You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tinkerpop.apache.org by sp...@apache.org on 2017/02/27 12:02:16 UTC
[08/27] tinkerpop git commit: Made immutable variables final
Made immutable variables final
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/4544b01e
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/4544b01e
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/4544b01e
Branch: refs/heads/master
Commit: 4544b01e0414aa6b3cad5db50e9fe6a8b148f450
Parents: 202d658
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Sun Dec 11 12:16:12 2016 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 19:58:48 2017 +0100
----------------------------------------------------------------------
.../gremlin/server/auth/Krb5Authenticator.java | 18 +--
.../tinkerpop/gremlin/server/AuthKrb5Test.java | 112 +++++++++++++------
2 files changed, 85 insertions(+), 45 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/4544b01e/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
index bf09368..0f71b94 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
@@ -66,7 +66,7 @@ public class Krb5Authenticator implements Authenticator {
Krb5Authenticator.class.getName()));
}
try {
- File keytabFile = new File((String) config.get(KEYTAB_KEY));
+ final File keytabFile = new File((String) config.get(KEYTAB_KEY));
principalName = (String) config.get(PRINCIPAL_KEY);
subject = JaasKrbUtil.loginUsingKeytab(principalName, keytabFile);
} catch (Exception e) {
@@ -113,13 +113,13 @@ public class Krb5Authenticator implements Authenticator {
* http://www.roguelynn.com/words/explain-like-im-5-kerberos/
*/
private class Krb5SaslAuthenticator implements Authenticator.SaslNegotiator, CallbackHandler {
- private String mechanism = "GSSAPI";
- private String gremlinQOP = "auth";
+ private static final String mechanism = "GSSAPI";
+ private static final String gremlinQOP = "auth";
private SaslServer saslServer;
Krb5SaslAuthenticator() {
try {
- Map props = new HashMap<String, Object>();
+ final Map props = new HashMap<String, Object>();
// Set secure values for relevant sasl properties regarding GSSAPI, see:
// https://docs.oracle.com/javase/8/docs/technotes/guides/security/sasl/sasl-refguide.html#SERVER
// Rely on GSSAPI defaults for Sasl.MAX_BUFFER and "javax.security.sasl.sendmaxbuffer"
@@ -127,16 +127,16 @@ public class Krb5Authenticator implements Authenticator {
// props.put(Sasl.POLICY_NOANONYMOUS, System.getProperty(Sasl.POLICY_NOANONYMOUS, "true"));
// props.put(Sasl.POLICY_NOACTIVE, System.getProperty(Sasl.POLICY_NOACTIVE, "true"));
// props.put(Sasl.POLICY_NOPLAINTEXT, System.getProperty(Sasl.POLICY_NOPLAINTEXT, "true"));
- String[] principalParts = principalName.split("/|@");
+ final String[] principalParts = principalName.split("/|@");
if (principalParts.length < 3) throw new IllegalArgumentException("Use principal name of format 'service/fqdn@kdcrealm'");
saslServer = Sasl.createSaslServer(mechanism, principalParts[0], principalParts[1], props, Krb5SaslAuthenticator.this);
} catch(Exception e) {
logger.error("Creating sasl server failed: ", e);
}
logger.debug("SaslServer created with: " + saslServer.getMechanismName());
- // ToDo: check other Sasl.QoP values on a system with cyrus sasl
- if (System.getProperty(Sasl.QOP) != gremlinQOP)
- logger.warn("Gremlin server with libgsasl does not support Sasl.QOP security layer features, use SSL");
+ // ToDo: investigate use of Sasl.QoP values, also on a system with cyrus sasl
+ // if (!System.getProperty(Sasl.QOP).equals(gremlinQOP))
+ // logger.warn("Gremlin server with libgsasl does not support Sasl.QOP security layer features, use SSL");
}
/*
@@ -175,7 +175,7 @@ public class Krb5Authenticator implements Authenticator {
@Override
public byte[] evaluateResponse(final byte[] clientResponse) throws AuthenticationException {
logger.debug("evaluateResponse() length: " + clientResponse.length);
- byte[] response = null;
+ byte[] response;
try {
response = saslServer.evaluateResponse(clientResponse);
} catch (Exception e) {
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/4544b01e/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
index bc20b1b..bd639ef 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
@@ -20,9 +20,10 @@ package org.apache.tinkerpop.gremlin.server;
import org.apache.commons.lang.exception.ExceptionUtils;
import org.apache.kerby.kerberos.kerb.server.LoginTestBase;
-import org.apache.tinkerpop.gremlin.driver.MessageSerializer;
-import org.apache.tinkerpop.gremlin.driver.exception.ResponseException;
-import org.apache.tinkerpop.gremlin.driver.ser.GryoMessageSerializerV1d0;
+import org.apache.log4j.AppenderSkeleton;
+import org.apache.log4j.Level;
+import org.apache.log4j.Logger;
+import org.apache.log4j.spi.LoggingEvent;
import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
import org.ietf.jgss.GSSException;
import org.junit.After;
@@ -33,29 +34,29 @@ import org.apache.tinkerpop.gremlin.driver.Client;
import org.apache.tinkerpop.gremlin.driver.Cluster;
import java.io.File;
-import java.net.Inet4Address;
import java.util.*;
import org.junit.rules.TestName;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import javax.security.auth.Subject;
import javax.security.auth.login.LoginException;
-import static org.hamcrest.CoreMatchers.anyOf;
-import static org.hamcrest.MatcherAssert.assertThat;
import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
+
/**
* @author Marc de Lignie
*
* Todo: change back to integrate test later on
*/
public class AuthKrb5Test extends LoginTestBase {
- private static final Logger logger = LoggerFactory.getLogger(AuthKrb5Test.class);
+ // Cannot use mere slf4j because need to check log output
+ // Messier alternative would be to catch the console output:
+ // http://stackoverflow.com/questions/8708342/redirect-console-output-to-string-in-java
+ private final Logger rootLogger = Logger.getRootLogger();
+ private final Logger logger = Logger.getLogger(AuthKrb5Test.class);
private GremlinServerAuthKrb5Integrate server;
private static final String TESTCONSOLE = "GremlinConsole";
private static final String TESTCONSOLE_NOT_LOGGED_IN = "UserNotLoggedIn";
@@ -69,9 +70,8 @@ public class AuthKrb5Test extends LoginTestBase {
final File keytabFile;
GremlinServerAuthKrb5Integrate(String principal, File keytabFile) {
-
this.principal = principal;
- this.keytabFile =keytabFile;
+ this.keytabFile = keytabFile;
}
@Override
@@ -104,6 +104,7 @@ public class AuthKrb5Test extends LoginTestBase {
@Before
@Override
public void setUp() throws Exception {
+ logger.info("Starting " + name.getMethodName());
super.setUp();
loginServiceUsingKeytab();
loginClientUsingTicketCache();
@@ -200,38 +201,77 @@ public class AuthKrb5Test extends LoginTestBase {
}
}
-// @Test
-// public void shouldFailWithoutServerPrincipal() throws Exception {
-// String protocol = "no-service";
-// server = new GremlinServerAuthKrb5Integrate(protocol, serviceKeytabFile);
-// server.setUp();
-// final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
-// .protocol(protocol).addContactPoint(hostname).create();
-// final Client client = cluster.connect();
-// try {
-// client.submit("1+1").all().get();
-// fail("This should not succeed as the client config does not contain a JaasEntry");
-// } catch(Exception ex) {
-// final Throwable root = ExceptionUtils.getRootCause(ex);
-// assertEquals(GSSException.class, root.getClass());
-// } finally {
-// cluster.close();
-// server.tearDown();
-// }
-// }
+ @Test
+ public void shouldFailWithNonexistentServerPrincipal() throws Exception {
+ final TestAppender appender = new TestAppender();
+ rootLogger.addAppender(appender);
+ server = new GremlinServerAuthKrb5Integrate("no-service", serviceKeytabFile);
+ server.setUp();
+ server.tearDown();
-// @Test
-// public void shouldFailWithoutServerKeytab() throws Exception {
-// server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
-// server.setUp();
-// }
+ final List<LoggingEvent> log = appender.getLog();
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == Level.WARN &&
+ item.getMessage() == "Failed to login to kdc"));
+ }
+
+ class TestAppender extends AppenderSkeleton {
+ private final List<LoggingEvent> log = new ArrayList<LoggingEvent>();
+
+ @Override
+ public boolean requiresLayout() {
+ return false;
+ }
+
+ protected void append(final LoggingEvent loggingEvent) {
+ log.add(loggingEvent);
+ }
+
+ @Override
+ public void close() {
+ }
+
+ public List<LoggingEvent> getLog() {
+ return new ArrayList<LoggingEvent>(log);
+ }
+ }
+
+ @Test
+ public void shouldFailWithEmptyServerKeytab() throws Exception {
+ final TestAppender appender = new TestAppender();
+ rootLogger.addAppender(appender);
+ final File keytabFile = new File(".", "no-file");
+ server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), keytabFile);
+ server.setUp();
+ server.tearDown();
+
+ final List<LoggingEvent> log = appender.getLog();
+ for (LoggingEvent event: log) {
+ System.out.println("Log: " + event.getLevel() + " " + event.getMessage());
+ }
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == Level.WARN &&
+ item.getMessage() == "Failed to login to kdc"));
+ }
+ @Test
+ public void shouldFailWithWrongServerKeytab() throws Exception {
+ final TestAppender appender = new TestAppender();
+ rootLogger.addAppender(appender);
+ final String principal = "no-principal/somehost@TEST.COM";
+ getKdcServer().createPrincipal(principal);
+ server = new GremlinServerAuthKrb5Integrate(principal, serviceKeytabFile);
+ server.setUp();
+ server.tearDown();
+ }
+
+// ToDo: Unclear how to test this
// @Test
// public void shouldFailWithAuthIdUnequalAuthzId() throws Exception {
// server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
// server.setUp();
// }
+
+// ToDo: make this into a test for gremlin-driver
// @Test
// public void shouldAuthenticateWithSerializeResultToString() throws Exception {
// server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);