KEY = "authorization.ldap.groupSearchFilter";
- public static final String LDAP_REFERRAL_KEY = "authentication.ldap.referral";
-
- // default
- public static final String LDAP_BIND_ANONYMOUSLY_DEFAULT = "true";
- public static final String LDAP_PRIMARY_URL_DEFAULT = "localhost:389";
- public static final String LDAP_BASE_DN_DEFAULT = "dc=example,dc=com";
- public static final String LDAP_USERNAME_ATTRIBUTE_DEFAULT = "uid";
- public static final String LDAP_DN_ATTRIBUTE_DEFAULT = "dn";
- public static final String LDAP_USER_BASE_DEFAULT = "ou=people,dc=example,dc=com";
- public static final String LDAP_USER_OBJECT_CLASS_DEFAULT = "person";
- public static final String LDAP_GROUP_BASE_DEFAULT = "ou=groups,dc=example,dc=com";
- public static final String LDAP_GROUP_OBJECT_CLASS_DEFAULT = "group";
- public static final String LDAP_GROUP_NAMING_ATTR_DEFAULT = "cn";
- public static final String LDAP_GROUP_MEMBERSHIP_ATTR_DEFAULT = "member";
- public static final String LDAP_ADMIN_GROUP_MAPPING_RULES_DEFAULT = "Logsearch Administrators";
- public static final String LDAP_GROUP_SEARCH_FILTER_DEFAULT = "";
- public static final String LDAP_REFERRAL_DEFAULT = "ignore";
-
-}
http://git-wip-us.apache.org/repos/asf/ambari/blob/555f241c/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LdapUtil.java
----------------------------------------------------------------------
diff --git a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LdapUtil.java b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LdapUtil.java
deleted file mode 100644
index 6248e74..0000000
--- a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LdapUtil.java
+++ /dev/null
@@ -1,115 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.ambari.logsearch.web.security;
-
-import java.io.IOException;
-import java.util.Properties;
-
-import org.apache.ambari.logsearch.common.PropertiesHelper;
-import org.apache.ambari.logsearch.common.XMLPropertiesHelper;
-import org.apache.log4j.Logger;
-import org.springframework.core.io.ClassPathResource;
-
-public class LdapUtil {
-
- private static Logger logger = Logger.getLogger(LdapUtil.class);
-
- /**
- * Gets parameters of LDAP server to connect to
- *
- * @return LdapServerProperties object representing connection parameters
- */
- public static LdapProperties getLdapServerProperties(Properties properties) {
- LdapProperties ldapServerProperties = new LdapProperties();
-
- ldapServerProperties.setPrimaryUrl(properties.getProperty(LdapPropertyName.LDAP_PRIMARY_URL_KEY,
- LdapPropertyName.LDAP_PRIMARY_URL_DEFAULT));
- ldapServerProperties.setSecondaryUrl(properties.getProperty(LdapPropertyName.LDAP_SECONDARY_URL_KEY));
- ldapServerProperties.setUseSsl("true".equalsIgnoreCase(properties
- .getProperty(LdapPropertyName.LDAP_USE_SSL_KEY)));
- ldapServerProperties.setAnonymousBind("true".equalsIgnoreCase(properties.getProperty(
- LdapPropertyName.LDAP_BIND_ANONYMOUSLY_KEY, LdapPropertyName.LDAP_BIND_ANONYMOUSLY_DEFAULT)));
- ldapServerProperties.setManagerDn(properties.getProperty(LdapPropertyName.LDAP_MANAGER_DN_KEY));
- String ldapPasswordProperty = properties.getProperty(LdapPropertyName.LDAP_MANAGER_PASSWORD_KEY);
- // TODO read password from password file
- ldapServerProperties.setManagerPassword(ldapPasswordProperty);
- ldapServerProperties.setBaseDN(properties.getProperty(LdapPropertyName.LDAP_BASE_DN_KEY,
- LdapPropertyName.LDAP_BASE_DN_DEFAULT));
- ldapServerProperties.setUsernameAttribute(properties.getProperty(LdapPropertyName.LDAP_USERNAME_ATTRIBUTE_KEY,
- LdapPropertyName.LDAP_USERNAME_ATTRIBUTE_DEFAULT));
-
- ldapServerProperties.setUserBase(properties.getProperty(LdapPropertyName.LDAP_USER_BASE_KEY,
- LdapPropertyName.LDAP_USER_BASE_DEFAULT));
- ldapServerProperties.setUserObjectClass(properties.getProperty(LdapPropertyName.LDAP_USER_OBJECT_CLASS_KEY,
- LdapPropertyName.LDAP_USER_OBJECT_CLASS_DEFAULT));
- ldapServerProperties.setDnAttribute(properties.getProperty(LdapPropertyName.LDAP_DN_ATTRIBUTE_KEY,
- LdapPropertyName.LDAP_DN_ATTRIBUTE_DEFAULT));
-
- ldapServerProperties.setGroupBase(properties.getProperty(LdapPropertyName.LDAP_GROUP_BASE_KEY,
- LdapPropertyName.LDAP_GROUP_BASE_DEFAULT));
- ldapServerProperties.setGroupObjectClass(properties.getProperty(LdapPropertyName.LDAP_GROUP_OBJECT_CLASS_KEY,
- LdapPropertyName.LDAP_GROUP_OBJECT_CLASS_DEFAULT));
- ldapServerProperties.setGroupMembershipAttr(properties.getProperty(
- LdapPropertyName.LDAP_GROUP_MEMEBERSHIP_ATTR_KEY, LdapPropertyName.LDAP_GROUP_MEMBERSHIP_ATTR_DEFAULT));
- ldapServerProperties.setGroupNamingAttr(properties.getProperty(LdapPropertyName.LDAP_GROUP_NAMING_ATTR_KEY,
- LdapPropertyName.LDAP_GROUP_NAMING_ATTR_DEFAULT));
- ldapServerProperties.setAdminGroupMappingRules(properties.getProperty(
- LdapPropertyName.LDAP_ADMIN_GROUP_MAPPING_RULES_KEY,
- LdapPropertyName.LDAP_ADMIN_GROUP_MAPPING_RULES_DEFAULT));
- ldapServerProperties.setGroupSearchFilter(properties.getProperty(LdapPropertyName.LDAP_GROUP_SEARCH_FILTER_KEY,
- LdapPropertyName.LDAP_GROUP_SEARCH_FILTER_DEFAULT));
- ldapServerProperties.setReferralMethod(properties.getProperty(LdapPropertyName.LDAP_REFERRAL_KEY,
- LdapPropertyName.LDAP_REFERRAL_DEFAULT));
-
- if (properties.containsKey(LdapPropertyName.LDAP_GROUP_BASE_KEY)
- || properties.containsKey(LdapPropertyName.LDAP_GROUP_OBJECT_CLASS_KEY)
- || properties.containsKey(LdapPropertyName.LDAP_GROUP_MEMEBERSHIP_ATTR_KEY)
- || properties.containsKey(LdapPropertyName.LDAP_GROUP_NAMING_ATTR_KEY)
- || properties.containsKey(LdapPropertyName.LDAP_ADMIN_GROUP_MAPPING_RULES_KEY)
- || properties.containsKey(LdapPropertyName.LDAP_GROUP_SEARCH_FILTER_KEY)) {
- ldapServerProperties.setGroupMappingEnabled(true);
- }
-
- return ldapServerProperties;
- }
-
- /**
- * @return
- */
- public static LdapProperties loadLdapProperties() {
- LdapProperties ldapServerProperties = null;
- String ldapConfigFileName = PropertiesHelper.getProperty("logsearch.login.ldap.config", "logsearch-admin-site.xml");
- Properties props = null;
- ClassPathResource resource = new ClassPathResource(ldapConfigFileName);
- if (resource != null) {
- try {
- props = new Properties();
- new XMLPropertiesHelper().loadFromXml(props, resource.getInputStream());
- ldapServerProperties = getLdapServerProperties(props);
- } catch (IOException e) {
- logger.error("Ldap configudation file loading failed : " + e.getMessage());
- }
- }
- if (ldapServerProperties == null) {
- logger.error("ldapServerProperties object is not created.");
- }
- return ldapServerProperties;
- }
-
-}
http://git-wip-us.apache.org/repos/asf/ambari/blob/555f241c/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchAbstractAuthenticationProvider.java
----------------------------------------------------------------------
diff --git a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchAbstractAuthenticationProvider.java b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchAbstractAuthenticationProvider.java
index 1c7bf3b..88f8c3b 100644
--- a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchAbstractAuthenticationProvider.java
+++ b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchAbstractAuthenticationProvider.java
@@ -29,7 +29,7 @@ import org.springframework.security.core.authority.SimpleGrantedAuthority;
abstract class LogsearchAbstractAuthenticationProvider implements AuthenticationProvider {
protected enum AuthMethod {
- LDAP, FILE, EXTERNAL_AUTH, SIMPLE
+ FILE, EXTERNAL_AUTH, SIMPLE
};
@Override
http://git-wip-us.apache.org/repos/asf/ambari/blob/555f241c/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchAuthenticationProvider.java
----------------------------------------------------------------------
diff --git a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchAuthenticationProvider.java b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchAuthenticationProvider.java
index 711e3ec..09c05fc 100644
--- a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchAuthenticationProvider.java
+++ b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchAuthenticationProvider.java
@@ -37,9 +37,6 @@ public class LogsearchAuthenticationProvider extends LogsearchAbstractAuthentica
private static final Logger auditLogger = Logger.getLogger("org.apache.ambari.logsearch.audit");
@Inject
- private LogsearchLdapAuthenticationProvider ldapAuthenticationProvider;
-
- @Inject
private LogsearchFileAuthenticationProvider fileAuthenticationProvider;
@Inject
@@ -106,7 +103,6 @@ public class LogsearchAuthenticationProvider extends LogsearchAbstractAuthentica
private Authentication doAuth(Authentication authentication, AuthMethod authMethod) {
switch (authMethod) {
- case LDAP: return ldapAuthenticationProvider.authenticate(authentication);
case FILE: return fileAuthenticationProvider.authenticate(authentication);
case EXTERNAL_AUTH: return externalServerAuthenticationProvider.authenticate(authentication);
case SIMPLE: return simpleAuthenticationProvider.authenticate(authentication);
http://git-wip-us.apache.org/repos/asf/ambari/blob/555f241c/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchLdapAuthenticationProvider.java
----------------------------------------------------------------------
diff --git a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchLdapAuthenticationProvider.java b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchLdapAuthenticationProvider.java
deleted file mode 100644
index ed4d7ef..0000000
--- a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchLdapAuthenticationProvider.java
+++ /dev/null
@@ -1,187 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.ambari.logsearch.web.security;
-
-import java.util.List;
-
-import org.apache.ambari.logsearch.conf.AuthPropsConfig;
-import org.apache.log4j.Logger;
-import org.springframework.ldap.CommunicationException;
-import org.springframework.ldap.core.support.LdapContextSource;
-import org.springframework.security.authentication.BadCredentialsException;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.core.userdetails.UsernameNotFoundException;
-import org.springframework.security.ldap.authentication.LdapAuthenticationProvider;
-import org.springframework.security.ldap.search.FilterBasedLdapUserSearch;
-
-import javax.annotation.PostConstruct;
-import javax.inject.Inject;
-import javax.inject.Named;
-
-@Named
-public class LogsearchLdapAuthenticationProvider extends
- LogsearchAbstractAuthenticationProvider {
-
- private static Logger logger = Logger
- .getLogger(LogsearchLdapAuthenticationProvider.class);
-
- private static LdapProperties ldapServerProperties = null;
- private static LdapAuthenticationProvider ldapAuthProvider = null;
- private String logStatement = "";
-
- @Inject
- private AuthPropsConfig authPropsConfig;
-
- public LogsearchLdapAuthenticationProvider() {
- }
-
- @PostConstruct
- public void postConstruct() {
- logger.debug("Creating object of ldap auth provider ");
- if (authPropsConfig.isAuthLdapEnabled()) {
- ldapAuthProvider = loadLdapAuthenticationProvider();
- } else {
- logger.info("Ldap auth is disabled");
- }
- }
-
- @Override
- public Authentication authenticate(Authentication authentication)
- throws AuthenticationException {
- if (!authPropsConfig.isAuthLdapEnabled()) {
- logger.debug("Ldap auth is disabled");
- return authentication;
- }
- try {
- LdapAuthenticationProvider authProvider = loadLdapAuthenticationProvider();
- if (authProvider != null) {
- return authProvider.authenticate(authentication);
- } else {
- return authentication;
- }
- } catch (AuthenticationException e) {
- logger.info("Got exception during LDAP authentication attempt", e);
- // Try to help in troubleshooting
- Throwable cause = e.getCause();
- if (cause != null) {
- if ((cause != e)
- && (cause instanceof org.springframework.ldap.AuthenticationException)) {
- logger.warn(
- "Looks like LDAP manager credentials (that are used for "
- + "connecting to LDAP server) are invalid.",
- e);
- }
- }
- } catch (CommunicationException e) {
- logger.error(e);
- } catch (Exception e) {
- logger.error(e, e.getCause());
- }
- if (authentication != null && !authentication.isAuthenticated()) {
- logger.warn("Ldap authentication failed. username="
- + authentication.getName() + ", details="
- + authentication.getDetails());
- throw new BadCredentialsException("Invalid credentials!!");
- }
- return authentication;
- }
-
- /**
- * Reloads LDAP Context Source and depending objects if properties were
- * changed
- *
- * @return corresponding LDAP authentication provider
- */
- private LdapAuthenticationProvider loadLdapAuthenticationProvider() {
- if (reloadLdapServerProperties()) {
- logger.info("LDAP Properties changed - rebuilding Context");
- LdapContextSource springSecurityContextSource = new LdapContextSource();
- List<String> ldapUrls = ldapServerProperties.getLdapUrls();
- logStatement = "ldapUrls=" + ldapUrls;
- if (ldapUrls == null || ldapUrls.size() == 0) {
- logger.info("LDAP URL is empty. So won't initialize LDAP provider");
- return null;
- }
-
- springSecurityContextSource.setUrls(ldapUrls
- .toArray(new String[ldapUrls.size()]));
- springSecurityContextSource.setBase(ldapServerProperties
- .getBaseDN());
- logStatement = logStatement + ", baseDN="
- + ldapServerProperties.getBaseDN();
-
- if (!ldapServerProperties.isAnonymousBind()) {
- springSecurityContextSource.setUserDn(ldapServerProperties
- .getManagerDn());
- logStatement = logStatement + ", managerDN="
- + ldapServerProperties.getManagerDn();
- springSecurityContextSource.setPassword(ldapServerProperties
- .getManagerPassword());
- }
-
- try {
- springSecurityContextSource.afterPropertiesSet();
- } catch (Exception e) {
- logger.error("LDAP Context Source not loaded ", e);
- throw new UsernameNotFoundException(
- "LDAP Context Source not loaded. ldapDetails="
- + logStatement, e);
- }
-
- String userSearchBase = ldapServerProperties.getUserSearchBase();
- logStatement = logStatement + ", userSearchBase=" + userSearchBase;
- String userSearchFilter = ldapServerProperties
- .getUserSearchFilter();
- logStatement = logStatement + ", userSearchFilter="
- + userSearchFilter;
-
- logger.info("LDAP properties=" + logStatement);
- FilterBasedLdapUserSearch userSearch = new FilterBasedLdapUserSearch(
- userSearchBase, userSearchFilter,
- springSecurityContextSource);
-
- LogsearchLdapBindAuthenticator bindAuthenticator = new LogsearchLdapBindAuthenticator(
- springSecurityContextSource, ldapServerProperties);
- bindAuthenticator.setUserSearch(userSearch);
-
- LdapAuthenticationProvider authenticationProvider = new LdapAuthenticationProvider(
- bindAuthenticator);
- ldapAuthProvider = authenticationProvider;
-
- }
- return ldapAuthProvider;
- }
-
- /**
- * Reloads LDAP Server properties from configuration
- *
- * @return true if properties were reloaded
- */
- private boolean reloadLdapServerProperties() {
- LdapProperties properties = LdapUtil.loadLdapProperties();
- if (!properties.equals(ldapServerProperties)) {
- logger.info("Reloading properties");
- ldapServerProperties = properties;
- return true;
- }
- return false;
- }
-
-}
http://git-wip-us.apache.org/repos/asf/ambari/blob/555f241c/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchLdapBindAuthenticator.java
----------------------------------------------------------------------
diff --git a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchLdapBindAuthenticator.java b/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchLdapBindAuthenticator.java
deleted file mode 100644
index 10f7507..0000000
--- a/ambari-logsearch/ambari-logsearch-server/src/main/java/org/apache/ambari/logsearch/web/security/LogsearchLdapBindAuthenticator.java
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.ambari.logsearch.web.security;
-
-import org.apache.log4j.Logger;
-import org.springframework.ldap.core.DirContextOperations;
-import org.springframework.ldap.core.support.BaseLdapPathContextSource;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.ldap.authentication.BindAuthenticator;
-
-public class LogsearchLdapBindAuthenticator extends BindAuthenticator {
- private static Logger logger = Logger
- .getLogger(LogsearchLdapBindAuthenticator.class);
-
- LdapProperties ldapServerProperties;
-
- public LogsearchLdapBindAuthenticator(
- BaseLdapPathContextSource contextSource,
- LdapProperties ldapServerProperties) {
- super(contextSource);
- this.ldapServerProperties = ldapServerProperties;
- logger.info("LDAP properties=" + ldapServerProperties);
- }
-
- @Override
- public DirContextOperations authenticate(Authentication authentication) {
- return super.authenticate(authentication);
- }
-
-}
http://git-wip-us.apache.org/repos/asf/ambari/blob/555f241c/ambari-logsearch/ambari-logsearch-server/src/main/resources/default.properties
----------------------------------------------------------------------
diff --git a/ambari-logsearch/ambari-logsearch-server/src/main/resources/default.properties b/ambari-logsearch/ambari-logsearch-server/src/main/resources/default.properties
index cd1f22a..4c74142 100644
--- a/ambari-logsearch/ambari-logsearch-server/src/main/resources/default.properties
+++ b/ambari-logsearch/ambari-logsearch-server/src/main/resources/default.properties
@@ -21,7 +21,6 @@ logsearch.auth.simple.enable=false
#login config
logsearch.login.credentials.file=user_pass.json
-logsearch.login.ldap.config=logsearch-admin-site.xml
logsearch.cert.folder.location=/etc/ambari-logsearch-portal/conf/keys
logsearch.cert.algorithm=sha256WithRSAEncryption