You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tinkerpop.apache.org by sp...@apache.org on 2017/02/27 12:02:09 UTC
[01/27] tinkerpop git commit: Removed unnecessary test dependency
Repository: tinkerpop
Updated Branches:
refs/heads/master 7160b660f -> c5b9680e7
Removed unnecessary test dependency
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/cb75d9bf
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/cb75d9bf
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/cb75d9bf
Branch: refs/heads/master
Commit: cb75d9bf347b9dea70f928558b03a163a09b6853
Parents: 972b558
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Mon Dec 19 20:55:19 2016 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 19:58:48 2017 +0100
----------------------------------------------------------------------
gremlin-server/pom.xml | 12 ------------
.../kerby/kerberos/kerb/server/LoginTestBase.java | 12 ++++++------
2 files changed, 6 insertions(+), 18 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/cb75d9bf/gremlin-server/pom.xml
----------------------------------------------------------------------
diff --git a/gremlin-server/pom.xml b/gremlin-server/pom.xml
index 40f5785..75f6c90 100644
--- a/gremlin-server/pom.xml
+++ b/gremlin-server/pom.xml
@@ -116,18 +116,6 @@ limitations under the License.
<version>1.0.0-RC2</version>
<scope>test</scope>
</dependency>
- <!--dependency>
- <groupId>org.apache.kerby</groupId>
- <artifactId>client-tool</artifactId>
- <version>1.0.0-RC2</version>
- <scope>test</scope>
- </dependency-->
- <dependency>
- <groupId>org.assertj</groupId>
- <artifactId>assertj-core</artifactId>
- <version>2.3.0</version>
- <scope>test</scope>
- </dependency>
</dependencies>
<build>
<directory>${basedir}/target</directory>
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/cb75d9bf/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
index cb83276..ed805fa 100644
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
@@ -21,8 +21,6 @@ package org.apache.kerby.kerberos.kerb.server;
import org.apache.kerby.kerberos.kerb.client.JaasKrbUtil;
import org.apache.kerby.kerberos.kerb.type.ticket.TgtTicket;
-import org.junit.After;
-import org.junit.Before;
import javax.security.auth.Subject;
import javax.security.auth.login.LoginException;
@@ -30,11 +28,13 @@ import java.io.File;
import java.security.Principal;
import java.util.Set;
-import static org.assertj.core.api.Assertions.assertThat;
-
+import static org.hamcrest.MatcherAssert.assertThat;
+import org.junit.After;
+import org.junit.Before;
/*
- * Except for this comment, this file is a literal copy from:
+ * Except for this comment and the removal of the org.assertj.core.api.Assertions.assertThat import statement,
+ * this file is a literal copy from:
* https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/
* kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
*
@@ -76,7 +76,7 @@ public class LoginTestBase extends KdcTestBase {
protected void checkSubject(Subject subject) {
Set<Principal> clientPrincipals = subject.getPrincipals();
- assertThat(clientPrincipals);
+ assertThat("The subject has minimally one principal", clientPrincipals.size() > 0);
}
@After
[14/27] tinkerpop git commit: Changelog due to TINKERPOP-1566
Posted by sp...@apache.org.
Changelog due to TINKERPOP-1566
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/c8492955
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/c8492955
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/c8492955
Branch: refs/heads/master
Commit: c84929557d3ce9df98df005cd25d339257196e9b
Parents: c364643
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Tue Jan 10 21:11:00 2017 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 20:08:00 2017 +0100
----------------------------------------------------------------------
CHANGELOG.asciidoc | 3 +++
1 file changed, 3 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/c8492955/CHANGELOG.asciidoc
----------------------------------------------------------------------
diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
index 764c44d..a87a81d 100644
--- a/CHANGELOG.asciidoc
+++ b/CHANGELOG.asciidoc
@@ -62,6 +62,9 @@ TinkerPop 3.3.0 (Release Date: NOT OFFICIALLY RELEASED YET)
* Added SysV and systemd init scripts.
* `GraphTraversal.valueMap(includeTokens,propertyKeys...)` now returns a `Map<Object,E>` since keys could be `T.id` or `T.label`.
* Added `skip(long)` and `skip((Scope,long)` which call the `range(low,high)` equivalents with -1 as the high.
+* Added Kerberos authentication to `gremlin-server` for websockets and nio transport.
+* Added audit logging of authenticated users and gremlin queries to `gremlin-server`.
+* Fixed `gremlin-drivers`'s support for string results regarding returned byte arrays from `Sasl` authentication.
TinkerPop 3.2.0 (Nine Inch Gremlins)
------------------------------------
[02/27] tinkerpop git commit: Added Kerberos tests for client
Posted by sp...@apache.org.
Added Kerberos tests for client
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/2ead423d
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/2ead423d
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/2ead423d
Branch: refs/heads/master
Commit: 2ead423d304bced46da56def42d7f837177a3015
Parents: d2639a7
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Sun Dec 4 16:14:05 2016 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 19:58:48 2017 +0100
----------------------------------------------------------------------
.../kerby/kerberos/kerb/server/KdcTestBase.java | 1 -
.../tinkerpop/gremlin/server/AuthKrb5Test.java | 151 +++++++++++++++----
.../src/test/resources/log4j-test.properties | 2 +-
.../gremlin/server/gremlin-console-jaas.conf | 8 +
4 files changed, 133 insertions(+), 29 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/2ead423d/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
index c8f8255..37622de 100644
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
@@ -70,7 +70,6 @@ public abstract class KdcTestBase {
File targetdir = new File(basedir, "target");
testDir = new File(targetdir, "tmp");
testDir.mkdirs();
- System.out.println("Testdir: " + basedir);
}
@AfterClass
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/2ead423d/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
index 6615318..bc20b1b 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
@@ -18,10 +18,13 @@
*/
package org.apache.tinkerpop.gremlin.server;
+import org.apache.commons.lang.exception.ExceptionUtils;
import org.apache.kerby.kerberos.kerb.server.LoginTestBase;
import org.apache.tinkerpop.gremlin.driver.MessageSerializer;
+import org.apache.tinkerpop.gremlin.driver.exception.ResponseException;
import org.apache.tinkerpop.gremlin.driver.ser.GryoMessageSerializerV1d0;
import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
+import org.ietf.jgss.GSSException;
import org.junit.After;
import org.junit.Before;
import org.junit.Rule;
@@ -38,6 +41,7 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.security.auth.Subject;
+import javax.security.auth.login.LoginException;
import static org.hamcrest.CoreMatchers.anyOf;
import static org.hamcrest.MatcherAssert.assertThat;
@@ -54,29 +58,31 @@ public class AuthKrb5Test extends LoginTestBase {
private static final Logger logger = LoggerFactory.getLogger(AuthKrb5Test.class);
private GremlinServerAuthKrb5Integrate server;
private static final String TESTCONSOLE = "GremlinConsole";
+ private static final String TESTCONSOLE_NOT_LOGGED_IN = "UserNotLoggedIn";
@Rule
public TestName name = new TestName();
private class GremlinServerAuthKrb5Integrate extends AbstractGremlinServerIntegrationTest {
- private final String nameOfTest;
+ final String principal;
+ final File keytabFile;
- GremlinServerAuthKrb5Integrate(String nameOfTest) {
- this.nameOfTest = nameOfTest;
+ GremlinServerAuthKrb5Integrate(String principal, File keytabFile) {
+
+ this.principal = principal;
+ this.keytabFile =keytabFile;
}
@Override
public Settings overrideSettings(final Settings settings) {
- logger.debug("Testname: " + nameOfTest);
settings.host = hostname;
logger.debug("Hostname: " + settings.host);
final Settings.AuthenticationSettings authSettings = new Settings.AuthenticationSettings();
authSettings.className = Krb5Authenticator.class.getName();
final Map authConfig = new HashMap<String,Object>();
- final String buildDir = System.getProperty("build.dir");
- authConfig.put("keytab", serviceKeytabFile.getAbsolutePath());
- authConfig.put("principal", getServerPrincipal());
+ authConfig.put("keytab", keytabFile.getAbsolutePath());
+ authConfig.put("principal", principal);
authSettings.config = authConfig;
settings.authentication = authSettings;
final Settings.SslSettings sslConfig = new Settings.SslSettings();
@@ -99,32 +105,53 @@ public class AuthKrb5Test extends LoginTestBase {
@Override
public void setUp() throws Exception {
super.setUp();
- // Create keytab for gremlinServer and ticketcache for gremlinConsole
- Subject gremlinServer = loginServiceUsingKeytab();
- Subject gremlinConsole = loginClientUsingTicketCache();
- logger.debug("Done creating keytab and ticketcache");
-
+ loginServiceUsingKeytab();
+ loginClientUsingTicketCache();
final String buildDir = System.getProperty("build.dir");
System.setProperty("java.security.auth.login.config", buildDir +
"/test-classes/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf");
- logger.debug("java.security.auth.login.config: " + System.getProperty("java.security.auth.login.config"));
- logger.debug("project.build.directory: " + System.getProperty("project.build.directory"));
- server = new GremlinServerAuthKrb5Integrate(name.getMethodName());
- server.setUp();
}
@After
public void tearDown() throws Exception {
- server.tearDown();
super.tearDown();
}
+ /**
+ * Defaults from TestClientFactory:
+ * private int port = 45940;
+ * private MessageSerializer serializer = Serializers.GRYO_V1D0.simpleInstance();
+ * private int nioPoolSize = Runtime.getRuntime().availableProcessors();
+ * private int workerPoolSize = Runtime.getRuntime().availableProcessors() * 2;
+ * private int minConnectionPoolSize = ConnectionPool.MIN_POOL_SIZE;
+ * private int maxConnectionPoolSize = ConnectionPool.MAX_POOL_SIZE;
+ * private int minSimultaneousUsagePerConnection = ConnectionPool.MIN_SIMULTANEOUS_USAGE_PER_CONNECTION;
+ * private int maxSimultaneousUsagePerConnection = ConnectionPool.MAX_SIMULTANEOUS_USAGE_PER_CONNECTION;
+ * private int maxInProcessPerConnection = Connection.MAX_IN_PROCESS;
+ * private int minInProcessPerConnection = Connection.MIN_IN_PROCESS;
+ * private int maxWaitForConnection = Connection.MAX_WAIT_FOR_CONNECTION;
+ * private int maxWaitForSessionClose = Connection.MAX_WAIT_FOR_SESSION_CLOSE;
+ * private int maxContentLength = Connection.MAX_CONTENT_LENGTH;
+ * private int reconnectInitialDelay = Connection.RECONNECT_INITIAL_DELAY;
+ * private int reconnectInterval = Connection.RECONNECT_INTERVAL;
+ * private int resultIterationBatchSize = Connection.RESULT_ITERATION_BATCH_SIZE;
+ * private long keepAliveInterval = Connection.KEEP_ALIVE_INTERVAL;
+ * private String channelizer = Channelizer.WebSocketChannelizer.class.getName();
+ * private boolean enableSsl = false;
+ * private String trustCertChainFile = null;
+ * private String keyCertChainFile = null;
+ * private String keyFile = null;
+ * private String keyPassword = null;
+ * private SslContext sslContext = null;
+ * private LoadBalancingStrategy loadBalancingStrategy = new LoadBalancingStrategy.RoundRobin();
+ * private AuthProperties authProps = new AuthProperties();
+ */
@Test
- public void shouldAuthenticate() throws Exception {
- File f = new File(".");
- logger.debug("Working dir: " + f.getCanonicalPath());
+ public void shouldAuthenticateWithDefaults() throws Exception {
+ server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
+ server.setUp();
final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
- .protocol("test-service").addContactPoint(hostname).enableSsl(false).create();
+ .protocol(getServerPrincipalName()).addContactPoint(hostname).create();
final Client client = cluster.connect();
try {
assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
@@ -132,20 +159,91 @@ public class AuthKrb5Test extends LoginTestBase {
assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
} finally {
cluster.close();
+ server.tearDown();
}
}
+ @Test
+ public void shouldFailWithoutClientJaasEntry() throws Exception {
+ server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
+ server.setUp();
+ final Cluster cluster = TestClientFactory.build().protocol(getServerPrincipalName()).addContactPoint(hostname).create();
+ final Client client = cluster.connect();
+ try {
+ client.submit("1+1").all().get();
+ fail("This should not succeed as the client config does not contain a JaasEntry");
+ } catch(Exception ex) {
+ final Throwable root = ExceptionUtils.getRootCause(ex);
+ assertEquals(GSSException.class, root.getClass());
+ } finally {
+ cluster.close();
+ server.tearDown();
+ }
+ }
@Test
- public void shouldAuthenticateWithSerializeResultToString() throws Exception {
-// File f = new File(".");
-// logger.debug("Working dir: " + f.getCanonicalPath());
+ public void shouldFailWithoutClientTicketCache() throws Exception {
+ server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
+ server.setUp();
+ final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE_NOT_LOGGED_IN)
+ .protocol(getServerPrincipalName()).addContactPoint(hostname).create();
+ final Client client = cluster.connect();
+ try {
+ client.submit("1+1").all().get();
+ fail("This should not succeed as the client config does not contain a valid ticket cache");
+ } catch(Exception ex) {
+ final Throwable root = ExceptionUtils.getRootCause(ex);
+ assertEquals(LoginException.class, root.getClass());
+ } finally {
+ cluster.close();
+ server.tearDown();
+ }
+ }
+
+// @Test
+// public void shouldFailWithoutServerPrincipal() throws Exception {
+// String protocol = "no-service";
+// server = new GremlinServerAuthKrb5Integrate(protocol, serviceKeytabFile);
+// server.setUp();
+// final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
+// .protocol(protocol).addContactPoint(hostname).create();
+// final Client client = cluster.connect();
+// try {
+// client.submit("1+1").all().get();
+// fail("This should not succeed as the client config does not contain a JaasEntry");
+// } catch(Exception ex) {
+// final Throwable root = ExceptionUtils.getRootCause(ex);
+// assertEquals(GSSException.class, root.getClass());
+// } finally {
+// cluster.close();
+// server.tearDown();
+// }
+// }
+
+// @Test
+// public void shouldFailWithoutServerKeytab() throws Exception {
+// server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
+// server.setUp();
+// }
+
+// @Test
+// public void shouldFailWithAuthIdUnequalAuthzId() throws Exception {
+// server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
+// server.setUp();
+// }
+
+// @Test
+// public void shouldAuthenticateWithSerializeResultToString() throws Exception {
+// server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
+// server.setUp();
+// loginServiceUsingKeytab();
+// loginClientUsingTicketCache();
// MessageSerializer serializer = new GryoMessageSerializerV1d0();
// Map config = new HashMap<String, Object>();
// config.put("serializeResultToString", true);
// serializer.configure(config, null);
// final Cluster cluster = Cluster.build().jaasEntry(TESTCONSOLE)
-// .protocol("test-service").addContactPoint(serverHostname).port(45940).enableSsl(false).serializer(serializer).create();
+// .protocol(getServerPrincipalName()).addContactPoint(serverHostname).port(45940).enableSsl(false).serializer(serializer).create();
// final Client client = cluster.connect();
// try {
// assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
@@ -154,8 +252,7 @@ public class AuthKrb5Test extends LoginTestBase {
// } finally {
// cluster.close();
// }
- }
+// }
- // ToDo: test client login fails as wanted without a valid ticket
// ToDo: test with System.setProperty("javax.security.sasl.qop", "auth-conf");
}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/2ead423d/gremlin-server/src/test/resources/log4j-test.properties
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/resources/log4j-test.properties b/gremlin-server/src/test/resources/log4j-test.properties
index f3e437b..5dec106 100644
--- a/gremlin-server/src/test/resources/log4j-test.properties
+++ b/gremlin-server/src/test/resources/log4j-test.properties
@@ -15,7 +15,7 @@
# specific language governing permissions and limitations
# under the License.
-log4j.rootLogger=WARN, stdout
+log4j.rootLogger=INFO, stdout
log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=[%p] %C - %m%n
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/2ead423d/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf
index 1890af8..2e725c2 100644
--- a/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf
+++ b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf
@@ -23,3 +23,11 @@ GremlinConsole {
useTicketCache=true
ticketCache="target/tmp/test-tkt.cc";
};
+
+
+UserNotLoggedIn {
+ com.sun.security.auth.module.Krb5LoginModule required
+ doNotPrompt=true
+ principal="otheruser@TEST.COM"
+ useTicketCache=true;
+};
[16/27] tinkerpop git commit: Added audit log integrate test for two
clients
Posted by sp...@apache.org.
Added audit log integrate test for two clients
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/0ca1b16c
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/0ca1b16c
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/0ca1b16c
Branch: refs/heads/master
Commit: 0ca1b16cb3a22df5a9e2abf36f7db35d9c316a54
Parents: a5f3e1f
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Sun Jan 15 14:25:16 2017 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 20:08:00 2017 +0100
----------------------------------------------------------------------
CHANGELOG.asciidoc | 2 +-
.../GremlinServerAuditLogIntegrateTest.java | 62 ++++++++++++++++++--
.../tinkerpop/gremlin/server/KdcFixture.java | 17 +++++-
.../gremlin/server/gremlin-console-jaas.conf | 8 +++
4 files changed, 81 insertions(+), 8 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/0ca1b16c/CHANGELOG.asciidoc
----------------------------------------------------------------------
diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
index a87a81d..96e5a04 100644
--- a/CHANGELOG.asciidoc
+++ b/CHANGELOG.asciidoc
@@ -64,7 +64,7 @@ TinkerPop 3.3.0 (Release Date: NOT OFFICIALLY RELEASED YET)
* Added `skip(long)` and `skip((Scope,long)` which call the `range(low,high)` equivalents with -1 as the high.
* Added Kerberos authentication to `gremlin-server` for websockets and nio transport.
* Added audit logging of authenticated users and gremlin queries to `gremlin-server`.
-* Fixed `gremlin-drivers`'s support for string results regarding returned byte arrays from `Sasl` authentication.
+* Fixed `gremlin-driver`'s support for string results regarding returned byte arrays from `Sasl` authentication.
TinkerPop 3.2.0 (Nine Inch Gremlins)
------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/0ca1b16c/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
index 32c8451..dce159b 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
@@ -41,10 +41,7 @@ import static org.apache.tinkerpop.gremlin.server.GremlinServer.AUDIT_LOGGER_NAM
import org.apache.tinkerpop.gremlin.util.Log4jRecordingAppender;
import org.slf4j.LoggerFactory;
-import java.util.Base64;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
+import java.util.*;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import java.util.stream.Stream;
@@ -72,6 +69,7 @@ public class GremlinServerAuditLogIntegrateTest extends AbstractGremlinServerInt
private static final boolean AUDIT_LOG_ENABLED = true;
private static final boolean AUDIT_LOG_DISABLED = false;
+ private static final String TESTCONSOLE2 = "GremlinConsole2";
private KdcFixture kdcServer;
@@ -131,6 +129,7 @@ public class GremlinServerAuditLogIntegrateTest extends AbstractGremlinServerInt
case "shouldNotAuditLogWhenDisabled":
authSettings.enableAuditLog = AUDIT_LOG_DISABLED;
case "shouldAuditLogWithKrb5Authenticator":
+ case "shouldAuditLogTwoClientsWithKrb5Authenticator":
authConfig.put("keytab", kdcServer.serviceKeytabFile.getAbsolutePath());
authConfig.put("principal", kdcServer.serverPrincipal);
break;
@@ -318,5 +317,58 @@ public class GremlinServerAuditLogIntegrateTest extends AbstractGremlinServerInt
item.getMessage().toString().equals(String.format("User with address %s requested: 1-1", address))));
}
- //ToDo: test with two clients
+ @Test
+ public void shouldAuditLogTwoClientsWithKrb5Authenticator() throws Exception {
+ final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+ final Cluster cluster2 = TestClientFactory.build().jaasEntry(TESTCONSOLE2)
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
+ final Client client2 = cluster2.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(22, client2.submit("11+11").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(23, client2.submit("11+12").all().get().get(0).getInt());
+ assertEquals(24, client2.submit("11+13").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ cluster2.close();
+ }
+ final List<LoggingEvent> log = recordingAppender.getEvents();
+ final Stream<LoggingEvent> auditEvents = log.stream().filter(event -> event.getLoggerName().equals(AUDIT_LOGGER_NAME));
+ final Iterator<LoggingEvent> authEvents = auditEvents
+ .filter(event -> event.getMessage().toString().contains("Krb5Authenticator")).iterator();
+
+ // First client
+ final LoggingEvent authEvent = authEvents.next();
+ final String authMsg = authEvent.getMessage().toString();
+ final Matcher m = Pattern.compile(".*?([\\d.:]{13,21}).*?").matcher(authMsg);
+ m.find();
+ final String address = m.group(1);
+ assertTrue(authEvent.getLevel() == INFO && authMsg.equals(
+ String.format("User %s with address %s authenticated by Krb5Authenticator", kdcServer.clientPrincipalName, address)));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+1", address))));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+2", address))));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+3", address))));
+
+ // Second client
+ final LoggingEvent authEvent2 = authEvents.next();
+ final String authMsg2 = authEvent2.getMessage().toString();
+ final Matcher m2 = Pattern.compile(".*?([\\d.:]{13,21}).*?").matcher(authMsg2);
+ m2.find();
+ final String address2 = m2.group(1);
+ assertTrue(authEvent2.getLevel() == INFO && authMsg2.equals(
+ String.format("User %s with address %s authenticated by Krb5Authenticator", kdcServer.clientPrincipalName2, address2)));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 11+11", address2))));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 11+12", address2))));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 11+13", address2))));
+ }
}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/0ca1b16c/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
index db19c96..fce29d8 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
@@ -34,10 +34,10 @@ import java.net.Inet4Address;
/**
* @author Marc de Lignie
*
- * This class is derived from the following classes from https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/:
+ * This class is derived from the following classes from https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2:
* - org.apache.kerby.kerberos.kerb.server.TestKdcServer
* - org.apache.kerby.kerberos.kerb.server.KdcTestBase
- * - org.apache.kerby.kerberos.kerb.server.LoginTestBase.java
+ * - org.apache.kerby.kerberos.kerb.server.LoginTestBase
*
* See also: gremlin-server/src/main/static/NOTICE
*/
@@ -46,15 +46,20 @@ public class KdcFixture {
private static final org.slf4j.Logger logger = LoggerFactory.getLogger(KdcFixture.class);
final String clientPassword = "123456";
+ final String clientPassword2 = "1234562";
final String clientPrincipalName = "drankye";
+ final String clientPrincipalName2 = "drankye2";
final String serverPrincipalName = "test-service";
final String ticketCacheFileName = "test-tkt.cc";
+ final String ticketCacheFileName2 = "test-tkt2.cc";
final String serviceKeytabFileName = "test-service.keytab";
final String clientPrincipal;
+ final String clientPrincipal2;
final String serverPrincipal;
final File testDir;
final File ticketCacheFile;
+ final File ticketCacheFile2;
final File serviceKeytabFile;
final String hostname;
@@ -66,8 +71,10 @@ public class KdcFixture {
hostname = findHostname();
serverPrincipal = serverPrincipalName + "/" + hostname + "@" + KdcFixture.TestKdcServer.KDC_REALM;
clientPrincipal = clientPrincipalName + "@" + KdcFixture.TestKdcServer.KDC_REALM;
+ clientPrincipal2 = clientPrincipalName2 + "@" + KdcFixture.TestKdcServer.KDC_REALM;
testDir = createTestDir();
ticketCacheFile = new File(testDir, ticketCacheFileName);
+ ticketCacheFile2 = new File(testDir, ticketCacheFileName2);
serviceKeytabFile = new File(testDir, serviceKeytabFileName);
}
@@ -130,12 +137,17 @@ public class KdcFixture {
kdcServer.createPrincipal(clientPrincipal, clientPassword);
TgtTicket tgt = kdcServer.getKrbClient().requestTgt(clientPrincipal, clientPassword);
kdcServer.getKrbClient().storeTicket(tgt, ticketCacheFile);
+
+ kdcServer.createPrincipal(clientPrincipal2, clientPassword2);
+ TgtTicket tgt2 = kdcServer.getKrbClient().requestTgt(clientPrincipal2, clientPassword2);
+ kdcServer.getKrbClient().storeTicket(tgt2, ticketCacheFile2);
}
public void close() throws Exception {
deletePrincipals();
kdcServer.stop();
ticketCacheFile.delete();
+ ticketCacheFile2.delete();
serviceKeytabFile.delete();
testDir.delete();
System.clearProperty("java.security.auth.login.config");
@@ -145,6 +157,7 @@ public class KdcFixture {
kdcServer.getKadmin().deleteBuiltinPrincipals();
kdcServer.deletePrincipals(serverPrincipal);
kdcServer.deletePrincipal(clientPrincipal);
+ kdcServer.deletePrincipal(clientPrincipal2);
}
public void createPrincipal(final String principal) throws KrbException {
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/0ca1b16c/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf
index 2e725c2..b467ab7 100644
--- a/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf
+++ b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf
@@ -31,3 +31,11 @@ UserNotLoggedIn {
principal="otheruser@TEST.COM"
useTicketCache=true;
};
+
+
+GremlinConsole2 {
+ com.sun.security.auth.module.Krb5LoginModule required
+ doNotPrompt=true
+ useTicketCache=true
+ ticketCache="target/tmp/test-tkt2.cc";
+};
[13/27] tinkerpop git commit: Some cleanup
Posted by sp...@apache.org.
Some cleanup
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/6a9c6674
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/6a9c6674
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/6a9c6674
Branch: refs/heads/master
Commit: 6a9c6674ca80fac28a4c74e00e00d91aefc829dd
Parents: c849295
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Fri Jan 13 20:42:51 2017 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 20:08:00 2017 +0100
----------------------------------------------------------------------
.../gremlin/server/auth/JaasKrbUtil.java | 9 +-
.../gremlin/server/auth/Krb5Authenticator.java | 22 +-
.../tinkerpop/gremlin/server/AuditLogTest.java | 322 -------------------
.../tinkerpop/gremlin/server/AuthKrb5Test.java | 263 ---------------
.../GremlinServerAuditLogIntegrateTest.java | 322 +++++++++++++++++++
.../GremlinServerAuthKrb5IntegrateTest.java | 235 ++++++++++++++
.../tinkerpop/gremlin/server/KdcFixture.java | 2 +-
7 files changed, 569 insertions(+), 606 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/6a9c6674/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
index ad87d58..6a2e8d3 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
@@ -53,8 +53,7 @@ public final class JaasKrbUtil {
private JaasKrbUtil() { }
- public static Subject loginUsingPassword(
- String principal, String password) throws LoginException {
+ public static Subject loginUsingPassword(String principal, String password) throws LoginException {
Set<Principal> principals = new HashSet<Principal>();
principals.add(new KerberosPrincipal(principal));
@@ -69,8 +68,7 @@ public final class JaasKrbUtil {
return loginContext.getSubject();
}
- public static Subject loginUsingTicketCache(
- String principal, File cacheFile) throws LoginException {
+ public static Subject loginUsingTicketCache(String principal, File cacheFile) throws LoginException {
Set<Principal> principals = new HashSet<Principal>();
principals.add(new KerberosPrincipal(principal));
@@ -84,8 +82,7 @@ public final class JaasKrbUtil {
return loginContext.getSubject();
}
- public static Subject loginUsingKeytab(
- String principal, File keytabFile) throws LoginException {
+ public static Subject loginUsingKeytab(String principal, File keytabFile) throws LoginException {
Set<Principal> principals = new HashSet<Principal>();
principals.add(new KerberosPrincipal(principal));
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/6a9c6674/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
index 57a4259..275dba6 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
@@ -36,7 +36,7 @@ import java.util.Map;
/**
- * A Kerberos implementation of an {@link Authenticator}
+ * A Kerberos (GSSAPI) implementation of an {@link Authenticator}
*
* @author Marc de Lignie
*/
@@ -102,10 +102,10 @@ public class Krb5Authenticator implements Authenticator {
}
/*
- * Invoked by:
- * https://github.com/apache/tinkerpop/blob/3.1.1-incubating/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/SaslAuthenticationHandler.java
+ * Krb5SaslAuthenticator is invoked by:
+ * org.apache.tinkerpop.gremlin.server.handler.SaslAuthenticationHandler
* Negotiates with evaluateChallenge() of the generic sasl handler in gremlin console:
- * https://github.com/apache/tinkerpop/blob/3.1.1-incubating/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Handler.java
+ * org.apache.tinkerpop.gremlin.driver.Handler.java
* See also:
* https://docs.oracle.com/javase/8/docs/technotes/guides/security/sasl/sasl-refguide.html
* https://docs.oracle.com/javase/8/docs/api/org/ietf/jgss/GSSContext.html
@@ -120,13 +120,11 @@ public class Krb5Authenticator implements Authenticator {
try {
// For sasl properties regarding GSSAPI, see:
// https://docs.oracle.com/javase/8/docs/technotes/guides/security/sasl/sasl-refguide.html#SERVER
- // Rely on GSSAPI defaults for Sasl.MAX_BUFFER and "javax.security.sasl.sendmaxbuffer"
- // Sasl policy properties are not relevant here, because the sasl mechanisme is not negotiated
- // Kerberos implementations do not handle Sasl.QOP values reliably; rather use SSL for enhanced privacy,
- // see https://issues.apache.org/jira/browse/HIVE-8377
+ // Rely on GSSAPI defaults for Sasl.MAX_BUFFER and Sasl.QOP. Note, however, that gremlin-driver has
+ // Sasl.SERVER_AUTH fixed to true (mutual authentication) and one can configure SSL for enhanced confidentiality,
+ // Sasl policy properties for negotiating the authenticatin mechanism are not relevant here, because
+ // GSSAPI is the only available mechanism for this authenticator
final Map props = new HashMap<String, Object>();
- if (!System.getProperty(Sasl.QOP, "").equals(""))
- logger.warn("Gremlin server uses default Sasl.QOP values, use SSL for enhanced privacy");
final String[] principalParts = principalName.split("/|@");
if (principalParts.length < 3) throw new IllegalArgumentException("Use principal name of format 'service/fqdn@kdcrealm'");
saslServer = Sasl.createSaslServer(mechanism, principalParts[0], principalParts[1], props, Krb5SaslAuthenticator.this);
@@ -139,9 +137,6 @@ public class Krb5Authenticator implements Authenticator {
/*
* This method is based on the handle() method from:
* https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/kerby-kerb/integration-test/src/main/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppServer.java
- * Other example sources:
- * https://gist.github.com/honza889/1347ddee89311dd636d5 (APL)
- * https://github.com/wildfly-security/jboss-sasl/blob/master/src/test/java/org/jboss/sasl/test/ServerCallbackHandler.java (GPL)
*/
@Override
public void handle(Callback[] callbacks) throws UnsupportedCallbackException {
@@ -188,7 +183,6 @@ public class Krb5Authenticator implements Authenticator {
}
@Override
- // todo: apply for audit logging, see related todo in gremlin-server/.../SaslAuthenticationHandler.java
public AuthenticatedUser getAuthenticatedUser() throws AuthenticationException {
logger.debug("getAuthenticatedUser called: " + saslServer.getAuthorizationID());
return new AuthenticatedUser(saslServer.getAuthorizationID());
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/6a9c6674/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuditLogTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuditLogTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuditLogTest.java
deleted file mode 100644
index b2f0fe8..0000000
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuditLogTest.java
+++ /dev/null
@@ -1,322 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.tinkerpop.gremlin.server;
-
-import org.apache.http.client.methods.CloseableHttpResponse;
-import org.apache.http.client.methods.HttpGet;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClients;
-import org.apache.http.util.EntityUtils;
-import org.apache.log4j.Logger;
-import org.apache.log4j.spi.LoggingEvent;
-import static org.apache.log4j.Level.INFO;
-import org.apache.tinkerpop.gremlin.driver.Client;
-import org.apache.tinkerpop.gremlin.driver.Cluster;
-import org.apache.tinkerpop.gremlin.driver.Channelizer;
-import org.apache.tinkerpop.gremlin.server.channel.HttpChannelizer;
-import org.apache.tinkerpop.gremlin.server.channel.NioChannelizer;
-import org.apache.tinkerpop.shaded.jackson.databind.JsonNode;
-import org.apache.tinkerpop.shaded.jackson.databind.ObjectMapper;
-import org.apache.tinkerpop.gremlin.server.auth.AllowAllAuthenticator;
-import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
-import org.apache.tinkerpop.gremlin.server.auth.SimpleAuthenticator;
-import static org.apache.tinkerpop.gremlin.server.AuthKrb5Test.TESTCONSOLE;
-import static org.apache.tinkerpop.gremlin.server.GremlinServer.AUDIT_LOGGER_NAME;
-import org.apache.tinkerpop.gremlin.util.Log4jRecordingAppender;
-import org.slf4j.LoggerFactory;
-
-import java.util.Base64;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-import java.util.stream.Stream;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-
-
-/**
- * @author Marc de Lignie
- *
- * Note: like other descendents of AbstractGremlinServerIntegrationTest this testsuite assumes that tests are
- * run sequentially and thus the server variable can be reused.
- */
-public class AuditLogTest extends AbstractGremlinServerIntegrationTest {
- private static final org.slf4j.Logger logger = LoggerFactory.getLogger(AuditLogTest.class);
- private Log4jRecordingAppender recordingAppender = null;
-
- private final ObjectMapper mapper = new ObjectMapper();
- private final Base64.Encoder encoder = Base64.getUrlEncoder();
-
- private static final boolean AUDIT_LOG_ENABLED = true;
- private static final boolean AUDIT_LOG_DISABLED = false;
-
- private KdcFixture kdcServer;
-
- @Before
- @Override
- public void setUp() throws Exception {
- try {
- final String buildDir = System.getProperty("build.dir");
- kdcServer = new KdcFixture(buildDir +
- "/test-classes/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf");
- kdcServer.setUp();
- } catch(Exception e) {
- logger.warn(e.getMessage());
- }
- super.setUp();
- }
-
- @Before
- public void setupForEachTest() {
- recordingAppender = new Log4jRecordingAppender();
- final Logger rootLogger = Logger.getRootLogger();
- rootLogger.addAppender(recordingAppender);
- }
-
- @After
- public void teardownForEachTest() throws Exception {
- final Logger rootLogger = Logger.getRootLogger();
- rootLogger.removeAppender(recordingAppender);
- kdcServer.close();
- }
-
- /**
- * Configure specific Gremlin Server settings for specific tests.
- */
- @Override
- public Settings overrideSettings(final Settings settings) {
- settings.host = kdcServer.hostname;
- final Settings.SslSettings sslConfig = new Settings.SslSettings();
- sslConfig.enabled = false;
- settings.ssl = sslConfig;
- final Settings.AuthenticationSettings authSettings = new Settings.AuthenticationSettings();
- settings.authentication = authSettings;
- authSettings.enableAuditLog = AUDIT_LOG_ENABLED;
- authSettings.className = Krb5Authenticator.class.getName();
- final Map<String,Object> authConfig = new HashMap<>();
- authSettings.config = authConfig;
-
- final String nameOfTest = name.getMethodName();
- switch (nameOfTest) {
- case "shouldAuditLogWithAllowAllAuthenticator":
- authSettings.className = AllowAllAuthenticator.class.getName();
- break;
- case "shouldAuditLogWithSimpleAuthenticator":
- authSettings.className = SimpleAuthenticator.class.getName();
- authConfig.put(SimpleAuthenticator.CONFIG_CREDENTIALS_DB, "conf/tinkergraph-credentials.properties");
- break;
- case "shouldNotAuditLogWhenDisabled":
- authSettings.enableAuditLog = AUDIT_LOG_DISABLED;
- case "shouldAuditLogWithKrb5Authenticator":
- authConfig.put("keytab", kdcServer.serviceKeytabFile.getAbsolutePath());
- authConfig.put("principal", kdcServer.serverPrincipal);
- break;
- case "shouldAuditLogWithNioTransport":
- settings.channelizer = NioChannelizer.class.getName();
- authConfig.put("keytab", kdcServer.serviceKeytabFile.getAbsolutePath());
- authConfig.put("principal", kdcServer.serverPrincipal);
- break;
- case "shouldAuditLogWithHttpTransport":
- settings.host = "localhost";
- settings.channelizer = HttpChannelizer.class.getName();
- authSettings.className = SimpleAuthenticator.class.getName();
- authConfig.put(SimpleAuthenticator.CONFIG_CREDENTIALS_DB, "conf/tinkergraph-credentials.properties");
- break;
- }
- return settings;
- }
-
- @Test
- public void shouldAuditLogWithAllowAllAuthenticator() throws Exception {
-
- final Cluster cluster = TestClientFactory.build().addContactPoint(kdcServer.hostname).create();
- final Client client = cluster.connect();
-
- try {
- assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
- assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
- assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
- } finally {
- cluster.close();
- }
-
- // WebSocketChannelizer does not add SaslAuthenticationHandler, so no authenticated user log line available
- assertTrue(recordingAppender.logMatchesAny(AUDIT_LOGGER_NAME, INFO, "User with address .*? requested: 1\\+1"));
- assertTrue(recordingAppender.logMatchesAny(AUDIT_LOGGER_NAME, INFO, "User with address .*? requested: 1\\+2"));
- assertTrue(recordingAppender.logMatchesAny(AUDIT_LOGGER_NAME, INFO, "User with address .*? requested: 1\\+3"));
- }
-
- @Test
- public void shouldAuditLogWithSimpleAuthenticator() throws Exception {
- final String username = "stephen";
- final String password = "password";
-
- final Cluster cluster = TestClientFactory.build().credentials(username, password)
- .addContactPoint(kdcServer.hostname).create();
- final Client client = cluster.connect();
-
- try {
- assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
- assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
- assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
- } finally {
- cluster.close();
- }
-
- final String simpleAuthenticatorName = SimpleAuthenticator.class.getSimpleName();
- final String authMsg = recordingAppender.getMessages().stream()
- .filter( msg -> msg.toString().contains("by " + simpleAuthenticatorName) ).iterator().next();
- final Matcher m = Pattern.compile(".*?([\\d.:]+).*?").matcher(authMsg);
- m.find();
- final String address = m.group(1);
-
- assertTrue(recordingAppender.logContainsAny(AUDIT_LOGGER_NAME, INFO,
- String.format("User %s with address %s authenticated by %s", username, address, simpleAuthenticatorName)));
- assertTrue(recordingAppender.logContainsAny(AUDIT_LOGGER_NAME, INFO,
- String.format("User with address %s requested: 1+1", address)));
- assertTrue(recordingAppender.logContainsAny(AUDIT_LOGGER_NAME, INFO,
- String.format("User with address %s requested: 1+2", address)));
- assertTrue(recordingAppender.logContainsAny(AUDIT_LOGGER_NAME, INFO,
- String.format("User with address %s requested: 1+3", address)));
- }
-
- @Test
- public void shouldAuditLogWithKrb5Authenticator() throws Exception {
- final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
- .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
- final Client client = cluster.connect();
- try {
- assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
- assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
- assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
- } finally {
- cluster.close();
- }
-
- final List<LoggingEvent> log = recordingAppender.getEvents();
- final Stream<LoggingEvent> auditEvents = log.stream().filter(event -> event.getLoggerName().equals(AUDIT_LOGGER_NAME));
- final LoggingEvent authEvent = auditEvents
- .filter(event -> event.getMessage().toString().contains("Krb5Authenticator")).iterator().next();
- final String authMsg = authEvent.getMessage().toString();
- final Matcher m = Pattern.compile(".*?([\\d.:]+).*?").matcher(authMsg);
- m.find();
- final String address = m.group(1);
- assertTrue(authEvent.getLevel() == INFO && authMsg.equals(
- String.format("User %s with address %s authenticated by Krb5Authenticator", kdcServer.clientPrincipalName, address)));
- assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
- item.getMessage().toString().equals(String.format("User with address %s requested: 1+1", address))));
- assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
- item.getMessage().toString().equals(String.format("User with address %s requested: 1+2", address))));
- assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
- item.getMessage().toString().equals(String.format("User with address %s requested: 1+3", address))));
- }
-
- @Test
- public void shouldNotAuditLogWhenDisabled() throws Exception {
- final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
- .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
- final Client client = cluster.connect();
- try {
- assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
- assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
- assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
- } finally {
- cluster.close();
- }
-
- final List<LoggingEvent> log = recordingAppender.getEvents();
- assertFalse(log.stream().anyMatch(item -> item.getLevel() == INFO &&
- item.getMessage().toString().matches("User .*? with address .*? authenticated by Krb5Authenticator")));
- assertFalse(log.stream().anyMatch(item -> item.getLevel() == INFO &&
- item.getMessage().toString().matches("User with address .*? requested: 1\\+1")));
- assertFalse(log.stream().anyMatch(item -> item.getLevel() == INFO &&
- item.getMessage().toString().matches("User with address .*? requested: 1\\+2")));
- assertFalse(log.stream().anyMatch(item -> item.getLevel() == INFO &&
- item.getMessage().toString().matches("User with address .*? requested: 1\\+3")));
- }
-
- @Test
- public void shouldAuditLogWithNioTransport() throws Exception {
- // ToDo issue (outside scope of this suite): .channelizer(Channelizer.NioChannelizer.class) fails
- final Cluster cluster = TestClientFactory.build().channelizer(Channelizer.NioChannelizer.class.getName())
- .jaasEntry(TESTCONSOLE).protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
- final Client client = cluster.connect();
- try {
- assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
- assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
- assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
- } finally {
- cluster.close();
- }
-
- final List<LoggingEvent> log = recordingAppender.getEvents();
- final Stream<LoggingEvent> auditEvents = log.stream().filter(event -> event.getLoggerName().equals(AUDIT_LOGGER_NAME));
- final LoggingEvent authEvent = auditEvents
- .filter(event -> event.getMessage().toString().contains("Krb5Authenticator")).iterator().next();
- final String authMsg = authEvent.getMessage().toString();
- final Matcher m = Pattern.compile(".*?([\\d.:]+).*?").matcher(authMsg);
- m.find();
- final String address = m.group(1);
- assertTrue(authEvent.getLevel() == INFO && authMsg.equals(
- String.format("User %s with address %s authenticated by Krb5Authenticator", kdcServer.clientPrincipalName, address)));
- assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
- item.getMessage().toString().equals(String.format("User with address %s requested: 1+1", address))));
- assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
- item.getMessage().toString().equals(String.format("User with address %s requested: 1+2", address))));
- assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
- item.getMessage().toString().equals(String.format("User with address %s requested: 1+3", address))));
- }
-
- @Test
- public void shouldAuditLogWithHttpTransport() throws Exception {
- final CloseableHttpClient httpclient = HttpClients.createDefault();
- final HttpGet httpget = new HttpGet(TestClientFactory.createURLString("?gremlin=1-1"));
- httpget.addHeader("Authorization", "Basic " + encoder.encodeToString("stephen:password".getBytes()));
-
- final CloseableHttpResponse response = httpclient.execute(httpget);
- assertEquals(200, response.getStatusLine().getStatusCode());
- assertEquals("application/json", response.getEntity().getContentType().getValue());
- final String json = EntityUtils.toString(response.getEntity());
- final JsonNode node = mapper.readTree(json);
- response.close();
- assertEquals(0, node.get("result").get("data").get(0).intValue());
-
- final List<LoggingEvent> log = recordingAppender.getEvents();
- final Stream<LoggingEvent> auditEvents = log.stream().filter(event -> event.getLoggerName().equals(AUDIT_LOGGER_NAME));
- final LoggingEvent authEvent = auditEvents
- .filter(event -> event.getMessage().toString().contains("SimpleAuthenticator")).iterator().next();
- final String authMsg = authEvent.getMessage().toString();
- final Matcher m = Pattern.compile(".*?([\\d.:]+).*?").matcher(authMsg);
- m.find();
- final String address = m.group(1);
- assertTrue(authEvent.getLevel() == INFO && authMsg.equals(
- String.format("User %s with address %s authenticated by SimpleAuthenticator", "stephen", address)));
- assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
- item.getMessage().toString().equals(String.format("User with address %s requested: 1-1", address))));
- }
-
- //ToDo: test with two clients
-}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/6a9c6674/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
deleted file mode 100644
index 11b873c..0000000
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
+++ /dev/null
@@ -1,263 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.tinkerpop.gremlin.server;
-
-import org.apache.commons.lang.exception.ExceptionUtils;
-import org.apache.log4j.Logger;
-import org.apache.tinkerpop.gremlin.driver.Client;
-import org.apache.tinkerpop.gremlin.driver.Cluster;
-import org.apache.tinkerpop.gremlin.driver.MessageSerializer;
-import org.apache.tinkerpop.gremlin.driver.ser.GryoMessageSerializerV1d0;
-import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
-import org.apache.tinkerpop.gremlin.util.Log4jRecordingAppender;
-import org.ietf.jgss.GSSException;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.slf4j.LoggerFactory;
-
-import java.io.File;
-import java.util.HashMap;
-import java.util.Map;
-import javax.security.auth.login.LoginException;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-
-
-
-/**
- * @author Marc de Lignie
- *
- * Todo: change back to integrate test later on
- */
-public class AuthKrb5Test extends AbstractGremlinServerIntegrationTest {
- private static final org.slf4j.Logger logger = LoggerFactory.getLogger(AuthKrb5Test.class);
- private Log4jRecordingAppender recordingAppender = null;
-
- static final String TESTCONSOLE = "GremlinConsole";
- static final String TESTCONSOLE_NOT_LOGGED_IN = "UserNotLoggedIn";
-
- private KdcFixture kdcServer;
-
- @Before
- @Override
- public void setUp() throws Exception {
- setupForEachTest();
- try {
- final String buildDir = System.getProperty("build.dir");
- kdcServer = new KdcFixture(buildDir +
- "/test-classes/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf");
- kdcServer.setUp();
- } catch(Exception e) {
- logger.warn(e.getMessage());
- }
- super.setUp();
- }
-
- public void setupForEachTest() {
- recordingAppender = new Log4jRecordingAppender();
- final Logger rootLogger = Logger.getRootLogger();
- rootLogger.addAppender(recordingAppender);
- }
-
- @After
- public void teardownForEachTest() throws Exception {
- final Logger rootLogger = Logger.getRootLogger();
- rootLogger.removeAppender(recordingAppender);
- kdcServer.close();
- }
-
- /**
- * Configure specific Gremlin Server settings for specific tests.
- */
- @Override
- public Settings overrideSettings(final Settings settings) {
- settings.host = kdcServer.hostname;
- final Settings.SslSettings sslConfig = new Settings.SslSettings();
- sslConfig.enabled = false;
- settings.ssl = sslConfig;
- final Settings.AuthenticationSettings authSettings = new Settings.AuthenticationSettings();
- settings.authentication = authSettings;
- authSettings.className = Krb5Authenticator.class.getName();
- final Map<String,Object> authConfig = new HashMap<>();
- authConfig.put("principal", kdcServer.serverPrincipal);
- authConfig.put("keytab", kdcServer.serviceKeytabFile.getAbsolutePath());
- authSettings.config = authConfig;
-
- final String nameOfTest = name.getMethodName();
- switch (nameOfTest) {
- case "shouldAuthenticateWithDefaults":
- case "shouldFailWithoutClientJaasEntry":
- case "shouldFailWithoutClientTicketCache":
- break;
- case "shouldFailWithNonexistentServerPrincipal":
- authConfig.put("principal", "no-service");
- break;
- case "shouldFailWithEmptyServerKeytab":
- final File keytabFile = new File(".", "no-file");
- authConfig.put("keytab", keytabFile);
- break;
- case "shouldFailWithWrongServerKeytab":
- final String principal = "no-principal/somehost@TEST.COM";
- try { kdcServer.createPrincipal(principal); } catch(Exception e) {
- logger.error("Cannot create principal in overrideSettings(): " + e.getMessage());
- };
- authConfig.put("principal", principal);
- break;
- case "shouldAuthenticateWithQop":
- break;
- }
- return settings;
- }
-
- /**
- * Defaults from TestClientFactory:
- * private int port = 45940;
- * private MessageSerializer serializer = Serializers.GRYO_V1D0.simpleInstance();
- * private int nioPoolSize = Runtime.getRuntime().availableProcessors();
- * private int workerPoolSize = Runtime.getRuntime().availableProcessors() * 2;
- * private int minConnectionPoolSize = ConnectionPool.MIN_POOL_SIZE;
- * private int maxConnectionPoolSize = ConnectionPool.MAX_POOL_SIZE;
- * private int minSimultaneousUsagePerConnection = ConnectionPool.MIN_SIMULTANEOUS_USAGE_PER_CONNECTION;
- * private int maxSimultaneousUsagePerConnection = ConnectionPool.MAX_SIMULTANEOUS_USAGE_PER_CONNECTION;
- * private int maxInProcessPerConnection = Connection.MAX_IN_PROCESS;
- * private int minInProcessPerConnection = Connection.MIN_IN_PROCESS;
- * private int maxWaitForConnection = Connection.MAX_WAIT_FOR_CONNECTION;
- * private int maxWaitForSessionClose = Connection.MAX_WAIT_FOR_SESSION_CLOSE;
- * private int maxContentLength = Connection.MAX_CONTENT_LENGTH;
- * private int reconnectInitialDelay = Connection.RECONNECT_INITIAL_DELAY;
- * private int reconnectInterval = Connection.RECONNECT_INTERVAL;
- * private int resultIterationBatchSize = Connection.RESULT_ITERATION_BATCH_SIZE;
- * private long keepAliveInterval = Connection.KEEP_ALIVE_INTERVAL;
- * private String channelizer = Channelizer.WebSocketChannelizer.class.getName();
- * private boolean enableSsl = false;
- * private String trustCertChainFile = null;
- * private String keyCertChainFile = null;
- * private String keyFile = null;
- * private String keyPassword = null;
- * private SslContext sslContext = null;
- * private LoadBalancingStrategy loadBalancingStrategy = new LoadBalancingStrategy.RoundRobin();
- * private AuthProperties authProps = new AuthProperties();
- */
- @Test
- public void shouldAuthenticateWithDefaults() throws Exception {
- final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
- .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
- final Client client = cluster.connect();
- try {
- assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
- assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
- assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
- } finally {
- cluster.close();
- }
- }
-
- @Test
- public void shouldFailWithoutClientJaasEntry() throws Exception {
- final Cluster cluster = TestClientFactory.build().protocol(kdcServer.serverPrincipalName)
- .addContactPoint(kdcServer.hostname).create();
- final Client client = cluster.connect();
- try {
- client.submit("1+1").all().get();
- fail("This should not succeed as the client config does not contain a JaasEntry");
- } catch(Exception ex) {
- final Throwable root = ExceptionUtils.getRootCause(ex);
- assertEquals(GSSException.class, root.getClass());
- } finally {
- cluster.close();
- }
- }
-
- @Test
- public void shouldFailWithoutClientTicketCache() throws Exception {
- final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE_NOT_LOGGED_IN)
- .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
- final Client client = cluster.connect();
- try {
- client.submit("1+1").all().get();
- fail("This should not succeed as the client config does not contain a valid ticket cache");
- } catch(Exception ex) {
- final Throwable root = ExceptionUtils.getRootCause(ex);
- assertEquals(LoginException.class, root.getClass());
- } finally {
- cluster.close();
- }
- }
-
- @Test
- public void shouldFailWithNonexistentServerPrincipal() throws Exception {
- assertTrue(recordingAppender.logContainsAny("WARN - Failed to login to kdc"));
- }
-
- @Test
- public void shouldFailWithEmptyServerKeytab() throws Exception {
- assertTrue(recordingAppender.logContainsAny("WARN - Failed to login to kdc"));
- }
-
- @Test
- public void shouldFailWithWrongServerKeytab() throws Exception {
- assertTrue(recordingAppender.logContainsAny("WARN - Failed to login to kdc"));
- }
-
- @Test
- public void shouldAuthenticateWithQop() throws Exception {
- final String oldQop = System.getProperty("javax.security.sasl.qop", "");
- System.setProperty("javax.security.sasl.qop", "auth-conf");
- final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
- .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
- final Client client = cluster.connect();
- try {
- assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
- assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
- assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
- } finally {
- cluster.close();
- System.setProperty("javax.security.sasl.qop", oldQop);
- }
- }
-
-// ToDo: Unclear how to test this
-// @Test
-// public void shouldFailWithAuthIdUnequalAuthzId() throws Exception {
-// server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
-// server.setUp();
-// }
-
-
- @Test
- public void shouldAuthenticateWithSerializeResultToString() throws Exception {
- MessageSerializer serializer = new GryoMessageSerializerV1d0();
- Map config = new HashMap<String, Object>();
- config.put("serializeResultToString", true);
- serializer.configure(config, null);
- final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
- .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).serializer(serializer).create();
- final Client client = cluster.connect();
- try {
- assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
- assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
- assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
- } finally {
- cluster.close();
- }
- }
-}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/6a9c6674/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
new file mode 100644
index 0000000..32c8451
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
@@ -0,0 +1,322 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.tinkerpop.gremlin.server;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.util.EntityUtils;
+import org.apache.log4j.Logger;
+import org.apache.log4j.spi.LoggingEvent;
+import static org.apache.log4j.Level.INFO;
+import org.apache.tinkerpop.gremlin.driver.Client;
+import org.apache.tinkerpop.gremlin.driver.Cluster;
+import org.apache.tinkerpop.gremlin.driver.Channelizer;
+import org.apache.tinkerpop.gremlin.server.channel.HttpChannelizer;
+import org.apache.tinkerpop.gremlin.server.channel.NioChannelizer;
+import org.apache.tinkerpop.shaded.jackson.databind.JsonNode;
+import org.apache.tinkerpop.shaded.jackson.databind.ObjectMapper;
+import org.apache.tinkerpop.gremlin.server.auth.AllowAllAuthenticator;
+import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
+import org.apache.tinkerpop.gremlin.server.auth.SimpleAuthenticator;
+import static org.apache.tinkerpop.gremlin.server.GremlinServerAuthKrb5IntegrateTest.TESTCONSOLE;
+import static org.apache.tinkerpop.gremlin.server.GremlinServer.AUDIT_LOGGER_NAME;
+import org.apache.tinkerpop.gremlin.util.Log4jRecordingAppender;
+import org.slf4j.LoggerFactory;
+
+import java.util.Base64;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import java.util.stream.Stream;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+
+/**
+ * @author Marc de Lignie
+ *
+ * Note: like other descendents of AbstractGremlinServerIntegrationTest this test suite assumes that tests are
+ * run sequentially and thus the server and kdcServer variables can be reused.
+ */
+public class GremlinServerAuditLogIntegrateTest extends AbstractGremlinServerIntegrationTest {
+ private static final org.slf4j.Logger logger = LoggerFactory.getLogger(GremlinServerAuditLogIntegrateTest.class);
+ private Log4jRecordingAppender recordingAppender = null;
+
+ private final ObjectMapper mapper = new ObjectMapper();
+ private final Base64.Encoder encoder = Base64.getUrlEncoder();
+
+ private static final boolean AUDIT_LOG_ENABLED = true;
+ private static final boolean AUDIT_LOG_DISABLED = false;
+
+ private KdcFixture kdcServer;
+
+ @Before
+ @Override
+ public void setUp() throws Exception {
+ try {
+ final String buildDir = System.getProperty("build.dir");
+ kdcServer = new KdcFixture(buildDir +
+ "/test-classes/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf");
+ kdcServer.setUp();
+ } catch(Exception e) {
+ logger.warn(e.getMessage());
+ }
+ super.setUp();
+ }
+
+ @Before
+ public void setupForEachTest() {
+ recordingAppender = new Log4jRecordingAppender();
+ final Logger rootLogger = Logger.getRootLogger();
+ rootLogger.addAppender(recordingAppender);
+ }
+
+ @After
+ public void teardownForEachTest() throws Exception {
+ final Logger rootLogger = Logger.getRootLogger();
+ rootLogger.removeAppender(recordingAppender);
+ kdcServer.close();
+ }
+
+ /**
+ * Configure specific Gremlin Server settings for specific tests.
+ */
+ @Override
+ public Settings overrideSettings(final Settings settings) {
+ settings.host = kdcServer.hostname;
+ final Settings.SslSettings sslConfig = new Settings.SslSettings();
+ sslConfig.enabled = false;
+ settings.ssl = sslConfig;
+ final Settings.AuthenticationSettings authSettings = new Settings.AuthenticationSettings();
+ settings.authentication = authSettings;
+ authSettings.enableAuditLog = AUDIT_LOG_ENABLED;
+ authSettings.className = Krb5Authenticator.class.getName();
+ final Map<String,Object> authConfig = new HashMap<>();
+ authSettings.config = authConfig;
+
+ final String nameOfTest = name.getMethodName();
+ switch (nameOfTest) {
+ case "shouldAuditLogWithAllowAllAuthenticator":
+ authSettings.className = AllowAllAuthenticator.class.getName();
+ break;
+ case "shouldAuditLogWithSimpleAuthenticator":
+ authSettings.className = SimpleAuthenticator.class.getName();
+ authConfig.put(SimpleAuthenticator.CONFIG_CREDENTIALS_DB, "conf/tinkergraph-credentials.properties");
+ break;
+ case "shouldNotAuditLogWhenDisabled":
+ authSettings.enableAuditLog = AUDIT_LOG_DISABLED;
+ case "shouldAuditLogWithKrb5Authenticator":
+ authConfig.put("keytab", kdcServer.serviceKeytabFile.getAbsolutePath());
+ authConfig.put("principal", kdcServer.serverPrincipal);
+ break;
+ case "shouldAuditLogWithNioTransport":
+ settings.channelizer = NioChannelizer.class.getName();
+ authConfig.put("keytab", kdcServer.serviceKeytabFile.getAbsolutePath());
+ authConfig.put("principal", kdcServer.serverPrincipal);
+ break;
+ case "shouldAuditLogWithHttpTransport":
+ settings.host = "localhost";
+ settings.channelizer = HttpChannelizer.class.getName();
+ authSettings.className = SimpleAuthenticator.class.getName();
+ authConfig.put(SimpleAuthenticator.CONFIG_CREDENTIALS_DB, "conf/tinkergraph-credentials.properties");
+ break;
+ }
+ return settings;
+ }
+
+ @Test
+ public void shouldAuditLogWithAllowAllAuthenticator() throws Exception {
+
+ final Cluster cluster = TestClientFactory.build().addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+
+ // WebSocketChannelizer does not add SaslAuthenticationHandler for AllowAllAuthenticator,
+ // so no authenticated user log line available
+ assertTrue(recordingAppender.logMatchesAny(AUDIT_LOGGER_NAME, INFO, "User with address .*? requested: 1\\+1"));
+ assertTrue(recordingAppender.logMatchesAny(AUDIT_LOGGER_NAME, INFO, "User with address .*? requested: 1\\+2"));
+ assertTrue(recordingAppender.logMatchesAny(AUDIT_LOGGER_NAME, INFO, "User with address .*? requested: 1\\+3"));
+ }
+
+ @Test
+ public void shouldAuditLogWithSimpleAuthenticator() throws Exception {
+ final String username = "stephen";
+ final String password = "password";
+
+ final Cluster cluster = TestClientFactory.build().credentials(username, password)
+ .addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+
+ final String simpleAuthenticatorName = SimpleAuthenticator.class.getSimpleName();
+ final String authMsg = recordingAppender.getMessages().stream()
+ .filter( msg -> msg.toString().contains("by " + simpleAuthenticatorName) ).iterator().next();
+ final Matcher m = Pattern.compile(".*?([\\d.:]+).*?").matcher(authMsg);
+ m.find();
+ final String address = m.group(1);
+
+ assertTrue(recordingAppender.logContainsAny(AUDIT_LOGGER_NAME, INFO,
+ String.format("User %s with address %s authenticated by %s", username, address, simpleAuthenticatorName)));
+ assertTrue(recordingAppender.logContainsAny(AUDIT_LOGGER_NAME, INFO,
+ String.format("User with address %s requested: 1+1", address)));
+ assertTrue(recordingAppender.logContainsAny(AUDIT_LOGGER_NAME, INFO,
+ String.format("User with address %s requested: 1+2", address)));
+ assertTrue(recordingAppender.logContainsAny(AUDIT_LOGGER_NAME, INFO,
+ String.format("User with address %s requested: 1+3", address)));
+ }
+
+ @Test
+ public void shouldAuditLogWithKrb5Authenticator() throws Exception {
+ final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+
+ final List<LoggingEvent> log = recordingAppender.getEvents();
+ final Stream<LoggingEvent> auditEvents = log.stream().filter(event -> event.getLoggerName().equals(AUDIT_LOGGER_NAME));
+ final LoggingEvent authEvent = auditEvents
+ .filter(event -> event.getMessage().toString().contains("Krb5Authenticator")).iterator().next();
+ final String authMsg = authEvent.getMessage().toString();
+ final Matcher m = Pattern.compile(".*?([\\d.:]+).*?").matcher(authMsg);
+ m.find();
+ final String address = m.group(1);
+ assertTrue(authEvent.getLevel() == INFO && authMsg.equals(
+ String.format("User %s with address %s authenticated by Krb5Authenticator", kdcServer.clientPrincipalName, address)));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+1", address))));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+2", address))));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+3", address))));
+ }
+
+ @Test
+ public void shouldNotAuditLogWhenDisabled() throws Exception {
+ final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+
+ final List<LoggingEvent> log = recordingAppender.getEvents();
+ assertFalse(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().matches("User .*? with address .*? authenticated by Krb5Authenticator")));
+ assertFalse(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().matches("User with address .*? requested: 1\\+1")));
+ assertFalse(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().matches("User with address .*? requested: 1\\+2")));
+ assertFalse(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().matches("User with address .*? requested: 1\\+3")));
+ }
+
+ @Test
+ public void shouldAuditLogWithNioTransport() throws Exception {
+ final Cluster cluster = TestClientFactory.build().channelizer(Channelizer.NioChannelizer.class.getName())
+ .jaasEntry(TESTCONSOLE).protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+
+ final List<LoggingEvent> log = recordingAppender.getEvents();
+ final Stream<LoggingEvent> auditEvents = log.stream().filter(event -> event.getLoggerName().equals(AUDIT_LOGGER_NAME));
+ final LoggingEvent authEvent = auditEvents
+ .filter(event -> event.getMessage().toString().contains("Krb5Authenticator")).iterator().next();
+ final String authMsg = authEvent.getMessage().toString();
+ final Matcher m = Pattern.compile(".*?([\\d.:]+).*?").matcher(authMsg);
+ m.find();
+ final String address = m.group(1);
+ assertTrue(authEvent.getLevel() == INFO && authMsg.equals(
+ String.format("User %s with address %s authenticated by Krb5Authenticator", kdcServer.clientPrincipalName, address)));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+1", address))));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+2", address))));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+3", address))));
+ }
+
+ @Test
+ public void shouldAuditLogWithHttpTransport() throws Exception {
+ final CloseableHttpClient httpclient = HttpClients.createDefault();
+ final HttpGet httpget = new HttpGet(TestClientFactory.createURLString("?gremlin=1-1"));
+ httpget.addHeader("Authorization", "Basic " + encoder.encodeToString("stephen:password".getBytes()));
+
+ final CloseableHttpResponse response = httpclient.execute(httpget);
+ assertEquals(200, response.getStatusLine().getStatusCode());
+ assertEquals("application/json", response.getEntity().getContentType().getValue());
+ final String json = EntityUtils.toString(response.getEntity());
+ final JsonNode node = mapper.readTree(json);
+ response.close();
+ assertEquals(0, node.get("result").get("data").get(0).intValue());
+
+ final List<LoggingEvent> log = recordingAppender.getEvents();
+ final Stream<LoggingEvent> auditEvents = log.stream().filter(event -> event.getLoggerName().equals(AUDIT_LOGGER_NAME));
+ final LoggingEvent authEvent = auditEvents
+ .filter(event -> event.getMessage().toString().contains("SimpleAuthenticator")).iterator().next();
+ final String authMsg = authEvent.getMessage().toString();
+ final Matcher m = Pattern.compile(".*?([\\d.:]+).*?").matcher(authMsg);
+ m.find();
+ final String address = m.group(1);
+ assertTrue(authEvent.getLevel() == INFO && authMsg.equals(
+ String.format("User %s with address %s authenticated by SimpleAuthenticator", "stephen", address)));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1-1", address))));
+ }
+
+ //ToDo: test with two clients
+}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/6a9c6674/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
new file mode 100644
index 0000000..9573208
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
@@ -0,0 +1,235 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.tinkerpop.gremlin.server;
+
+import org.apache.commons.lang.exception.ExceptionUtils;
+import org.apache.log4j.Logger;
+import org.apache.tinkerpop.gremlin.driver.Client;
+import org.apache.tinkerpop.gremlin.driver.Cluster;
+import org.apache.tinkerpop.gremlin.driver.MessageSerializer;
+import org.apache.tinkerpop.gremlin.driver.ser.GryoMessageSerializerV1d0;
+import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
+import org.apache.tinkerpop.gremlin.util.Log4jRecordingAppender;
+import org.ietf.jgss.GSSException;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.slf4j.LoggerFactory;
+
+import java.io.File;
+import java.util.HashMap;
+import java.util.Map;
+import javax.security.auth.login.LoginException;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+
+
+/**
+ * @author Marc de Lignie
+ *
+ */
+public class GremlinServerAuthKrb5IntegrateTest extends AbstractGremlinServerIntegrationTest {
+ private static final org.slf4j.Logger logger = LoggerFactory.getLogger(GremlinServerAuthKrb5IntegrateTest.class);
+ private Log4jRecordingAppender recordingAppender = null;
+
+ static final String TESTCONSOLE = "GremlinConsole";
+ static final String TESTCONSOLE_NOT_LOGGED_IN = "UserNotLoggedIn";
+
+ private KdcFixture kdcServer;
+
+ @Before
+ @Override
+ public void setUp() throws Exception {
+ setupForEachTest();
+ try {
+ final String buildDir = System.getProperty("build.dir");
+ kdcServer = new KdcFixture(buildDir +
+ "/test-classes/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf");
+ kdcServer.setUp();
+ } catch(Exception e) {
+ logger.warn(e.getMessage());
+ }
+ super.setUp();
+ }
+
+ public void setupForEachTest() {
+ recordingAppender = new Log4jRecordingAppender();
+ final Logger rootLogger = Logger.getRootLogger();
+ rootLogger.addAppender(recordingAppender);
+ }
+
+ @After
+ public void teardownForEachTest() throws Exception {
+ final Logger rootLogger = Logger.getRootLogger();
+ rootLogger.removeAppender(recordingAppender);
+ kdcServer.close();
+ }
+
+ /**
+ * Configure specific Gremlin Server settings for specific tests.
+ */
+ @Override
+ public Settings overrideSettings(final Settings settings) {
+ settings.host = kdcServer.hostname;
+ final Settings.SslSettings sslConfig = new Settings.SslSettings();
+ sslConfig.enabled = false;
+ settings.ssl = sslConfig;
+ final Settings.AuthenticationSettings authSettings = new Settings.AuthenticationSettings();
+ settings.authentication = authSettings;
+ authSettings.className = Krb5Authenticator.class.getName();
+ final Map<String,Object> authConfig = new HashMap<>();
+ authConfig.put("principal", kdcServer.serverPrincipal);
+ authConfig.put("keytab", kdcServer.serviceKeytabFile.getAbsolutePath());
+ authSettings.config = authConfig;
+
+ final String nameOfTest = name.getMethodName();
+ switch (nameOfTest) {
+ case "shouldAuthenticateWithDefaults":
+ case "shouldFailWithoutClientJaasEntry":
+ case "shouldFailWithoutClientTicketCache":
+ break;
+ case "shouldFailWithNonexistentServerPrincipal":
+ authConfig.put("principal", "no-service");
+ break;
+ case "shouldFailWithEmptyServerKeytab":
+ final File keytabFile = new File(".", "no-file");
+ authConfig.put("keytab", keytabFile);
+ break;
+ case "shouldFailWithWrongServerKeytab":
+ final String principal = "no-principal/somehost@TEST.COM";
+ try { kdcServer.createPrincipal(principal); } catch(Exception e) {
+ logger.error("Cannot create principal in overrideSettings(): " + e.getMessage());
+ };
+ authConfig.put("principal", principal);
+ break;
+ case "shouldAuthenticateWithQop":
+ break;
+ }
+ return settings;
+ }
+
+ @Test
+ public void shouldAuthenticateWithDefaults() throws Exception {
+ final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+ }
+
+ @Test
+ public void shouldFailWithoutClientJaasEntry() throws Exception {
+ final Cluster cluster = TestClientFactory.build().protocol(kdcServer.serverPrincipalName)
+ .addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+ try {
+ client.submit("1+1").all().get();
+ fail("This should not succeed as the client config does not contain a JaasEntry");
+ } catch(Exception ex) {
+ final Throwable root = ExceptionUtils.getRootCause(ex);
+ assertEquals(GSSException.class, root.getClass());
+ } finally {
+ cluster.close();
+ }
+ }
+
+ @Test
+ public void shouldFailWithoutClientTicketCache() throws Exception {
+ final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE_NOT_LOGGED_IN)
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+ try {
+ client.submit("1+1").all().get();
+ fail("This should not succeed as the client config does not contain a valid ticket cache");
+ } catch(Exception ex) {
+ final Throwable root = ExceptionUtils.getRootCause(ex);
+ assertEquals(LoginException.class, root.getClass());
+ } finally {
+ cluster.close();
+ }
+ }
+
+ @Test
+ public void shouldFailWithNonexistentServerPrincipal() throws Exception {
+ assertTrue(recordingAppender.logContainsAny("WARN - Failed to login to kdc"));
+ }
+
+ @Test
+ public void shouldFailWithEmptyServerKeytab() throws Exception {
+ assertTrue(recordingAppender.logContainsAny("WARN - Failed to login to kdc"));
+ }
+
+ @Test
+ public void shouldFailWithWrongServerKeytab() throws Exception {
+ assertTrue(recordingAppender.logContainsAny("WARN - Failed to login to kdc"));
+ }
+
+ @Test
+ public void shouldAuthenticateWithQop() throws Exception {
+ final String oldQop = System.getProperty("javax.security.sasl.qop", "");
+ System.setProperty("javax.security.sasl.qop", "auth-conf");
+ final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ System.setProperty("javax.security.sasl.qop", oldQop);
+ }
+ }
+
+// ToDo: Unclear how to test this
+// @Test
+// public void shouldFailWithAuthIdUnequalAuthzId() throws Exception {
+// server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
+// server.setUp();
+// }
+
+
+ // This test backs a fix in gremlin-driver (cd628b251f6956c826df20c89177680fe120ff99)
+ // Maybe gremlin-driver needs its own test with client.submit("[1,2,3] as byte[]")
+ @Test
+ public void shouldAuthenticateWithSerializeResultToString() throws Exception {
+ MessageSerializer serializer = new GryoMessageSerializerV1d0();
+ Map config = new HashMap<String, Object>();
+ config.put("serializeResultToString", true);
+ serializer.configure(config, null);
+ final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).serializer(serializer).create();
+ final Client client = cluster.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/6a9c6674/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
index 7ff2f06..db19c96 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
@@ -79,7 +79,7 @@ public class KdcFixture {
try {
hostname = Inet4Address.getLocalHost().getCanonicalHostName().toLowerCase();
} catch (Exception e) {
- logger.error("Hostname not found");
+ logger.error("Hostname not found: " + e.getMessage());
}
return hostname;
}
[04/27] tinkerpop git commit: Added failing test
shouldAuthenticateWithSerializeResultToString
Posted by sp...@apache.org.
Added failing test shouldAuthenticateWithSerializeResultToString
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/36713cfe
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/36713cfe
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/36713cfe
Branch: refs/heads/master
Commit: 36713cfed9bbee1e74dd74cb2838cd2ecdfb30d9
Parents: b3cb7e9
Author: vtslab <vt...@xs4all.nl>
Authored: Mon Nov 28 13:16:51 2016 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 19:58:48 2017 +0100
----------------------------------------------------------------------
.../gremlin/server/AuthKrb5IntegrateTest.java | 146 ----------------
.../tinkerpop/gremlin/server/AuthKrb5Test.java | 168 +++++++++++++++++++
2 files changed, 168 insertions(+), 146 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/36713cfe/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5IntegrateTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5IntegrateTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5IntegrateTest.java
deleted file mode 100644
index 64cfb29..0000000
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5IntegrateTest.java
+++ /dev/null
@@ -1,146 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.tinkerpop.gremlin.server;
-
-import org.apache.kerby.kerberos.kerb.server.LoginTestBase;
-import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Rule;
-import org.junit.Test;
-import org.apache.tinkerpop.gremlin.driver.Client;
-import org.apache.tinkerpop.gremlin.driver.Cluster;
-
-import java.io.ByteArrayOutputStream;
-import java.io.File;
-import java.io.InputStream;
-import java.net.Inet4Address;
-import java.net.InetAddress;
-import java.util.*;
-
-import org.junit.rules.TestName;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import javax.security.auth.Subject;
-
-import static org.hamcrest.CoreMatchers.anyOf;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
-
-
-/**
- * @author Marc de Lignie
- */
-public class AuthKrb5IntegrateTest extends LoginTestBase {
- private static final Logger logger = LoggerFactory.getLogger(AuthKrb5IntegrateTest.class);
- private GremlinServerAuthKrb5Integrate server;
- private String serverHostname = null;
- private static final String TESTCONSOLE = "GremlinConsole";
-
- @Rule
- public TestName name = new TestName();
-
- private class GremlinServerAuthKrb5Integrate extends AbstractGremlinServerIntegrationTest {
-
- private final String nameOfTest;
-
- GremlinServerAuthKrb5Integrate(String nameOfTest) {
- this.nameOfTest = nameOfTest;
- }
-
- @Override
- public Settings overrideSettings(final Settings settings) {
- logger.debug("Testname: " + nameOfTest);
- try { // See hostname setting in KdcTestBase
- serverHostname = Inet4Address.getLocalHost().getCanonicalHostName();
- settings.host = serverHostname;
- } catch(Exception e) {
- logger.error("Hostname not found");
- }
- logger.debug("Hostname: " + settings.host);
- final Settings.AuthenticationSettings authSettings = new Settings.AuthenticationSettings();
- authSettings.className = Krb5Authenticator.class.getName();
- final Map<String,Object> authConfig = new HashMap<>();
- final String buildDir = System.getProperty("build.dir");
- authConfig.put("keytab", serviceKeytabFile.getAbsolutePath());
- authConfig.put("principal", getServerPrincipal());
- authSettings.config = authConfig;
- settings.authentication = authSettings;
- final Settings.SslSettings sslConfig = new Settings.SslSettings();
- sslConfig.enabled = false;
- settings.ssl = sslConfig;
-
-// switch (nameOfTest) {
-// case "shouldAuthenticateOverSslWithKerberosTicket":
-// case "shouldFailIfSslEnabledOnServerButNotClient":
-// final Settings.SslSettings sslConfig = new Settings.SslSettings();
-// sslConfig.enabled = true;
-// settings.ssl = sslConfig;
-// break;
-// }
- return settings;
- }
- }
-
- @Before
- @Override
- public void setUp() throws Exception {
- super.setUp();
- // Create keytab for gremlinServer and ticketcache for gremlinConsole
- Subject gremlinServer = loginServiceUsingKeytab();
- Subject gremlinConsole = loginClientUsingTicketCache();
- logger.debug("Done creating keytab and ticketcache");
-
- // ToDo: how to set java.security.auth.login.config when using gremlin-console with krb5LoginModule
- final String buildDir = System.getProperty("build.dir");
- System.setProperty("java.security.auth.login.config", buildDir +
- "/test-classes/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf");
- logger.debug("java.security.auth.login.config: " + System.getProperty("java.security.auth.login.config"));
- logger.debug("project.build.directory: " + System.getProperty("project.build.directory"));
- server = new GremlinServerAuthKrb5Integrate(name.getMethodName());
- server.setUp();
- }
-
- @After
- public void tearDown() throws Exception {
- server.tearDown();
- super.tearDown();
- }
-
- @Test
- public void testRemoteLogin() throws Exception {
- File f = new File(".");
- logger.debug("Working dir: " + f.getCanonicalPath());
- // ToDo: try TestClientFactory
- final Cluster cluster = Cluster.build().jaasEntry(TESTCONSOLE)
- .protocol("test-service").addContactPoint(serverHostname).port(45940).enableSsl(false).create();
- final Client client = cluster.connect();
- try {
- assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
- assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
- assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
- } finally {
- cluster.close();
- }
- }
- // ToDo: test client login fails as wanted without a valid ticket
- // ToDo: test with System.setProperty("javax.security.sasl.qop", "auth-conf");
-}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/36713cfe/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
new file mode 100644
index 0000000..298957c
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
@@ -0,0 +1,168 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.tinkerpop.gremlin.server;
+
+import org.apache.kerby.kerberos.kerb.server.LoginTestBase;
+import org.apache.tinkerpop.gremlin.driver.MessageSerializer;
+import org.apache.tinkerpop.gremlin.driver.ser.GryoMessageSerializerV1d0;
+import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.apache.tinkerpop.gremlin.driver.Client;
+import org.apache.tinkerpop.gremlin.driver.Cluster;
+
+import java.io.File;
+import java.net.Inet4Address;
+import java.util.*;
+
+import org.junit.rules.TestName;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.security.auth.Subject;
+
+import static org.hamcrest.CoreMatchers.anyOf;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.fail;
+
+
+/**
+ * @author Marc de Lignie
+ *
+ * Todo: change back to integrate test later on
+ */
+public class AuthKrb5Test extends LoginTestBase {
+ private static final Logger logger = LoggerFactory.getLogger(AuthKrb5Test.class);
+ private GremlinServerAuthKrb5Integrate server;
+ private String serverHostname = null;
+ private static final String TESTCONSOLE = "GremlinConsole";
+
+ @Rule
+ public TestName name = new TestName();
+
+ private class GremlinServerAuthKrb5Integrate extends AbstractGremlinServerIntegrationTest {
+
+ private final String nameOfTest;
+
+ GremlinServerAuthKrb5Integrate(String nameOfTest) {
+ this.nameOfTest = nameOfTest;
+ }
+
+ @Override
+ public Settings overrideSettings(final Settings settings) {
+ logger.debug("Testname: " + nameOfTest);
+ try { // See hostname setting in KdcTestBase
+ serverHostname = Inet4Address.getLocalHost().getCanonicalHostName();
+ settings.host = serverHostname;
+ } catch(Exception e) {
+ logger.error("Hostname not found");
+ }
+ logger.debug("Hostname: " + settings.host);
+ final Settings.AuthenticationSettings authSettings = new Settings.AuthenticationSettings();
+ authSettings.className = Krb5Authenticator.class.getName();
+ final Map authConfig = new HashMap<String,Object>();
+ final String buildDir = System.getProperty("build.dir");
+ authConfig.put("keytab", serviceKeytabFile.getAbsolutePath());
+ authConfig.put("principal", getServerPrincipal());
+ authSettings.config = authConfig;
+ settings.authentication = authSettings;
+ final Settings.SslSettings sslConfig = new Settings.SslSettings();
+ sslConfig.enabled = false;
+ settings.ssl = sslConfig;
+
+// switch (nameOfTest) {
+// case "shouldAuthenticateOverSslWithKerberosTicket":
+// case "shouldFailIfSslEnabledOnServerButNotClient":
+// final Settings.SslSettings sslConfig = new Settings.SslSettings();
+// sslConfig.enabled = true;
+// settings.ssl = sslConfig;
+// break;
+// }
+ return settings;
+ }
+ }
+
+ @Before
+ @Override
+ public void setUp() throws Exception {
+ super.setUp();
+ // Create keytab for gremlinServer and ticketcache for gremlinConsole
+ Subject gremlinServer = loginServiceUsingKeytab();
+ Subject gremlinConsole = loginClientUsingTicketCache();
+ logger.debug("Done creating keytab and ticketcache");
+
+ final String buildDir = System.getProperty("build.dir");
+ System.setProperty("java.security.auth.login.config", buildDir +
+ "/test-classes/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf");
+ logger.debug("java.security.auth.login.config: " + System.getProperty("java.security.auth.login.config"));
+ logger.debug("project.build.directory: " + System.getProperty("project.build.directory"));
+ server = new GremlinServerAuthKrb5Integrate(name.getMethodName());
+ server.setUp();
+ }
+
+ @After
+ public void tearDown() throws Exception {
+ server.tearDown();
+ super.tearDown();
+ }
+
+ @Test
+ public void shouldAuthenticate() throws Exception {
+ File f = new File(".");
+ logger.debug("Working dir: " + f.getCanonicalPath());
+ // ToDo: try TestClientFactory
+ final Cluster cluster = Cluster.build().jaasEntry(TESTCONSOLE)
+ .protocol("test-service").addContactPoint(serverHostname).port(45940).enableSsl(false).create();
+ final Client client = cluster.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+ }
+
+
+ @Test
+ public void shouldAuthenticateWithSerializeResultToString() throws Exception {
+// File f = new File(".");
+// logger.debug("Working dir: " + f.getCanonicalPath());
+// MessageSerializer serializer = new GryoMessageSerializerV1d0();
+// Map config = new HashMap<String, Object>();
+// config.put("serializeResultToString", true);
+// serializer.configure(config, null);
+// final Cluster cluster = Cluster.build().jaasEntry(TESTCONSOLE)
+// .protocol("test-service").addContactPoint(serverHostname).port(45940).enableSsl(false).serializer(serializer).create();
+// final Client client = cluster.connect();
+// try {
+// assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+// assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+// assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+// } finally {
+// cluster.close();
+// }
+ }
+
+ // ToDo: test client login fails as wanted without a valid ticket
+ // ToDo: test with System.setProperty("javax.security.sasl.qop", "auth-conf");
+}
[19/27] tinkerpop git commit: Restored WARN for gremlin-server
log4j.properties
Posted by sp...@apache.org.
Restored WARN for gremlin-server log4j.properties
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/64001285
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/64001285
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/64001285
Branch: refs/heads/master
Commit: 6400128580dd7531e3c94386febe4b55b51a3af8
Parents: 3668557
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Fri Jan 20 08:32:12 2017 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Fri Jan 20 08:32:12 2017 +0100
----------------------------------------------------------------------
gremlin-server/src/test/resources/log4j-test.properties | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/64001285/gremlin-server/src/test/resources/log4j-test.properties
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/resources/log4j-test.properties b/gremlin-server/src/test/resources/log4j-test.properties
index c806201..a9aeddd 100644
--- a/gremlin-server/src/test/resources/log4j-test.properties
+++ b/gremlin-server/src/test/resources/log4j-test.properties
@@ -15,9 +15,10 @@
# specific language governing permissions and limitations
# under the License.
-log4j.rootLogger=INFO, stdout
+log4j.rootLogger=WARN, stdout
log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=[%p] %C - %m%n
log4j.logger.org.apache.tinkerpop.gremlin.server.op.AbstractEvalOpProcessor=ERROR
+log4j.logger.audit.org.apache.tinkerpop.gremlin.server=INFO
[15/27] tinkerpop git commit: Improved code comments regarding
authorization after Kerberos authentication
Posted by sp...@apache.org.
Improved code comments regarding authorization after Kerberos authentication
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/a5f3e1fb
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/a5f3e1fb
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/a5f3e1fb
Branch: refs/heads/master
Commit: a5f3e1fb14afc691a8cb9617d8da4417c514aeaa
Parents: 6a9c667
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Sat Jan 14 20:19:23 2017 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 20:08:00 2017 +0100
----------------------------------------------------------------------
.../tinkerpop/gremlin/server/auth/Krb5Authenticator.java | 5 +++++
.../server/GremlinServerAuthKrb5IntegrateTest.java | 10 +---------
2 files changed, 6 insertions(+), 9 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/a5f3e1fb/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
index 275dba6..9733523 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
@@ -37,6 +37,7 @@ import java.util.Map;
/**
* A Kerberos (GSSAPI) implementation of an {@link Authenticator}
+ * This authenticator authenticates and autorizes all clients with a valid service ticket.
*
* @author Marc de Lignie
*/
@@ -137,6 +138,10 @@ public class Krb5Authenticator implements Authenticator {
/*
* This method is based on the handle() method from:
* https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/kerby-kerb/integration-test/src/main/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppServer.java
+ *
+ * This provides the simplest form of authorization, where each client that provides a valid service ticket,
+ * is authorized. More elaborate authorization schemes would interrogate a policy server like Apache Ranger
+ * or ACL's of a storage backend.
*/
@Override
public void handle(Callback[] callbacks) throws UnsupportedCallbackException {
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/a5f3e1fb/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
index 9573208..22d38cd 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
@@ -205,15 +205,7 @@ public class GremlinServerAuthKrb5IntegrateTest extends AbstractGremlinServerInt
}
}
-// ToDo: Unclear how to test this
-// @Test
-// public void shouldFailWithAuthIdUnequalAuthzId() throws Exception {
-// server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
-// server.setUp();
-// }
-
-
- // This test backs a fix in gremlin-driver (cd628b251f6956c826df20c89177680fe120ff99)
+ // This test backs a fix in gremlin-driver (see commit cd628b251f6956c826df20c89177680fe120ff99)
// Maybe gremlin-driver needs its own test with client.submit("[1,2,3] as byte[]")
@Test
public void shouldAuthenticateWithSerializeResultToString() throws Exception {
[18/27] tinkerpop git commit: Added Kerberos authentication test with
ssl
Posted by sp...@apache.org.
Added Kerberos authentication test with ssl
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/3668557f
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/3668557f
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/3668557f
Branch: refs/heads/master
Commit: 3668557f65c47292ccb28ea4556dbe6dcf43dd44
Parents: d81f0d7
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Wed Jan 18 21:38:07 2017 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 21:38:07 2017 +0100
----------------------------------------------------------------------
.../server/GremlinServerAuthKrb5IntegrateTest.java | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/3668557f/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
index 63d464d..e974118 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
@@ -121,6 +121,9 @@ public class GremlinServerAuthKrb5IntegrateTest extends AbstractGremlinServerInt
};
authConfig.put("principal", principal);
break;
+ case "shouldAuthenticateWithSsl":
+ sslConfig.enabled = true;
+ break;
case "shouldAuthenticateWithQop":
break;
}
@@ -206,6 +209,20 @@ public class GremlinServerAuthKrb5IntegrateTest extends AbstractGremlinServerInt
}
@Test
+ public void shouldAuthenticateWithSsl() throws Exception {
+ final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE).enableSsl(true)
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+ }
+
+ @Test
public void shouldAuthenticateWithSerializeResultToString() throws Exception {
MessageSerializer serializer = new GryoMessageSerializerV1d0();
Map config = new HashMap<String, Object>();
[03/27] tinkerpop git commit: Fixed problem with non-lowercase
hostname
Posted by sp...@apache.org.
Fixed problem with non-lowercase hostname
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/d2639a7a
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/d2639a7a
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/d2639a7a
Branch: refs/heads/master
Commit: d2639a7a4c239ceab80b2085ff01983db2e58441
Parents: 36713cf
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Sat Dec 3 16:41:47 2016 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 19:58:48 2017 +0100
----------------------------------------------------------------------
.../apache/kerby/kerberos/kerb/server/KdcTestBase.java | 7 ++++---
.../apache/tinkerpop/gremlin/server/AuthKrb5Test.java | 13 +++----------
2 files changed, 7 insertions(+), 13 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/d2639a7a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
index d50f420..c8f8255 100644
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
@@ -40,7 +40,7 @@ public abstract class KdcTestBase {
private static final Logger logger = LoggerFactory.getLogger(KdcTestBase.class);
private static File testDir;
- private static String hostname;
+ protected static String hostname;
private static final String clientPassword = "123456";
private static final String clientPrincipalName = "drankye";
private static final String clientPrincipal = clientPrincipalName + "@" + TestKdcServer.KDC_REALM;
@@ -51,9 +51,10 @@ public abstract class KdcTestBase {
KdcTestBase() {
// Hostname setting must be consistent with the way gremlin-console sets gremlin-server's hostname
- // and derives gremlin-server's principal name
+ // and derives gremlin-server's principal name. Also, the hostname needs to be lowercase for use
+ // in principal names.
try {
- hostname = Inet4Address.getLocalHost().getCanonicalHostName();
+ hostname = Inet4Address.getLocalHost().getCanonicalHostName().toLowerCase();
serverPrincipal = serverPrincipalName + "/" + hostname + "@" + TestKdcServer.KDC_REALM;
} catch (UnknownHostException e) {
logger.error("Hostname not found");
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/d2639a7a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
index 298957c..6615318 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
@@ -53,7 +53,6 @@ import static org.junit.Assert.fail;
public class AuthKrb5Test extends LoginTestBase {
private static final Logger logger = LoggerFactory.getLogger(AuthKrb5Test.class);
private GremlinServerAuthKrb5Integrate server;
- private String serverHostname = null;
private static final String TESTCONSOLE = "GremlinConsole";
@Rule
@@ -70,12 +69,7 @@ public class AuthKrb5Test extends LoginTestBase {
@Override
public Settings overrideSettings(final Settings settings) {
logger.debug("Testname: " + nameOfTest);
- try { // See hostname setting in KdcTestBase
- serverHostname = Inet4Address.getLocalHost().getCanonicalHostName();
- settings.host = serverHostname;
- } catch(Exception e) {
- logger.error("Hostname not found");
- }
+ settings.host = hostname;
logger.debug("Hostname: " + settings.host);
final Settings.AuthenticationSettings authSettings = new Settings.AuthenticationSettings();
authSettings.className = Krb5Authenticator.class.getName();
@@ -129,9 +123,8 @@ public class AuthKrb5Test extends LoginTestBase {
public void shouldAuthenticate() throws Exception {
File f = new File(".");
logger.debug("Working dir: " + f.getCanonicalPath());
- // ToDo: try TestClientFactory
- final Cluster cluster = Cluster.build().jaasEntry(TESTCONSOLE)
- .protocol("test-service").addContactPoint(serverHostname).port(45940).enableSsl(false).create();
+ final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
+ .protocol("test-service").addContactPoint(hostname).enableSsl(false).create();
final Client client = cluster.connect();
try {
assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
[09/27] tinkerpop git commit: Added Krb5Authenticator to reference
docs
Posted by sp...@apache.org.
Added Krb5Authenticator to reference docs
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/202d658e
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/202d658e
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/202d658e
Branch: refs/heads/master
Commit: 202d658e33e08e03059e6d742c99e15fdccdced0
Parents: 2ead423
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Sun Dec 11 11:15:29 2016 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 19:58:48 2017 +0100
----------------------------------------------------------------------
.../src/reference/gremlin-applications.asciidoc | 89 +++++++++++++++++---
1 file changed, 76 insertions(+), 13 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/202d658e/docs/src/reference/gremlin-applications.asciidoc
----------------------------------------------------------------------
diff --git a/docs/src/reference/gremlin-applications.asciidoc b/docs/src/reference/gremlin-applications.asciidoc
index 696b93b..57f43e0 100644
--- a/docs/src/reference/gremlin-applications.asciidoc
+++ b/docs/src/reference/gremlin-applications.asciidoc
@@ -1138,20 +1138,44 @@ The `TraversalOpProcessor` provides a way to use <<connecting-via-remotegraph,Re
|cacheMaxSize |The maximum number of entries in the side-effect cache. |1000
|=========================================================
-Security and Execution
-^^^^^^^^^^^^^^^^^^^^^^
+Security
+^^^^^^^^
image:gremlin-server-secure.png[width=175,float=right] Gremlin Server provides for several features that aid in the
-security of the graphs that it exposes. It has built in SSL support and a pluggable authentication framework using
+security of the graphs that it exposes. In particular it supports SSL for transport layer security, protective measures against
+malicious script execution, and authentication. SSL options are described in the configuration settings table in the
+<<connecting-via-java, "Connecting via Java">> section. Script execution options are covered
+<<script-execution, "at the end of this section">>. This section starts with authentication.
+
+
+Gremlin Server supports a pluggable authentication framework using
link:https://en.wikipedia.org/wiki/Simple_Authentication_and_Security_Layer[SASL] (Simple Authentication and
-Security Layer). SSL options are described in the configuration settings table above, so this section will focus on
-authentication.
+Security Layer). Depending on the client used to connect to Gremlin Server, different authentication
+mechanisms are accessible, see the table below.
+
+[width="70%",cols="3,5,3",options="header"]
+|=========================================================
+|Client |Authentication mechanism |Availability
+|HTTP |BASIC |3.0.0-incubating
+1.3+v|Gremlin-Java/
+Gremlin-Console |PLAIN SASL (username/password) |3.0.0-incubating
+|Pluggable SASL |3.0.0-incubating
+|GSSAPI SASL (Kerberos) |3.3.0
+|Gremlin-Python |PLAIN SASL |3.2.2
+|Gremlin-Javascript |PLAIN SASL |3.3.0
+|=========================================================
By default, Gremlin Server is configured to allow all requests to be processed (i.e. no authentication). To enable
authentication, Gremlin Server must be configured with an `Authenticator` implementation in its YAML file. Gremlin
-Server comes packaged with an implementation called `SimpleAuthenticator`. The `SimpleAuthenticator` implements the
-`PLAIN` SASL mechanism (i.e. plain text) to authenticate a request. It validates username/password pairs against a
-graph database, which must be provided to it as part of the configuration.
+Server comes packaged with two implementations called `SimpleAuthenticator` for plain text authentication using HTTP BASIC or
+PLAIN SASL and `Krb5Authenticator` for Kerberos authentication using GSSAPI SASL.
+
+Plain text authentication
++++++++++++++++++++++++++
+
+The `SimpleAuthenticator` implements the "PLAIN" SASL mechanism (i.e. plain text) to authenticate a request. It also
+supports handling basic authentication requests from http clients. It validates
+username/password pairs against a graph database, which must be provided to it as part of the configuration.
[source,yaml]
authentication: {
@@ -1159,9 +1183,6 @@ authentication: {
config: {
credentialsDb: conf/tinkergraph-credentials.properties}}
-Quick Start
-+++++++++++
-
A quick way to get started with the `SimpleAuthenticator` is to use TinkerGraph for the "credentials graph" and the
"sample" credential graph that is packaged with the server.
@@ -1259,9 +1280,51 @@ credentials.removeUser("daniel")
credentials.countUsers()
----
+[[krb5authenticator]]
+Kerberos Authentication
++++++++++++++++++++++++
+
+The `Krb5Authenticator` implements the "GSSAPI" SASL mechanism (i.e. Kerberos) to authenticate a request from a Gremlin
+client. It can be applied in an existing Kerberos environment and validates whether a
+link:https://http://www.roguelynn.com/words/explain-like-im-5-kerberos/[valid authentication proof and service ticket are
+offered].
+
+[source,yaml]
+authentication: {
+ className: org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator,
+ config: {
+ principal: gremlinserver/hostname.your.org@YOUR.REALM,
+ keytab: /etc/security/keytabs/gremlinserver.service.keytab}}
+
+Krb5Authenticator needs a Kerberos service principal and a keytab that holds the secret key for that principal. The keytab
+location and service name, e.g. gremlinserver, are free to be chosen, but Gremlin clients have to specify this service name
+as the `protocol`. For Gremlin-Console the `protocol` is an entry in the remote.yaml file, for Gremlin-java the client builder
+has a `protocol()` method.
+
+In addition to the `protocol`, the Gremlin client needs to specify a `jaasEntry`, an entry in the
+link:https://en.wikipedia.org/wiki/Java_Authentication_and_Authorization_Service[JAAS] configuration file. Gremlin-Console
+comes with a sample gremlin-jaas.conf file with a `GremlinConsole` jaasEntry:
+
+[source, jaas]
+GremlinConsole {
+ com.sun.security.auth.module.Krb5LoginModule required
+ doNotPrompt=true
+ useTicketCache=true;
+};
+
+This configuration tells Gremlin-Console to pass authentication requests from gremlin-server to the Krb5LoginModule, which is
+part of the java standard library. The Krb5LoginModule does not prompt the user for a username and password but uses the ticket cache that
+is normally refreshed when a user logs in to a host within the Kerberos realm.
+
+Finally, the Gremlin client needs the location of the JAAS configuration file to be passed as a system property to the JVM. For
+Gremlin-Console the easiest way to do this is to pass it to the run script via the JAVA_OPTIONS environment property:
+
+[source, bash]
+export JAVA_OPTIONS="$JAVA_OPTIONS -Djava.security.auth.login.config=conf/gremlin-jaas.conf"
+
[[script-execution]]
-Script Execution
-++++++++++++++++
+Protecting Script Execution
++++++++++++++++++++++++++++
It is important to remember that Gremlin Server exposes a `ScriptEngine` instance that allows for remote execution
of arbitrary code on the server. Obviously, this situation can represent a security risk or, more minimally, provide
[07/27] tinkerpop git commit: Refactored and cleaned directory-kerby
usage
Posted by sp...@apache.org.
Refactored and cleaned directory-kerby usage
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/14dd5215
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/14dd5215
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/14dd5215
Branch: refs/heads/master
Commit: 14dd521526c33ae4ac5a1351c12ed66e07095303
Parents: 4544b01
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Tue Dec 13 14:55:04 2016 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 19:58:48 2017 +0100
----------------------------------------------------------------------
gremlin-server/pom.xml | 4 +-
.../gremlin/server/auth/JaasKrbUtil.java | 161 +++++++++++++++++--
.../kerb/integration/test/AppClient.java | 70 --------
.../kerb/integration/test/AppServer.java | 87 ----------
.../kerberos/kerb/integration/test/AppTest.java | 87 ----------
.../kerb/integration/test/SaslAppTest.java | 55 -------
.../kerb/integration/test/Transport.java | 137 ----------------
.../integration/test/sasl/SaslAppClient.java | 106 ------------
.../integration/test/sasl/SaslAppServer.java | 139 ----------------
.../kerby/kerberos/kerb/server/KdcTestBase.java | 48 +++---
.../kerberos/kerb/server/LoginTestBase.java | 11 +-
.../kerberos/kerb/server/TestKdcServer.java | 7 +
.../tinkerpop/gremlin/server/AuthKrb5Test.java | 79 ++-------
.../gremlin/server/AuthKrb5TestBase.java | 130 +++++++++++++++
14 files changed, 324 insertions(+), 797 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/14dd5215/gremlin-server/pom.xml
----------------------------------------------------------------------
diff --git a/gremlin-server/pom.xml b/gremlin-server/pom.xml
index 3cae525..40f5785 100644
--- a/gremlin-server/pom.xml
+++ b/gremlin-server/pom.xml
@@ -116,12 +116,12 @@ limitations under the License.
<version>1.0.0-RC2</version>
<scope>test</scope>
</dependency>
- <dependency>
+ <!--dependency>
<groupId>org.apache.kerby</groupId>
<artifactId>client-tool</artifactId>
<version>1.0.0-RC2</version>
<scope>test</scope>
- </dependency>
+ </dependency-->
<dependency>
<groupId>org.assertj</groupId>
<artifactId>assertj-core</artifactId>
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/14dd5215/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
index 3a8099a..ad87d58 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
@@ -6,42 +6,46 @@
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
- *
+ *
* http://www.apache.org/licenses/LICENSE-2.0
- *
+ *
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
- * under the License.
- *
+ * under the License.
+ *
*/
package org.apache.tinkerpop.gremlin.server.auth;
import javax.security.auth.Subject;
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.PasswordCallback;
+import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.kerberos.KerberosPrincipal;
import javax.security.auth.login.AppConfigurationEntry;
import javax.security.auth.login.Configuration;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import java.io.File;
+import java.io.IOException;
import java.security.Principal;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
-
/**
* JAAS utilities for Kerberos login.
*
- * Pruned but otherwise literal copy from package org.apache.kerby.kerberos.kerb.client, see:
- * https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/kerby-kerb/kerb-simplekdc/
- * src/main/java/org/apache/kerby/kerberos/kerb/client/JaasKrbUtil.java
+ * Except for the package name and this comment, this file is a literal copy from
+ * package org.apache.kerby.kerberos.kerb.client, see:
+ * https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/kerby-kerb/kerb-simplekdc/
+ * src/main/java/org/apache/kerby/kerberos/kerb/client/JaasKrbUtil.java
*
- * ToDo: isIniator=true is probably wrong for keytab login, but passes the test
- * ToDo: consider making JaasKrbUtil an explicit project dependency
+ * See also: gremlin-server/src/main/static/NOTICE
*/
public final class JaasKrbUtil {
@@ -49,10 +53,45 @@ public final class JaasKrbUtil {
private JaasKrbUtil() { }
- public static Subject loginUsingKeytab(String principal, File keytabFile) throws LoginException {
+ public static Subject loginUsingPassword(
+ String principal, String password) throws LoginException {
+ Set<Principal> principals = new HashSet<Principal>();
+ principals.add(new KerberosPrincipal(principal));
+
+ Subject subject = new Subject(false, principals,
+ new HashSet<Object>(), new HashSet<Object>());
+
+ Configuration conf = usePassword(principal);
+ String confName = "PasswordConf";
+ CallbackHandler callback = new KrbCallbackHandler(principal, password);
+ LoginContext loginContext = new LoginContext(confName, subject, callback, conf);
+ loginContext.login();
+ return loginContext.getSubject();
+ }
+
+ public static Subject loginUsingTicketCache(
+ String principal, File cacheFile) throws LoginException {
Set<Principal> principals = new HashSet<Principal>();
principals.add(new KerberosPrincipal(principal));
- Subject subject = new Subject(false, principals, new HashSet<Object>(), new HashSet<Object>());
+
+ Subject subject = new Subject(false, principals,
+ new HashSet<Object>(), new HashSet<Object>());
+
+ Configuration conf = useTicketCache(principal, cacheFile);
+ String confName = "TicketCacheConf";
+ LoginContext loginContext = new LoginContext(confName, subject, null, conf);
+ loginContext.login();
+ return loginContext.getSubject();
+ }
+
+ public static Subject loginUsingKeytab(
+ String principal, File keytabFile) throws LoginException {
+ Set<Principal> principals = new HashSet<Principal>();
+ principals.add(new KerberosPrincipal(principal));
+
+ Subject subject = new Subject(false, principals,
+ new HashSet<Object>(), new HashSet<Object>());
+
Configuration conf = useKeytab(principal, keytabFile);
String confName = "KeytabConf";
LoginContext loginContext = new LoginContext(confName, subject, null, conf);
@@ -60,14 +99,23 @@ public final class JaasKrbUtil {
return loginContext.getSubject();
}
+ public static Configuration usePassword(String principal) {
+ return new PasswordJaasConf(principal);
+ }
+
+ public static Configuration useTicketCache(String principal,
+ File credentialFile) {
+ return new TicketCacheJaasConf(principal, credentialFile);
+ }
+
public static Configuration useKeytab(String principal, File keytabFile) {
return new KeytabJaasConf(principal, keytabFile);
}
private static String getKrb5LoginModuleName() {
return System.getProperty("java.vendor").contains("IBM")
- ? "com.ibm.security.auth.module.Krb5LoginModule"
- : "com.sun.security.auth.module.Krb5LoginModule";
+ ? "com.ibm.security.auth.module.Krb5LoginModule"
+ : "com.sun.security.auth.module.Krb5LoginModule";
}
static class KeytabJaasConf extends Configuration {
@@ -93,9 +141,88 @@ public final class JaasKrbUtil {
options.put("debug", String.valueOf(ENABLE_DEBUG));
return new AppConfigurationEntry[]{
- new AppConfigurationEntry(getKrb5LoginModuleName(),
- AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
- options)};
+ new AppConfigurationEntry(getKrb5LoginModuleName(),
+ AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
+ options)};
+ }
+ }
+
+ static class TicketCacheJaasConf extends Configuration {
+ private String principal;
+ private File clientCredentialFile;
+
+ TicketCacheJaasConf(String principal, File clientCredentialFile) {
+ this.principal = principal;
+ this.clientCredentialFile = clientCredentialFile;
+ }
+
+ @Override
+ public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
+ Map<String, String> options = new HashMap<String, String>();
+ options.put("principal", principal);
+ options.put("storeKey", "false");
+ options.put("doNotPrompt", "false");
+ options.put("useTicketCache", "true");
+ options.put("renewTGT", "true");
+ options.put("refreshKrb5Config", "true");
+ options.put("isInitiator", "true");
+ options.put("ticketCache", clientCredentialFile.getAbsolutePath());
+ options.put("debug", String.valueOf(ENABLE_DEBUG));
+
+ return new AppConfigurationEntry[]{
+ new AppConfigurationEntry(getKrb5LoginModuleName(),
+ AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
+ options)};
}
}
+
+ static class PasswordJaasConf extends Configuration {
+ private String principal;
+
+ PasswordJaasConf(String principal) {
+ this.principal = principal;
+ }
+
+ @Override
+ public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
+ Map<String, String> options = new HashMap<>();
+ options.put("principal", principal);
+ options.put("storeKey", "true");
+ options.put("useTicketCache", "true");
+ options.put("useKeyTab", "false");
+ options.put("renewTGT", "true");
+ options.put("refreshKrb5Config", "true");
+ options.put("isInitiator", "true");
+ options.put("debug", String.valueOf(ENABLE_DEBUG));
+
+ return new AppConfigurationEntry[]{
+ new AppConfigurationEntry(getKrb5LoginModuleName(),
+ AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
+ options)};
+ }
+ }
+
+ public static class KrbCallbackHandler implements CallbackHandler {
+ private String principal;
+ private String password;
+
+ public KrbCallbackHandler(String principal, String password) {
+ this.principal = principal;
+ this.password = password;
+ }
+
+ public void handle(Callback[] callbacks)
+ throws IOException, UnsupportedCallbackException {
+ for (int i = 0; i < callbacks.length; i++) {
+ if (callbacks[i] instanceof PasswordCallback) {
+ PasswordCallback pc = (PasswordCallback) callbacks[i];
+ if (pc.getPrompt().contains(principal)) {
+ pc.setPassword(password.toCharArray());
+ break;
+ }
+ }
+ }
+ }
+ }
+
}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/14dd5215/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppClient.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppClient.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppClient.java
deleted file mode 100644
index c0a636a..0000000
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppClient.java
+++ /dev/null
@@ -1,70 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.kerby.kerberos.kerb.integration.test;
-
-import java.io.IOException;
-
-public abstract class AppClient {
- private Transport.Connection conn;
- private boolean isTestOK = false;
-
- public AppClient(String[] args) throws Exception {
- usage(args);
-
- String hostName = args[0];
- int port = Integer.parseInt(args[1]);
-
- this.conn = Transport.Connector.connect(hostName, port);
- }
-
- protected void usage(String[] args) {
- if (args.length < 2) {
- System.err.println("Usage: java <options> AppClient "
- + "<server-host> <server-port>");
- throw new RuntimeException("Arguments are invalid.");
- }
- }
-
- public void run() {
- // System.out.println("Connected to server");
-
- try {
- withConnection(conn);
- } catch (Exception e) {
- e.printStackTrace();
- } finally {
- try {
- conn.close();
- } catch (IOException e) {
- e.printStackTrace();
- }
- }
- }
-
- protected abstract void withConnection(Transport.Connection conn) throws Exception;
-
- public boolean isTestOK() {
- return isTestOK;
- }
-
- protected synchronized void setTestOK(boolean isOK) {
- this.isTestOK = isOK;
- }
-}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/14dd5215/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppServer.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppServer.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppServer.java
deleted file mode 100644
index 77abc65..0000000
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppServer.java
+++ /dev/null
@@ -1,87 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.kerby.kerberos.kerb.integration.test;
-
-import java.io.IOException;
-
-/**
- * Making it runnable because the server will be launched in a separate thread
- * in a test.
- */
-public abstract class AppServer implements Runnable {
- protected Transport.Acceptor acceptor;
- private boolean terminated = false;
-
- public AppServer(String[] args) throws IOException {
- usage(args);
-
- int listenPort = Integer.parseInt(args[0]);
- this.acceptor = new Transport.Acceptor(listenPort);
- }
-
- protected void usage(String[] args) {
- if (args.length < 1) {
- System.err.println("Usage: AppServer <ListenPort>");
- throw new RuntimeException("Usage: AppServer <ListenPort>");
- }
- }
-
- public synchronized void start() {
- new Thread(this).start();
- }
-
- public synchronized void stop() {
- terminated = true;
- }
-
- @Override
- public void run() {
- try {
- synchronized (this) {
- while (!terminated) {
- runOnce();
- }
- }
- } finally {
- acceptor.close();
- }
- }
-
- private void runOnce() {
- // System.out.println("Waiting for incoming connection...");
-
- Transport.Connection conn = acceptor.accept();
- // System.out.println("Got connection from client");
-
- try {
- onConnection(conn);
- } catch (Exception e) {
- e.printStackTrace();
- } finally {
- try {
- conn.close();
- } catch (IOException e) {
- e.printStackTrace();
- }
- }
- }
-
- protected abstract void onConnection(Transport.Connection conn) throws Exception;
-}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/14dd5215/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppTest.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppTest.java
deleted file mode 100644
index 0964598..0000000
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppTest.java
+++ /dev/null
@@ -1,87 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.kerby.kerberos.kerb.integration.test;
-
-import org.apache.kerby.kerberos.kerb.server.LoginTestBase;
-import org.apache.kerby.util.NetworkUtil;
-import org.junit.Assert;
-import org.junit.Before;
-
-import javax.security.auth.Subject;
-import java.security.PrivilegedAction;
-
-public abstract class AppTest extends LoginTestBase {
- private int serverPort;
- protected AppClient appClient;
- protected AppServer appServer;
-
- @Before
- @Override
- public void setUp() throws Exception {
- super.setUp();
-
- serverPort = NetworkUtil.getServerPort();
-
- setupAppServer();
- }
-
- protected int getServerPort() {
- return serverPort;
- }
-
- protected void setupAppServer() throws Exception {
- Subject subject = loginServiceUsingKeytab();
- Subject.doAs(subject, new PrivilegedAction<Object>() {
- @Override
- public Object run() {
- try {
- appServer = createAppServer();
- appServer.start();
- } catch (Exception e) {
- e.printStackTrace();
- }
- return null;
- }
- });
- }
-
- protected abstract AppServer createAppServer() throws Exception;
-
- protected void runAppClient() throws Exception {
- Subject subject = loginClientUsingTicketCache();
- Subject.doAs(subject, new PrivilegedAction<Object>() {
- @Override
- public Object run() {
- try {
- appClient = createAppClient();
- appClient.run();
- } catch (Exception e) {
- e.printStackTrace();
- }
- return null;
- }
- });
-
- Assert.assertTrue("Client successfully connected and authenticated to server",
- appClient.isTestOK());
- }
-
- protected abstract AppClient createAppClient() throws Exception;
-}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/14dd5215/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/SaslAppTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/SaslAppTest.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/SaslAppTest.java
deleted file mode 100644
index 332d046..0000000
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/SaslAppTest.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.kerby.kerberos.kerb.integration.test;
-
-import org.apache.kerby.kerberos.kerb.integration.test.sasl.SaslAppClient;
-import org.apache.kerby.kerberos.kerb.integration.test.sasl.SaslAppServer;
-import org.junit.Test;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-
-public class SaslAppTest extends AppTest {
-
- @Override
- protected AppServer createAppServer() throws Exception {
- return new SaslAppServer(new String[] {
- String.valueOf(getServerPort()),
- getServerPrincipalName(),
- getHostname()
- });
- }
-
- @Override
- protected AppClient createAppClient() throws Exception {
- return new SaslAppClient(new String[] {
- getHostname(),
- String.valueOf(getServerPort()),
- getServerPrincipalName(),
- getHostname()
- });
- }
-
- @Test
- //TODO: not robust enough, with "ICMP Port Unreachable" exception.
- public void test() throws Exception {
- runAppClient();
- }
-}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/14dd5215/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/Transport.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/Transport.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/Transport.java
deleted file mode 100644
index 50bad1a..0000000
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/Transport.java
+++ /dev/null
@@ -1,137 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.kerby.kerberos.kerb.integration.test;
-
-import java.io.DataInputStream;
-import java.io.DataOutputStream;
-import java.io.IOException;
-import java.net.ServerSocket;
-import java.net.Socket;
-import java.nio.charset.StandardCharsets;
-
-public class Transport {
-
- public static class Acceptor {
- ServerSocket serverSocket;
-
- public Acceptor(int listenPort) throws IOException {
- this.serverSocket = new ServerSocket(listenPort);
- }
-
- public Connection accept() {
- try {
- Socket socket = serverSocket.accept();
- return new Connection(socket);
- } catch (IOException ioe) {
- throw new RuntimeException(ioe);
- }
- }
-
- public void close() {
- try {
- serverSocket.close();
- } catch (IOException e) {
- e.printStackTrace();
- }
- }
- }
-
- public static class Connector {
- public static Connection connect(String host,
- int port) throws IOException {
- Socket socket = new Socket(host, port);
- return new Connection(socket);
- }
- }
-
- public static class Connection {
- private Socket socket;
- private DataInputStream instream;
- private DataOutputStream outstream;
-
- public Connection(Socket socket) throws IOException {
- this.socket = socket;
- instream = new DataInputStream(socket.getInputStream());
- outstream = new DataOutputStream(socket.getOutputStream());
- }
-
- public void close() throws IOException {
- socket.close();
- }
-
- public void sendToken(byte[] token) throws IOException {
- if (token != null) {
- outstream.writeInt(token.length);
- outstream.write(token);
- } else {
- outstream.writeInt(0);
- }
- outstream.flush();
- }
-
- public void sendMessage(Message msg) throws IOException {
- if (msg != null) {
- sendToken(msg.header);
- sendToken(msg.body);
- }
- }
-
- public void sendMessage(byte[] header, byte[] body) throws IOException {
- sendMessage(new Message(header, body));
- }
-
- public void sendMessage(String header, byte[] body) throws IOException {
- sendMessage(new Message(header, body));
- }
-
- public byte[] recvToken() throws IOException {
- int len = instream.readInt();
- if (len > 0) {
- byte[] token = new byte[len];
- instream.readFully(token);
- return token;
- }
- return null;
- }
-
- public Message recvMessage() throws IOException {
- byte[] header = recvToken();
- byte[] body = recvToken();
- Message msg = new Message(header, body);
- return msg;
- }
- }
-
- public static class Message {
- public byte[] header;
- public byte[] body;
-
-
- Message(byte[] header, byte[] body) {
- this.header = header;
- this.body = body;
- }
-
- public Message(String header, byte[] body) {
- this.header = header.getBytes(StandardCharsets.UTF_8);
- this.body = body;
- }
- }
-}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/14dd5215/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppClient.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppClient.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppClient.java
deleted file mode 100644
index b928e01..0000000
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppClient.java
+++ /dev/null
@@ -1,106 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.kerby.kerberos.kerb.integration.test.sasl;
-
-import org.apache.kerby.kerberos.kerb.integration.test.AppClient;
-import org.apache.kerby.kerberos.kerb.integration.test.Transport;
-
-import javax.security.sasl.Sasl;
-import javax.security.sasl.SaslClient;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.util.HashMap;
-import java.util.Map;
-
-public class SaslAppClient extends AppClient {
- private SaslClient saslClient;
-
- public SaslAppClient(String[] args) throws Exception {
- super(args);
-
- String protocol = args[2];
- String serverFqdn = args[3];
- Map<String, String> props = new HashMap<String, String>();
- props.put(Sasl.QOP, "auth");
-
- this.saslClient = Sasl.createSaslClient(new String[]{"GSSAPI"}, null,
- protocol, serverFqdn, props, null);
- }
-
- public static void main(String[] args) throws Exception {
- new SaslAppClient(args).run();
- }
-
- @Override
- protected void usage(String[] args) {
- if (args.length < 4) {
- System.err.println("Usage: SaslAppClient "
- + "<server-host> <server-port> <service-protocol> <server-fqdn>");
- throw new RuntimeException("Usage: SaslAppClient "
- + "<server-host> <server-port> <service-protocol> <server-fqdn>");
- }
- }
-
- @Override
- protected void withConnection(Transport.Connection conn) throws Exception {
- byte[] token = saslClient.hasInitialResponse() ? new byte[0] : null;
- token = saslClient.evaluateChallenge(token);
- conn.sendMessage("CONT", token);
-
- Transport.Message msg = conn.recvMessage();
- while (!saslClient.isComplete() && (isContinue(msg) || isOK(msg))) {
- byte[] respToken = saslClient.evaluateChallenge(msg.body);
-
- if (isOK(msg)) {
- if (respToken != null) {
- throw new IOException("Attempting to send response after completion");
- }
- break;
- } else {
- conn.sendMessage("CONT", respToken);
- msg = conn.recvMessage();
- }
- }
-
- //System.out.println("Context Established! ");
-
- token = "Hello There!\0".getBytes(StandardCharsets.UTF_8);
- //System.out.println("Will send wrap token of size " + token.length);
-
- conn.sendToken(token);
- setTestOK(true);
-
- saslClient.dispose();
- }
-
- private boolean isOK(Transport.Message msg) {
- if (msg.header != null) {
- return new String(msg.header, StandardCharsets.UTF_8).equals("OK");
- }
- return false;
- }
-
- private boolean isContinue(Transport.Message msg) {
- if (msg.header != null) {
- return new String(msg.header, StandardCharsets.UTF_8).equals("CONT");
- }
- return false;
- }
-}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/14dd5215/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppServer.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppServer.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppServer.java
deleted file mode 100644
index 8c4c646..0000000
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppServer.java
+++ /dev/null
@@ -1,139 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.kerby.kerberos.kerb.integration.test.sasl;
-
-import org.apache.kerby.kerberos.kerb.integration.test.AppServer;
-import org.apache.kerby.kerberos.kerb.integration.test.Transport;
-
-import javax.security.auth.callback.Callback;
-import javax.security.auth.callback.CallbackHandler;
-import javax.security.auth.callback.UnsupportedCallbackException;
-import javax.security.sasl.AuthorizeCallback;
-import javax.security.sasl.Sasl;
-import javax.security.sasl.SaslException;
-import javax.security.sasl.SaslServer;
-import java.io.IOException;
-import java.util.HashMap;
-import java.util.Map;
-
-public class SaslAppServer extends AppServer {
- private String mechanism;
- private String serviceProtocol;
- private String serverFqdn;
-
- public SaslAppServer(String[] args) throws Exception {
- super(args);
-
- this.mechanism = "GSSAPI";
- this.serviceProtocol = args[1];
- this.serverFqdn = args[2];
- }
-
- public static void main(String[] args) throws Exception {
- new SaslAppServer(args).run();
- }
-
- @Override
- protected void usage(String[] args) {
- if (args.length < 3) {
- System.err.println("Usage: SaslAppServer "
- + "<ListenPort> <service-protocol> <server-fqdn>");
- throw new RuntimeException("Usage: SaslAppServer "
- + "<ListenPort> <service-protocol> <server-fqdn>");
- }
- }
-
- @Override
- protected void onConnection(Transport.Connection conn) throws Exception {
- // System.out.print("Starting negotiating security context");
-
- //mechanism, protocol, serverId, saslProperties, callback
- CallbackHandler callbackHandler = new SaslGssCallbackHandler();
- Map<String, Object> props = new HashMap<String, Object>();
- props.put(Sasl.QOP, "auth");
-
- SaslServer ss = Sasl.createSaslServer(mechanism,
- serviceProtocol, serverFqdn, props, callbackHandler);
- System.out.println("!!!! " + mechanism + ", " + serviceProtocol + ", " + serverFqdn);
- Transport.Message msg = conn.recvMessage();
- while (!ss.isComplete()) {
- try {
- byte[] respToken = ss.evaluateResponse(msg.body);
- if (ss.isComplete()) {
- conn.sendMessage("OK", respToken);
- } else {
- conn.sendMessage("CONT", respToken);
- msg = conn.recvMessage();
- }
-
- } catch (SaslException e) {
- conn.sendMessage("ERR", null);
- ss.dispose();
- break;
- }
- }
-
- // System.out.print("Context Established! ");
-
- doWith(ss, props, conn);
-
- ss.dispose();
- }
-
- protected void doWith(SaslServer ss, Map<String, Object> props,
- Transport.Connection conn) throws IOException, Exception {
- conn.recvToken();
- //byte[] token = conn.recvToken();
- //String str = new String(token, StandardCharsets.UTF_8);
- // System.out.println("Received data \""
- // + str + "\" of length " + str.length());
- }
-
- public static class SaslGssCallbackHandler implements CallbackHandler {
-
- @Override
- public void handle(Callback[] callbacks) throws
- UnsupportedCallbackException {
- AuthorizeCallback ac = null;
- for (Callback callback : callbacks) {
- if (callback instanceof AuthorizeCallback) {
- ac = (AuthorizeCallback) callback;
- } else {
- throw new UnsupportedCallbackException(callback,
- "Unrecognized SASL GSSAPI Callback");
- }
- }
- if (ac != null) {
- String authid = ac.getAuthenticationID();
- String authzid = ac.getAuthorizationID();
- if (authid.equals(authzid)) {
- ac.setAuthorized(true);
- } else {
- ac.setAuthorized(false);
- }
- if (ac.isAuthorized()) {
- // System.out.println("SASL server GSSAPI callback: setting "
- //+ "canonicalized client ID: " + authzid);
- ac.setAuthorizedID(authzid);
- }
- }
- }
- }
-}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/14dd5215/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
index 37622de..15663cb 100644
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
@@ -27,39 +27,33 @@ import org.junit.After;
import org.junit.AfterClass;
import org.junit.Before;
import org.junit.BeforeClass;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import java.io.File;
import java.io.IOException;
-import java.net.Inet4Address;
-import java.net.InetAddress;
-import java.net.UnknownHostException;
+/*
+ * This file is based on:
+ * https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/
+ * kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
+ * but with the following changes:
+ * - added this comment
+ * - made allowUdp() return false because of issues with UDP in the RC2 release, see directory-kerby on JIRA
+ *
+ * See also: gremlin-server/src/main/static/NOTICE
+ */
public abstract class KdcTestBase {
- private static final Logger logger = LoggerFactory.getLogger(KdcTestBase.class);
-
private static File testDir;
- protected static String hostname;
- private static final String clientPassword = "123456";
- private static final String clientPrincipalName = "drankye";
- private static final String clientPrincipal = clientPrincipalName + "@" + TestKdcServer.KDC_REALM;
- private static final String serverPrincipalName = "test-service";
- private static String serverPrincipal = null;
- private SimpleKdcServer kdcServer;
+ private final String clientPassword = "123456";
+ private final String hostname = "localhost";
+ private final String clientPrincipalName = "drankye";
+ private final String clientPrincipal =
+ clientPrincipalName + "@" + TestKdcServer.KDC_REALM;
+ private final String serverPrincipalName = "test-service";
+ private final String serverPrincipal =
+ serverPrincipalName + "/" + hostname + "@" + TestKdcServer.KDC_REALM;
- KdcTestBase() {
- // Hostname setting must be consistent with the way gremlin-console sets gremlin-server's hostname
- // and derives gremlin-server's principal name. Also, the hostname needs to be lowercase for use
- // in principal names.
- try {
- hostname = Inet4Address.getLocalHost().getCanonicalHostName().toLowerCase();
- serverPrincipal = serverPrincipalName + "/" + hostname + "@" + TestKdcServer.KDC_REALM;
- } catch (UnknownHostException e) {
- logger.error("Hostname not found");
- }
- }
+ private SimpleKdcServer kdcServer;
@BeforeClass
public static void createTestDir() throws IOException {
@@ -121,7 +115,9 @@ public abstract class KdcTestBase {
return hostname;
}
- protected boolean allowUdp() { return false; } //}true;}
+ protected boolean allowUdp() {
+ return false;
+ } // originally: true
protected boolean allowTcp() {
return true;
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/14dd5215/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
index f5bdb80..cb83276 100644
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
@@ -33,6 +33,13 @@ import java.util.Set;
import static org.assertj.core.api.Assertions.assertThat;
+/*
+ * Except for this comment, this file is a literal copy from:
+ * https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/
+ * kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
+ *
+ * See also: gremlin-server/src/main/static/NOTICE
+ */
public class LoginTestBase extends KdcTestBase {
protected File ticketCacheFile;
@@ -75,8 +82,8 @@ public class LoginTestBase extends KdcTestBase {
@After
@Override
public void tearDown() throws Exception {
-// ticketCacheFile.delete(); easier for debugging
-// serviceKeytabFile.delete(); easier for debugging
+ ticketCacheFile.delete();
+ serviceKeytabFile.delete();
super.tearDown();
}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/14dd5215/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java
index 76f9bc1..3addc88 100644
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java
@@ -25,6 +25,13 @@ import org.apache.kerby.kerberos.kerb.client.KrbConfig;
import org.apache.kerby.kerberos.kerb.client.KrbConfigKey;
import org.apache.kerby.util.NetworkUtil;
+/*
+ * Except for this comment, this file is a literal copy from:
+ * https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/
+ * kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java
+ *
+ * See also: gremlin-server/src/main/static/NOTICE
+ */
public class TestKdcServer extends SimpleKdcServer {
public static final String KDC_REALM = "TEST.COM";
public static final String HOSTNAME = "localhost";
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/14dd5215/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
index bd639ef..223b572 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
@@ -19,12 +19,12 @@
package org.apache.tinkerpop.gremlin.server;
import org.apache.commons.lang.exception.ExceptionUtils;
-import org.apache.kerby.kerberos.kerb.server.LoginTestBase;
import org.apache.log4j.AppenderSkeleton;
-import org.apache.log4j.Level;
import org.apache.log4j.Logger;
+import org.apache.log4j.Level;
import org.apache.log4j.spi.LoggingEvent;
-import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
+import org.apache.tinkerpop.gremlin.driver.Client;
+import org.apache.tinkerpop.gremlin.driver.Cluster;
import org.ietf.jgss.GSSException;
import org.junit.After;
import org.junit.Before;
@@ -35,14 +35,12 @@ import org.apache.tinkerpop.gremlin.driver.Cluster;
import java.io.File;
import java.util.*;
-
-import org.junit.rules.TestName;
-
import javax.security.auth.login.LoginException;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
+import org.junit.Test;
@@ -51,73 +49,15 @@ import static org.junit.Assert.fail;
*
* Todo: change back to integrate test later on
*/
-public class AuthKrb5Test extends LoginTestBase {
+public class AuthKrb5Test extends AuthKrb5TestBase {
// Cannot use mere slf4j because need to check log output
- // Messier alternative would be to catch the console output:
- // http://stackoverflow.com/questions/8708342/redirect-console-output-to-string-in-java
private final Logger rootLogger = Logger.getRootLogger();
private final Logger logger = Logger.getLogger(AuthKrb5Test.class);
+
private GremlinServerAuthKrb5Integrate server;
private static final String TESTCONSOLE = "GremlinConsole";
private static final String TESTCONSOLE_NOT_LOGGED_IN = "UserNotLoggedIn";
- @Rule
- public TestName name = new TestName();
-
- private class GremlinServerAuthKrb5Integrate extends AbstractGremlinServerIntegrationTest {
-
- final String principal;
- final File keytabFile;
-
- GremlinServerAuthKrb5Integrate(String principal, File keytabFile) {
- this.principal = principal;
- this.keytabFile = keytabFile;
- }
-
- @Override
- public Settings overrideSettings(final Settings settings) {
- settings.host = hostname;
- logger.debug("Hostname: " + settings.host);
- final Settings.AuthenticationSettings authSettings = new Settings.AuthenticationSettings();
- authSettings.className = Krb5Authenticator.class.getName();
- final Map authConfig = new HashMap<String,Object>();
- authConfig.put("keytab", keytabFile.getAbsolutePath());
- authConfig.put("principal", principal);
- authSettings.config = authConfig;
- settings.authentication = authSettings;
- final Settings.SslSettings sslConfig = new Settings.SslSettings();
- sslConfig.enabled = false;
- settings.ssl = sslConfig;
-
-// switch (nameOfTest) {
-// case "shouldAuthenticateOverSslWithKerberosTicket":
-// case "shouldFailIfSslEnabledOnServerButNotClient":
-// final Settings.SslSettings sslConfig = new Settings.SslSettings();
-// sslConfig.enabled = true;
-// settings.ssl = sslConfig;
-// break;
-// }
- return settings;
- }
- }
-
- @Before
- @Override
- public void setUp() throws Exception {
- logger.info("Starting " + name.getMethodName());
- super.setUp();
- loginServiceUsingKeytab();
- loginClientUsingTicketCache();
- final String buildDir = System.getProperty("build.dir");
- System.setProperty("java.security.auth.login.config", buildDir +
- "/test-classes/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf");
- }
-
- @After
- public void tearDown() throws Exception {
- super.tearDown();
- }
-
/**
* Defaults from TestClientFactory:
* private int port = 45940;
@@ -152,7 +92,7 @@ public class AuthKrb5Test extends LoginTestBase {
server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
server.setUp();
final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
- .protocol(getServerPrincipalName()).addContactPoint(hostname).create();
+ .protocol(getServerPrincipalName()).addContactPoint(getHostname()).create();
final Client client = cluster.connect();
try {
assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
@@ -168,7 +108,8 @@ public class AuthKrb5Test extends LoginTestBase {
public void shouldFailWithoutClientJaasEntry() throws Exception {
server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
server.setUp();
- final Cluster cluster = TestClientFactory.build().protocol(getServerPrincipalName()).addContactPoint(hostname).create();
+ final Cluster cluster = TestClientFactory.build().protocol(getServerPrincipalName())
+ .addContactPoint(getHostname()).create();
final Client client = cluster.connect();
try {
client.submit("1+1").all().get();
@@ -187,7 +128,7 @@ public class AuthKrb5Test extends LoginTestBase {
server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
server.setUp();
final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE_NOT_LOGGED_IN)
- .protocol(getServerPrincipalName()).addContactPoint(hostname).create();
+ .protocol(getServerPrincipalName()).addContactPoint(getHostname()).create();
final Client client = cluster.connect();
try {
client.submit("1+1").all().get();
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/14dd5215/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5TestBase.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5TestBase.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5TestBase.java
new file mode 100644
index 0000000..ccf6f9f
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5TestBase.java
@@ -0,0 +1,130 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.tinkerpop.gremlin.server;
+
+import org.apache.kerby.kerberos.kerb.KrbException;
+import org.apache.kerby.kerberos.kerb.server.LoginTestBase;
+import org.apache.kerby.kerberos.kerb.server.TestKdcServer;
+import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
+
+import java.io.File;
+import java.net.Inet4Address;
+import java.net.UnknownHostException;
+import java.util.*;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.rules.TestName;
+import org.slf4j.LoggerFactory;
+
+
+/**
+ * @author Marc de Lignie
+ */
+public class AuthKrb5TestBase extends LoginTestBase {
+ private static final org.slf4j.Logger logger = LoggerFactory.getLogger(AuthKrb5TestBase.class);
+
+ private String safeHostname = null;
+ private String safeServerPrincipal = null;
+
+ public AuthKrb5TestBase() {
+ // Hostname setting must be consistent with the way gremlin-console sets gremlin-server's hostname
+ // and derives gremlin-server's principal name. Also, the hostname needs to be lowercase for use
+ // in principal names.
+ try {
+ safeHostname = Inet4Address.getLocalHost().getCanonicalHostName().toLowerCase();
+ safeServerPrincipal = getServerPrincipalName() + "/" + getHostname() + "@" + TestKdcServer.KDC_REALM;
+ } catch (UnknownHostException e) {
+ logger.error("Hostname not found");
+ }
+ }
+
+ @Rule
+ public TestName name = new TestName();
+
+ @Override
+ protected String getHostname() {
+ return safeHostname;
+ }
+
+ @Override
+ protected String getServerPrincipal() { return safeServerPrincipal; }
+
+ @Override
+ protected void createPrincipals() throws KrbException {
+ getKdcServer().createPrincipals(getServerPrincipal());
+ getKdcServer().createPrincipal(getClientPrincipal(), getClientPassword());
+ }
+
+ @Override
+ protected void deletePrincipals() throws KrbException {
+ getKdcServer().getKadmin().deleteBuiltinPrincipals();
+ getKdcServer().deletePrincipals(getServerPrincipal());
+ getKdcServer().deletePrincipal(getClientPrincipal());
+ }
+
+ protected class GremlinServerAuthKrb5Integrate extends AbstractGremlinServerIntegrationTest {
+
+ final String principal;
+ final File keytabFile;
+
+ GremlinServerAuthKrb5Integrate(String principal, File keytabFile) {
+ this.principal = principal;
+ this.keytabFile = keytabFile;
+ }
+
+ @Override
+ public Settings overrideSettings(final Settings settings) {
+ settings.host = getHostname();
+ logger.debug("Hostname: " + settings.host);
+ final Settings.AuthenticationSettings authSettings = new Settings.AuthenticationSettings();
+ authSettings.className = Krb5Authenticator.class.getName();
+ final Map authConfig = new HashMap<String,Object>();
+ authConfig.put("keytab", keytabFile.getAbsolutePath());
+ authConfig.put("principal", principal);
+ authSettings.config = authConfig;
+ settings.authentication = authSettings;
+ final Settings.SslSettings sslConfig = new Settings.SslSettings();
+ sslConfig.enabled = false;
+ settings.ssl = sslConfig;
+
+// switch (nameOfTest) {
+// case "shouldAuthenticateOverSslWithKerberosTicket":
+// case "shouldFailIfSslEnabledOnServerButNotClient":
+// final Settings.SslSettings sslConfig = new Settings.SslSettings();
+// sslConfig.enabled = true;
+// settings.ssl = sslConfig;
+// break;
+// }
+ return settings;
+ }
+ }
+
+ @Before
+ @Override
+ public void setUp() throws Exception {
+ logger.info("Starting " + name.getMethodName());
+ super.setUp();
+ loginServiceUsingKeytab();
+ loginClientUsingTicketCache();
+ final String buildDir = System.getProperty("build.dir");
+ System.setProperty("java.security.auth.login.config", buildDir +
+ "/test-classes/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf");
+ }
+}
[06/27] tinkerpop git commit: Verified and documented proper usage of
sasl configuration properties
Posted by sp...@apache.org.
Verified and documented proper usage of sasl configuration properties
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/972b5587
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/972b5587
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/972b5587
Branch: refs/heads/master
Commit: 972b558781679c2e389aee853ebef36e7d9bcc30
Parents: 14dd521
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Tue Dec 13 17:30:42 2016 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 19:58:48 2017 +0100
----------------------------------------------------------------------
.../gremlin/server/auth/Krb5Authenticator.java | 19 +++++++----------
.../tinkerpop/gremlin/server/AuthKrb5Test.java | 22 ++++++++++++++++++--
2 files changed, 28 insertions(+), 13 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/972b5587/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
index 0f71b94..57a4259 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
@@ -113,20 +113,20 @@ public class Krb5Authenticator implements Authenticator {
* http://www.roguelynn.com/words/explain-like-im-5-kerberos/
*/
private class Krb5SaslAuthenticator implements Authenticator.SaslNegotiator, CallbackHandler {
- private static final String mechanism = "GSSAPI";
- private static final String gremlinQOP = "auth";
+ private final String mechanism = "GSSAPI";
private SaslServer saslServer;
Krb5SaslAuthenticator() {
try {
- final Map props = new HashMap<String, Object>();
- // Set secure values for relevant sasl properties regarding GSSAPI, see:
+ // For sasl properties regarding GSSAPI, see:
// https://docs.oracle.com/javase/8/docs/technotes/guides/security/sasl/sasl-refguide.html#SERVER
// Rely on GSSAPI defaults for Sasl.MAX_BUFFER and "javax.security.sasl.sendmaxbuffer"
- // ToDo: check impact of policies on a system with cyrus sasl
-// props.put(Sasl.POLICY_NOANONYMOUS, System.getProperty(Sasl.POLICY_NOANONYMOUS, "true"));
-// props.put(Sasl.POLICY_NOACTIVE, System.getProperty(Sasl.POLICY_NOACTIVE, "true"));
-// props.put(Sasl.POLICY_NOPLAINTEXT, System.getProperty(Sasl.POLICY_NOPLAINTEXT, "true"));
+ // Sasl policy properties are not relevant here, because the sasl mechanisme is not negotiated
+ // Kerberos implementations do not handle Sasl.QOP values reliably; rather use SSL for enhanced privacy,
+ // see https://issues.apache.org/jira/browse/HIVE-8377
+ final Map props = new HashMap<String, Object>();
+ if (!System.getProperty(Sasl.QOP, "").equals(""))
+ logger.warn("Gremlin server uses default Sasl.QOP values, use SSL for enhanced privacy");
final String[] principalParts = principalName.split("/|@");
if (principalParts.length < 3) throw new IllegalArgumentException("Use principal name of format 'service/fqdn@kdcrealm'");
saslServer = Sasl.createSaslServer(mechanism, principalParts[0], principalParts[1], props, Krb5SaslAuthenticator.this);
@@ -134,9 +134,6 @@ public class Krb5Authenticator implements Authenticator {
logger.error("Creating sasl server failed: ", e);
}
logger.debug("SaslServer created with: " + saslServer.getMechanismName());
- // ToDo: investigate use of Sasl.QoP values, also on a system with cyrus sasl
- // if (!System.getProperty(Sasl.QOP).equals(gremlinQOP))
- // logger.warn("Gremlin server with libgsasl does not support Sasl.QOP security layer features, use SSL");
}
/*
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/972b5587/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
index 223b572..b87c170 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
@@ -204,6 +204,26 @@ public class AuthKrb5Test extends AuthKrb5TestBase {
server.tearDown();
}
+ @Test
+ public void shouldAuthenticateWithQop() throws Exception {
+ server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
+ server.setUp();
+ final String oldQop = System.getProperty("javax.security.sasl.qop", "");
+ System.setProperty("javax.security.sasl.qop", "auth-conf");
+ final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
+ .protocol(getServerPrincipalName()).addContactPoint(getHostname()).create();
+ final Client client = cluster.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ server.tearDown();
+ System.setProperty("javax.security.sasl.qop", oldQop);
+ }
+ }
+
// ToDo: Unclear how to test this
// @Test
// public void shouldFailWithAuthIdUnequalAuthzId() throws Exception {
@@ -234,6 +254,4 @@ public class AuthKrb5Test extends AuthKrb5TestBase {
// cluster.close();
// }
// }
-
- // ToDo: test with System.setProperty("javax.security.sasl.qop", "auth-conf");
}
[22/27] tinkerpop git commit: Restored gremlin-driver behavior
regarding GSSAPI mechanism
Posted by sp...@apache.org.
Restored gremlin-driver behavior regarding GSSAPI mechanism
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/4e40df95
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/4e40df95
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/4e40df95
Branch: refs/heads/master
Commit: 4e40df950499da257628ef2bfa8583c85d66fcfe
Parents: 0e299b0
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Thu Feb 2 18:53:11 2017 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Thu Feb 2 18:53:11 2017 +0100
----------------------------------------------------------------------
CHANGELOG.asciidoc | 1 -
.../org/apache/tinkerpop/gremlin/driver/Handler.java | 13 +++++++++----
.../server/GremlinServerAuditLogIntegrateTest.java | 14 +++++++-------
.../server/GremlinServerAuthIntegrateTest.java | 4 +++-
.../server/GremlinServerAuthKrb5IntegrateTest.java | 3 ++-
.../server/GremlinServerAuthOldIntegrateTest.java | 4 +++-
6 files changed, 24 insertions(+), 15 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/4e40df95/CHANGELOG.asciidoc
----------------------------------------------------------------------
diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
index 96e5a04..f618db4 100644
--- a/CHANGELOG.asciidoc
+++ b/CHANGELOG.asciidoc
@@ -64,7 +64,6 @@ TinkerPop 3.3.0 (Release Date: NOT OFFICIALLY RELEASED YET)
* Added `skip(long)` and `skip((Scope,long)` which call the `range(low,high)` equivalents with -1 as the high.
* Added Kerberos authentication to `gremlin-server` for websockets and nio transport.
* Added audit logging of authenticated users and gremlin queries to `gremlin-server`.
-* Fixed `gremlin-driver`'s support for string results regarding returned byte arrays from `Sasl` authentication.
TinkerPop 3.2.0 (Nine Inch Gremlins)
------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/4e40df95/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Handler.java
----------------------------------------------------------------------
diff --git a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Handler.java b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Handler.java
index 8d9cdfc..096cc21 100644
--- a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Handler.java
+++ b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Handler.java
@@ -176,12 +176,17 @@ final class Handler {
/**
* Work out the Sasl mechanism based on the user supplied parameters.
- * If we have a JAAS entry use GSSAPI otherwise PLAIN.
- * Use of additional mechanisms (CRAM-MD5, DIGEST-MD5, EXTERNAL) requires the server to return the
- * mechanism(s) it supports, so that getMechanism can get the negotiated mechanism from SaslClient.
+ * If we have a username and password use PLAIN otherwise GSSAPI
+ * ToDo: have gremlin-server provide the mechanism(s) it is configured with, so that additional mechanisms can
+ * be supported in the driver and confusing GSSException messages from the driver are avoided
*/
private String getMechanism() {
- return (authProps.get(AuthProperties.Property.JAAS_ENTRY) != null) ? "GSSAPI" : "PLAIN";
+ if ((authProps.get(AuthProperties.Property.USERNAME) != null) &&
+ (authProps.get(AuthProperties.Property.PASSWORD) != null)) {
+ return "PLAIN";
+ } else {
+ return "GSSAPI";
+ }
}
}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/4e40df95/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
index dce159b..d2d764c 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
@@ -295,13 +295,13 @@ public class GremlinServerAuditLogIntegrateTest extends AbstractGremlinServerInt
final HttpGet httpget = new HttpGet(TestClientFactory.createURLString("?gremlin=1-1"));
httpget.addHeader("Authorization", "Basic " + encoder.encodeToString("stephen:password".getBytes()));
- final CloseableHttpResponse response = httpclient.execute(httpget);
- assertEquals(200, response.getStatusLine().getStatusCode());
- assertEquals("application/json", response.getEntity().getContentType().getValue());
- final String json = EntityUtils.toString(response.getEntity());
- final JsonNode node = mapper.readTree(json);
- response.close();
- assertEquals(0, node.get("result").get("data").get(0).intValue());
+ try (final CloseableHttpResponse response = httpclient.execute(httpget)) {
+ assertEquals(200, response.getStatusLine().getStatusCode());
+ assertEquals("application/json", response.getEntity().getContentType().getValue());
+ final String json = EntityUtils.toString(response.getEntity());
+ final JsonNode node = mapper.readTree(json);
+ assertEquals(0, node.get("result").get("data").get(0).intValue());
+ }
final List<LoggingEvent> log = recordingAppender.getEvents();
final Stream<LoggingEvent> auditEvents = log.stream().filter(event -> event.getLoggerName().equals(AUDIT_LOGGER_NAME));
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/4e40df95/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthIntegrateTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthIntegrateTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthIntegrateTest.java
index 1c5188d..574c789 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthIntegrateTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthIntegrateTest.java
@@ -23,6 +23,7 @@ import org.apache.tinkerpop.gremlin.driver.Client;
import org.apache.tinkerpop.gremlin.driver.Cluster;
import org.apache.tinkerpop.gremlin.driver.exception.ResponseException;
import org.apache.tinkerpop.gremlin.server.auth.SimpleAuthenticator;
+import org.ietf.jgss.GSSException;
import org.junit.Test;
import java.util.HashMap;
@@ -35,6 +36,7 @@ import org.apache.tinkerpop.gremlin.driver.ser.Serializers;
import static org.hamcrest.CoreMatchers.startsWith;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
/**
@@ -127,7 +129,7 @@ public class GremlinServerAuthIntegrateTest extends AbstractGremlinServerIntegra
fail("This should not succeed as the client did not provide credentials");
} catch(Exception ex) {
final Throwable root = ExceptionUtils.getRootCause(ex);
- assertEquals(ResponseException.class, root.getClass());
+ assertTrue(root instanceof ResponseException || root instanceof GSSException);
} finally {
cluster.close();
}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/4e40df95/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
index 4cd7a4f..7211eb3 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
@@ -27,6 +27,7 @@ import org.apache.tinkerpop.gremlin.driver.exception.ResponseException;
import org.apache.tinkerpop.gremlin.driver.ser.GryoMessageSerializerV1d0;
import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
import org.apache.tinkerpop.gremlin.util.Log4jRecordingAppender;
+import org.ietf.jgss.GSSException;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
@@ -154,7 +155,7 @@ public class GremlinServerAuthKrb5IntegrateTest extends AbstractGremlinServerInt
fail("This should not succeed as the client config does not contain a JaasEntry");
} catch(Exception ex) {
final Throwable root = ExceptionUtils.getRootCause(ex);
- assertEquals(ResponseException.class, root.getClass());
+ assertTrue(root instanceof ResponseException || root instanceof GSSException);
} finally {
cluster.close();
}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/4e40df95/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthOldIntegrateTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthOldIntegrateTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthOldIntegrateTest.java
index f0e2104..5313bda 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthOldIntegrateTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthOldIntegrateTest.java
@@ -24,6 +24,7 @@ import org.apache.tinkerpop.gremlin.driver.Cluster;
import org.apache.tinkerpop.gremlin.driver.exception.ResponseException;
import org.apache.tinkerpop.gremlin.driver.ser.Serializers;
import org.apache.tinkerpop.gremlin.server.auth.SimpleAuthenticator;
+import org.ietf.jgss.GSSException;
import org.junit.Test;
import java.util.HashMap;
@@ -34,6 +35,7 @@ import java.util.concurrent.TimeoutException;
import static org.hamcrest.CoreMatchers.startsWith;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
/**
@@ -130,7 +132,7 @@ public class GremlinServerAuthOldIntegrateTest extends AbstractGremlinServerInte
fail("This should not succeed as the client did not provide credentials");
} catch(Exception ex) {
final Throwable root = ExceptionUtils.getRootCause(ex);
- assertEquals(ResponseException.class, root.getClass());
+ assertTrue(root instanceof ResponseException || root instanceof GSSException);
// removed this assert as the text of the message changes based on kerberos config - stupid kerberos
// assertThat(root.getMessage(), startsWith("Invalid name provided"));
[12/27] tinkerpop git commit: Added audit logging wih tests and docs
Posted by sp...@apache.org.
Added audit logging wih tests and docs
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/68eff1db
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/68eff1db
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/68eff1db
Branch: refs/heads/master
Commit: 68eff1dbdcca69fe74ba968ff6d30c5db0feeec3
Parents: cb75d9b
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Thu Dec 22 20:33:40 2016 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 20:05:40 2017 +0100
----------------------------------------------------------------------
.../src/reference/gremlin-applications.asciidoc | 1 +
.../tinkerpop/gremlin/server/GremlinServer.java | 1 +
.../tinkerpop/gremlin/server/Settings.java | 5 +
.../gremlin/server/channel/HttpChannelizer.java | 2 +-
.../gremlin/server/channel/NioChannelizer.java | 2 +-
.../server/channel/WebSocketChannelizer.java | 2 +-
.../handler/HttpBasicAuthenticationHandler.java | 19 +-
.../handler/HttpGremlinEndpointHandler.java | 5 +
.../handler/SaslAuthenticationHandler.java | 17 +-
.../server/op/AbstractEvalOpProcessor.java | 6 +
.../kerby/kerberos/kerb/server/KdcTestBase.java | 172 ----------
.../kerberos/kerb/server/LoginTestBase.java | 90 ------
.../kerberos/kerb/server/TestKdcServer.java | 61 ----
.../AbstractGremlinServerIntegrationTest.java | 1 +
.../tinkerpop/gremlin/server/AuditLogTest.java | 322 +++++++++++++++++++
.../tinkerpop/gremlin/server/AuthKrb5Test.java | 172 +++++-----
.../gremlin/server/AuthKrb5TestBase.java | 130 --------
.../tinkerpop/gremlin/server/KdcFixture.java | 152 +++++++++
.../gremlin/util/Log4jRecordingAppender.java | 20 +-
.../src/test/resources/log4j-test.properties | 2 +-
20 files changed, 634 insertions(+), 548 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/docs/src/reference/gremlin-applications.asciidoc
----------------------------------------------------------------------
diff --git a/docs/src/reference/gremlin-applications.asciidoc b/docs/src/reference/gremlin-applications.asciidoc
index 57f43e0..70e46e5 100644
--- a/docs/src/reference/gremlin-applications.asciidoc
+++ b/docs/src/reference/gremlin-applications.asciidoc
@@ -1035,6 +1035,7 @@ The following table describes the various YAML configuration options that Gremli
|=========================================================
|Key |Description |Default
|authentication.className |The fully qualified classname of an `Authenticator` implementation to use. If this setting is not present, then authentication is effectively disabled. |`AllowAllAuthenticator`
+|authentication.enableAuditLog |The available authenticators can issue audit logging messages, binding the authenticated user to his remote socket address and binding requests with a gremlin query to the remote socket address. For privacy reasons, the default value of this setting is false. The audit logging messages are logged at the INFO level via the `audit.org.apache.tinkerpop.gremlin.server` logger, which can be configured using the log4j.properties file. |false
|authentication.config |A `Map` of configuration settings to be passes to the `Authenticator` when it is constructed. The settings available are dependent on the implementation. |_none_
|channelizer |The fully qualified classname of the `Channelizer` implementation to use. A `Channelizer` is a "channel initializer" which Gremlin Server uses to define the type of processing pipeline to use. By allowing different `Channelizer` implementations, Gremlin Server can support different communication protocols (e.g. Websockets, Java NIO, etc.). |`WebSocketChannelizer`
|graphs |A `Map` of `Graph` configuration files where the key of the `Map` becomes the name to which the `Graph` will be bound and the value is the file name of a `Graph` configuration file. |_none_
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/GremlinServer.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/GremlinServer.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/GremlinServer.java
index ed0fd7c..703b7b1 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/GremlinServer.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/GremlinServer.java
@@ -62,6 +62,7 @@ public class GremlinServer {
}
private static final String SERVER_THREAD_PREFIX = "gremlin-server-";
+ public static final String AUDIT_LOGGER_NAME = "audit.org.apache.tinkerpop.gremlin.server";
private static final Logger logger = LoggerFactory.getLogger(GremlinServer.class);
private final Settings settings;
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/Settings.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/Settings.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/Settings.java
index 97e2875..fc0560f 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/Settings.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/Settings.java
@@ -383,6 +383,11 @@ public class Settings {
public String className = AllowAllAuthenticator.class.getName();
/**
+ * Enable audit logging of authenticated users and gremlin evaluation requests.
+ */
+ public boolean enableAuditLog = false;
+
+ /**
* A {@link Map} containing {@link Authenticator} specific configurations. Consult the
* {@link Authenticator} implementation for specifics on what configurations are expected.
*/
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/HttpChannelizer.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/HttpChannelizer.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/HttpChannelizer.java
index 5c632e6..b509e2d 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/HttpChannelizer.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/HttpChannelizer.java
@@ -68,7 +68,7 @@ public class HttpChannelizer extends AbstractChannelizer {
// not occur. It may not be a safe assumption that the handler
// is sharable so create a new handler each time.
authenticationHandler = authenticator.getClass() == AllowAllAuthenticator.class ?
- null : new HttpBasicAuthenticationHandler(authenticator);
+ null : new HttpBasicAuthenticationHandler(authenticator, settings.authentication);
if (authenticationHandler != null)
pipeline.addLast(PIPELINE_AUTHENTICATOR, authenticationHandler);
}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/NioChannelizer.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/NioChannelizer.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/NioChannelizer.java
index d2ba520..4baad23 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/NioChannelizer.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/NioChannelizer.java
@@ -52,7 +52,7 @@ public class NioChannelizer extends AbstractChannelizer {
// configure authentication - null means don't bother to add authentication to the pipeline
if (authenticator != null)
authenticationHandler = authenticator.getClass() == AllowAllAuthenticator.class ?
- null : new SaslAuthenticationHandler(authenticator);
+ null : new SaslAuthenticationHandler(authenticator, settings.authentication);
gremlinResponseFrameEncoder = new GremlinResponseFrameEncoder();
nioGremlinResponseFrameEncoder = new NioGremlinResponseFrameEncoder();
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/WebSocketChannelizer.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/WebSocketChannelizer.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/WebSocketChannelizer.java
index 2373819..ea59e8f 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/WebSocketChannelizer.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/WebSocketChannelizer.java
@@ -67,7 +67,7 @@ public class WebSocketChannelizer extends AbstractChannelizer {
// configure authentication - null means don't bother to add authentication to the pipeline
if (authenticator != null)
authenticationHandler = authenticator.getClass() == AllowAllAuthenticator.class ?
- null : new SaslAuthenticationHandler(authenticator);
+ null : new SaslAuthenticationHandler(authenticator, settings.authentication);
}
@Override
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpBasicAuthenticationHandler.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpBasicAuthenticationHandler.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpBasicAuthenticationHandler.java
index bf3b674..1beb7cf 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpBasicAuthenticationHandler.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpBasicAuthenticationHandler.java
@@ -24,8 +24,13 @@ import io.netty.channel.ChannelInboundHandlerAdapter;
import io.netty.handler.codec.http.DefaultFullHttpResponse;
import io.netty.handler.codec.http.FullHttpMessage;
import io.netty.util.ReferenceCountUtil;
+import org.apache.tinkerpop.gremlin.server.GremlinServer;
+import org.apache.tinkerpop.gremlin.server.Settings;
+import org.apache.tinkerpop.gremlin.server.auth.AuthenticatedUser;
import org.apache.tinkerpop.gremlin.server.auth.AuthenticationException;
import org.apache.tinkerpop.gremlin.server.auth.Authenticator;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
import java.nio.charset.Charset;
import java.util.Base64;
@@ -43,12 +48,17 @@ import static org.apache.tinkerpop.gremlin.groovy.plugin.dsl.credential.Credenti
* @author Stephen Mallette (http://stephen.genoprime.com)
*/
public class HttpBasicAuthenticationHandler extends ChannelInboundHandlerAdapter {
+ private static final Logger logger = LoggerFactory.getLogger(HttpBasicAuthenticationHandler.class);
+ private static final Logger auditLogger = LoggerFactory.getLogger(GremlinServer.AUDIT_LOGGER_NAME);
private final Authenticator authenticator;
+ private final Settings.AuthenticationSettings authenticationSettings;
private final Base64.Decoder decoder = Base64.getUrlDecoder();
- public HttpBasicAuthenticationHandler(final Authenticator authenticator) {
+ public HttpBasicAuthenticationHandler(final Authenticator authenticator,
+ final Settings.AuthenticationSettings authenticationSettings) {
this.authenticator = authenticator;
+ this.authenticationSettings = authenticationSettings;
}
@Override
@@ -92,6 +102,13 @@ public class HttpBasicAuthenticationHandler extends ChannelInboundHandlerAdapter
try {
authenticator.authenticate(credentials);
ctx.fireChannelRead(request);
+
+ // User name logged with the remote socket address and authenticator classname for audit logging
+ if (authenticationSettings.enableAuditLog) {
+ String[] authClassParts = authenticator.getClass().toString().split("[.]");
+ auditLogger.info("User {} with address {} authenticated by {}", credentials.get(PROPERTY_USERNAME),
+ ctx.channel().remoteAddress().toString().substring(1), authClassParts[authClassParts.length - 1]);
+ }
} catch (AuthenticationException ae) {
sendError(ctx, msg);
}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpGremlinEndpointHandler.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpGremlinEndpointHandler.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpGremlinEndpointHandler.java
index ad11834..2afe4b5 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpGremlinEndpointHandler.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpGremlinEndpointHandler.java
@@ -100,6 +100,7 @@ import static io.netty.handler.codec.http.HttpVersion.HTTP_1_1;
@ChannelHandler.Sharable
public class HttpGremlinEndpointHandler extends ChannelInboundHandlerAdapter {
private static final Logger logger = LoggerFactory.getLogger(HttpGremlinEndpointHandler.class);
+ private static final Logger auditLogger = LoggerFactory.getLogger(GremlinServer.AUDIT_LOGGER_NAME);
private static final Charset UTF8 = Charset.forName("UTF-8");
static final Meter errorMeter = MetricManager.INSTANCE.getMeter(name(GremlinServer.class, "errors"));
@@ -188,6 +189,10 @@ public class HttpGremlinEndpointHandler extends ChannelInboundHandlerAdapter {
try {
logger.debug("Processing request containing script [{}] and bindings of [{}] on {}",
requestArguments.getValue0(), requestArguments.getValue1(), Thread.currentThread().getName());
+ if (settings.authentication.enableAuditLog) {
+ final String address = ctx.channel().remoteAddress().toString().substring(1);
+ auditLogger.info("User with address {} requested: {}", address, requestArguments.getValue0());
+ }
final ChannelPromise promise = ctx.channel().newPromise();
final AtomicReference<Object> resultHolder = new AtomicReference<>();
promise.addListener(future -> {
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/SaslAuthenticationHandler.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/SaslAuthenticationHandler.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/SaslAuthenticationHandler.java
index 6cb0ddb..0878246 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/SaslAuthenticationHandler.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/SaslAuthenticationHandler.java
@@ -35,6 +35,8 @@ import org.apache.tinkerpop.gremlin.driver.Tokens;
import org.apache.tinkerpop.gremlin.driver.message.RequestMessage;
import org.apache.tinkerpop.gremlin.driver.message.ResponseMessage;
import org.apache.tinkerpop.gremlin.driver.message.ResponseStatusCode;
+import org.apache.tinkerpop.gremlin.server.GremlinServer;
+import org.apache.tinkerpop.gremlin.server.Settings;
import org.apache.tinkerpop.gremlin.server.auth.AuthenticatedUser;
import org.apache.tinkerpop.gremlin.server.auth.AuthenticationException;
import org.apache.tinkerpop.gremlin.server.auth.Authenticator;
@@ -55,11 +57,14 @@ public class SaslAuthenticationHandler extends ChannelInboundHandlerAdapter {
private static final Logger logger = LoggerFactory.getLogger(SaslAuthenticationHandler.class);
private static final Base64.Decoder BASE64_DECODER = Base64.getDecoder();
private static final Base64.Encoder BASE64_ENCODER = Base64.getEncoder();
+ private static final Logger auditLogger = LoggerFactory.getLogger(GremlinServer.AUDIT_LOGGER_NAME);
private final Authenticator authenticator;
+ private final Settings.AuthenticationSettings authenticationSettings;
- public SaslAuthenticationHandler(final Authenticator authenticator) {
+ public SaslAuthenticationHandler(final Authenticator authenticator, final Settings.AuthenticationSettings authenticationSettings) {
this.authenticator = authenticator;
+ this.authenticationSettings = authenticationSettings;
}
@Override
@@ -93,13 +98,17 @@ public class SaslAuthenticationHandler extends ChannelInboundHandlerAdapter {
ctx.writeAndFlush(error);
return;
}
-
+
try {
final byte[] saslMessage = negotiator.get().evaluateResponse(saslResponse);
if (negotiator.get().isComplete()) {
- // todo: do something with this user
final AuthenticatedUser user = negotiator.get().getAuthenticatedUser();
-
+ // User name logged with the remote socket address and authenticator classname for audit logging
+ if (authenticationSettings.enableAuditLog) {
+ String[] authClassParts = authenticator.getClass().toString().split("[.]");
+ auditLogger.info("User {} with address {} authenticated by {}", user.getName(),
+ ctx.channel().remoteAddress().toString().substring(1), authClassParts[authClassParts.length - 1]);
+ }
// If we have got here we are authenticated so remove the handler and pass
// the original message down the pipeline for processing
ctx.pipeline().remove(this);
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/op/AbstractEvalOpProcessor.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/op/AbstractEvalOpProcessor.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/op/AbstractEvalOpProcessor.java
index 48de830..baff5b7 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/op/AbstractEvalOpProcessor.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/op/AbstractEvalOpProcessor.java
@@ -46,6 +46,7 @@ import org.slf4j.LoggerFactory;
import javax.script.Bindings;
import javax.script.SimpleBindings;
+import java.net.SocketAddress;
import java.util.Arrays;
import java.util.HashSet;
import java.util.Iterator;
@@ -67,6 +68,7 @@ import static com.codahale.metrics.MetricRegistry.name;
*/
public abstract class AbstractEvalOpProcessor extends AbstractOpProcessor {
private static final Logger logger = LoggerFactory.getLogger(AbstractEvalOpProcessor.class);
+ private static final Logger auditLogger = LoggerFactory.getLogger(GremlinServer.AUDIT_LOGGER_NAME);
public static final Timer evalOpTimer = MetricManager.INSTANCE.getTimer(name(GremlinServer.class, "op", "eval"));
/**
@@ -243,6 +245,10 @@ public abstract class AbstractEvalOpProcessor extends AbstractOpProcessor {
final Iterator itty = IteratorUtils.asIterator(o);
logger.debug("Preparing to iterate results from - {} - in thread [{}]", msg, Thread.currentThread().getName());
+ if (settings.authentication.enableAuditLog) {
+ final String address = context.getChannelHandlerContext().channel().remoteAddress().toString().substring(1);
+ auditLogger.info("User with address {} requested: {}", address, script);
+ }
try {
handleIterator(context, itty);
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
deleted file mode 100644
index 15663cb..0000000
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
+++ /dev/null
@@ -1,172 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.kerby.kerberos.kerb.server;
-
-import org.apache.kerby.kerberos.kerb.KrbException;
-import org.apache.kerby.kerberos.kerb.client.KrbClient;
-import org.apache.kerby.kerberos.kerb.client.KrbPkinitClient;
-import org.apache.kerby.kerberos.kerb.client.KrbTokenClient;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-
-import java.io.File;
-import java.io.IOException;
-
-/*
- * This file is based on:
- * https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/
- * kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
- * but with the following changes:
- * - added this comment
- * - made allowUdp() return false because of issues with UDP in the RC2 release, see directory-kerby on JIRA
- *
- * See also: gremlin-server/src/main/static/NOTICE
- */
-public abstract class KdcTestBase {
- private static File testDir;
-
- private final String clientPassword = "123456";
- private final String hostname = "localhost";
- private final String clientPrincipalName = "drankye";
- private final String clientPrincipal =
- clientPrincipalName + "@" + TestKdcServer.KDC_REALM;
- private final String serverPrincipalName = "test-service";
- private final String serverPrincipal =
- serverPrincipalName + "/" + hostname + "@" + TestKdcServer.KDC_REALM;
-
- private SimpleKdcServer kdcServer;
-
- @BeforeClass
- public static void createTestDir() throws IOException {
- String basedir = System.getProperty("basedir");
- if (basedir == null) {
- basedir = new File(".").getCanonicalPath();
- }
- File targetdir = new File(basedir, "target");
- testDir = new File(targetdir, "tmp");
- testDir.mkdirs();
- }
-
- @AfterClass
- public static void deleteTestDir() throws IOException {
- testDir.delete();
- }
-
- protected File getTestDir() {
- return testDir;
- }
-
- protected SimpleKdcServer getKdcServer() {
- return kdcServer;
- }
-
- protected KrbClient getKrbClient() {
- return kdcServer.getKrbClient();
- }
-
- protected KrbPkinitClient getPkinitClient() {
- return kdcServer.getPkinitClient();
- }
-
- protected KrbTokenClient getTokenClient() {
- return kdcServer.getTokenClient();
- }
-
- protected String getClientPrincipalName() {
- return clientPrincipalName;
- }
-
- protected String getClientPrincipal() {
- return clientPrincipal;
- }
-
- protected String getServerPrincipalName() {
- return serverPrincipalName;
- }
-
- protected String getClientPassword() {
- return clientPassword;
- }
-
- protected String getServerPrincipal() {
- return serverPrincipal;
- }
-
- protected String getHostname() {
- return hostname;
- }
-
- protected boolean allowUdp() {
- return false;
- } // originally: true
-
- protected boolean allowTcp() {
- return true;
- }
-
- @Before
- public void setUp() throws Exception {
- setUpKdcServer();
-
- createPrincipals();
-
- setUpClient();
- }
-
- protected void prepareKdc() throws KrbException {
- kdcServer.init();
- }
-
- protected void configKdcSeverAndClient() {
- kdcServer.setWorkDir(testDir);
- }
-
- protected void setUpKdcServer() throws Exception {
- kdcServer = new TestKdcServer(allowTcp(), allowUdp());
-
- configKdcSeverAndClient();
-
- prepareKdc();
-
- kdcServer.start();
- }
-
- protected void setUpClient() throws Exception {
- }
-
- protected void createPrincipals() throws KrbException {
- kdcServer.createPrincipals(serverPrincipal);
- kdcServer.createPrincipal(clientPrincipal, clientPassword);
- }
-
- protected void deletePrincipals() throws KrbException {
- kdcServer.getKadmin().deleteBuiltinPrincipals();
- kdcServer.deletePrincipals(serverPrincipal);
- kdcServer.deletePrincipal(clientPrincipal);
- }
-
- @After
- public void tearDown() throws Exception {
- deletePrincipals();
- kdcServer.stop();
- }
-}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
deleted file mode 100644
index ed805fa..0000000
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
+++ /dev/null
@@ -1,90 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.kerby.kerberos.kerb.server;
-
-import org.apache.kerby.kerberos.kerb.client.JaasKrbUtil;
-import org.apache.kerby.kerberos.kerb.type.ticket.TgtTicket;
-
-import javax.security.auth.Subject;
-import javax.security.auth.login.LoginException;
-import java.io.File;
-import java.security.Principal;
-import java.util.Set;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-import org.junit.After;
-import org.junit.Before;
-
-/*
- * Except for this comment and the removal of the org.assertj.core.api.Assertions.assertThat import statement,
- * this file is a literal copy from:
- * https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/
- * kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
- *
- * See also: gremlin-server/src/main/static/NOTICE
- */
-public class LoginTestBase extends KdcTestBase {
-
- protected File ticketCacheFile;
- protected File serviceKeytabFile;
-
- @Before
- @Override
- public void setUp() throws Exception {
- super.setUp();
-
- ticketCacheFile = new File(getTestDir(), "test-tkt.cc");
- serviceKeytabFile = new File(getTestDir(), "test-service.keytab");
- }
-
- protected Subject loginClientUsingPassword() throws LoginException {
- return JaasKrbUtil.loginUsingPassword(getClientPrincipal(),
- getClientPassword());
- }
-
- protected Subject loginClientUsingTicketCache() throws Exception {
- TgtTicket tgt = getKrbClient().requestTgt(getClientPrincipal(),
- getClientPassword());
- getKrbClient().storeTicket(tgt, ticketCacheFile);
-
- return JaasKrbUtil.loginUsingTicketCache(getClientPrincipal(),
- ticketCacheFile);
- }
-
- protected Subject loginServiceUsingKeytab() throws Exception {
- getKdcServer().exportPrincipal(getServerPrincipal(), serviceKeytabFile);
- return JaasKrbUtil.loginUsingKeytab(getServerPrincipal(),
- serviceKeytabFile);
- }
-
- protected void checkSubject(Subject subject) {
- Set<Principal> clientPrincipals = subject.getPrincipals();
- assertThat("The subject has minimally one principal", clientPrincipals.size() > 0);
- }
-
- @After
- @Override
- public void tearDown() throws Exception {
- ticketCacheFile.delete();
- serviceKeytabFile.delete();
-
- super.tearDown();
- }
-}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java
deleted file mode 100644
index 3addc88..0000000
--- a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java
+++ /dev/null
@@ -1,61 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.kerby.kerberos.kerb.server;
-
-import org.apache.kerby.kerberos.kerb.KrbException;
-import org.apache.kerby.kerberos.kerb.client.KrbClient;
-import org.apache.kerby.kerberos.kerb.client.KrbConfig;
-import org.apache.kerby.kerberos.kerb.client.KrbConfigKey;
-import org.apache.kerby.util.NetworkUtil;
-
-/*
- * Except for this comment, this file is a literal copy from:
- * https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/
- * kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java
- *
- * See also: gremlin-server/src/main/static/NOTICE
- */
-public class TestKdcServer extends SimpleKdcServer {
- public static final String KDC_REALM = "TEST.COM";
- public static final String HOSTNAME = "localhost";
-
- public TestKdcServer(boolean allowTcp, boolean allowUdp) throws KrbException {
- super();
-
- setKdcRealm(KDC_REALM);
- setKdcHost(HOSTNAME);
- setAllowTcp(allowTcp);
- setAllowUdp(allowUdp);
-
- if (allowTcp) {
- setKdcTcpPort(NetworkUtil.getServerPort());
- }
- if (allowUdp) {
- setKdcUdpPort(NetworkUtil.getServerPort());
- }
-
- KrbClient krbClnt = getKrbClient();
- KrbConfig krbConfig = krbClnt.getKrbConfig();
- krbConfig.setString(KrbConfigKey.PERMITTED_ENCTYPES,
- "aes128-cts-hmac-sha1-96 des-cbc-crc des-cbc-md5 des3-cbc-sha1");
-
- krbClnt.setTimeout(10 * 1000);
- }
-}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AbstractGremlinServerIntegrationTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AbstractGremlinServerIntegrationTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AbstractGremlinServerIntegrationTest.java
index 12fadb6..56a599f 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AbstractGremlinServerIntegrationTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AbstractGremlinServerIntegrationTest.java
@@ -18,6 +18,7 @@
*/
package org.apache.tinkerpop.gremlin.server;
+import org.apache.tinkerpop.gremlin.util.Log4jRecordingAppender;
import org.junit.After;
import org.junit.Before;
import org.junit.Rule;
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuditLogTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuditLogTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuditLogTest.java
new file mode 100644
index 0000000..d8337e8
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuditLogTest.java
@@ -0,0 +1,322 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.tinkerpop.gremlin.server;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.util.EntityUtils;
+import org.apache.log4j.Logger;
+import org.apache.log4j.spi.LoggingEvent;
+import static org.apache.log4j.Level.INFO;
+import org.apache.tinkerpop.gremlin.driver.Client;
+import org.apache.tinkerpop.gremlin.driver.Cluster;
+import org.apache.tinkerpop.gremlin.driver.Channelizer;
+import org.apache.tinkerpop.gremlin.server.channel.HttpChannelizer;
+import org.apache.tinkerpop.gremlin.server.channel.NioChannelizer;
+import org.apache.tinkerpop.shaded.jackson.databind.JsonNode;
+import org.apache.tinkerpop.shaded.jackson.databind.ObjectMapper;
+import org.apache.tinkerpop.gremlin.server.auth.AllowAllAuthenticator;
+import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
+import org.apache.tinkerpop.gremlin.server.auth.SimpleAuthenticator;
+import static org.apache.tinkerpop.gremlin.server.AuthKrb5Test.TESTCONSOLE;
+import static org.apache.tinkerpop.gremlin.server.GremlinServer.AUDIT_LOGGER_NAME;
+import org.apache.tinkerpop.gremlin.util.Log4jRecordingAppender;
+import org.slf4j.LoggerFactory;
+
+import java.util.Base64;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import java.util.stream.Stream;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+
+/**
+ * @author Marc de Lignie
+ *
+ * Note: like other descendents of AbstractGremlinServerIntegrationTest this testsuite assumes that tests are
+ * run sequentially and thus the server variable can be reused.
+ */
+public class AuditLogTest extends AbstractGremlinServerIntegrationTest {
+ private static final org.slf4j.Logger logger = LoggerFactory.getLogger(AuditLogTest.class);
+ private Log4jRecordingAppender recordingAppender = null;
+
+ private final ObjectMapper mapper = new ObjectMapper();
+ private final Base64.Encoder encoder = Base64.getUrlEncoder();
+
+ private static final boolean AUDIT_LOG_ENABLED = true;
+ private static final boolean AUDIT_LOG_DISABLED = false;
+
+ private KdcFixture kdcServer;
+
+ @Before
+ @Override
+ public void setUp() throws Exception {
+ try {
+ final String buildDir = System.getProperty("build.dir");
+ kdcServer = new KdcFixture(buildDir +
+ "/test-classes/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf");
+ kdcServer.setUp();
+ } catch(Exception e) {
+ logger.warn(e.getMessage());
+ }
+ super.setUp();
+ }
+
+ @Before
+ public void setupForEachTest() {
+ recordingAppender = new Log4jRecordingAppender();
+ final Logger rootLogger = Logger.getRootLogger();
+ rootLogger.addAppender(recordingAppender);
+ }
+
+ @After
+ public void teardownForEachTest() {
+ final Logger rootLogger = Logger.getRootLogger();
+ rootLogger.removeAppender(recordingAppender);
+ }
+
+ /**
+ * Configure specific Gremlin Server settings for specific tests.
+ */
+ @Override
+ public Settings overrideSettings(final Settings settings) {
+ settings.host = kdcServer.hostname;
+ final Settings.SslSettings sslConfig = new Settings.SslSettings();
+ sslConfig.enabled = false;
+ settings.ssl = sslConfig;
+ final Settings.AuthenticationSettings authSettings = new Settings.AuthenticationSettings();
+ settings.authentication = authSettings;
+ authSettings.enableAuditLog = AUDIT_LOG_ENABLED;
+ authSettings.className = Krb5Authenticator.class.getName();
+ final Map<String,Object> authConfig = new HashMap<>();
+ authSettings.config = authConfig;
+
+ final String nameOfTest = name.getMethodName();
+ switch (nameOfTest) {
+ case "shouldAuditLogWithAllowAllAuthenticator":
+ authSettings.className = AllowAllAuthenticator.class.getName();
+ break;
+ case "shouldAuditLogWithSimpleAuthenticator":
+ authSettings.className = SimpleAuthenticator.class.getName();
+ authConfig.put(SimpleAuthenticator.CONFIG_CREDENTIALS_DB, "conf/tinkergraph-credentials.properties");
+ break;
+ case "shouldNotAuditLogWhenDisabled":
+ authSettings.enableAuditLog = AUDIT_LOG_DISABLED;
+ case "shouldAuditLogWithKrb5Authenticator":
+ authConfig.put("keytab", kdcServer.serviceKeytabFile.getAbsolutePath());
+ authConfig.put("principal", kdcServer.serverPrincipal);
+ break;
+ case "shouldAuditLogWithNioTransport":
+ settings.channelizer = NioChannelizer.class.getName();
+ authConfig.put("keytab", kdcServer.serviceKeytabFile.getAbsolutePath());
+ authConfig.put("principal", kdcServer.serverPrincipal);
+ break;
+ case "shouldAuditLogWithHttpTransport":
+ settings.host = "localhost";
+ settings.channelizer = HttpChannelizer.class.getName();
+ authSettings.className = SimpleAuthenticator.class.getName();
+ authConfig.put(SimpleAuthenticator.CONFIG_CREDENTIALS_DB, "conf/tinkergraph-credentials.properties");
+ break;
+ }
+ return settings;
+ }
+
+ @Test
+ public void shouldAuditLogWithAllowAllAuthenticator() throws Exception {
+
+ final Cluster cluster = TestClientFactory.build().credentials("sdfsdf", "")
+ .addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+
+ // WebSocketChannelizer does not add SaslAuthenticationHandler, so no authenticated user log line available
+ assertTrue(recordingAppender.logMatchesAny(AUDIT_LOGGER_NAME, INFO, "User with address .*? requested: 1\\+1"));
+ assertTrue(recordingAppender.logMatchesAny(AUDIT_LOGGER_NAME, INFO, "User with address .*? requested: 1\\+2"));
+ assertTrue(recordingAppender.logMatchesAny(AUDIT_LOGGER_NAME, INFO, "User with address .*? requested: 1\\+3"));
+ }
+
+ @Test
+ public void shouldAuditLogWithSimpleAuthenticator() throws Exception {
+ final String username = "stephen";
+ final String password = "password";
+
+ final Cluster cluster = TestClientFactory.build().credentials(username, password)
+ .addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+
+ final String simpleAuthenticatorName = SimpleAuthenticator.class.getSimpleName();
+ final String authMsg = recordingAppender.getMessages().stream()
+ .filter( msg -> msg.toString().contains("by " + simpleAuthenticatorName) ).iterator().next();
+ final Matcher m = Pattern.compile(".*?([\\d.:]+).*?").matcher(authMsg);
+ m.find();
+ final String address = m.group(1);
+
+ assertTrue(recordingAppender.logContainsAny(AUDIT_LOGGER_NAME, INFO,
+ String.format("User %s with address %s authenticated by %s", username, address, simpleAuthenticatorName)));
+ assertTrue(recordingAppender.logContainsAny(AUDIT_LOGGER_NAME, INFO,
+ String.format("User with address %s requested: 1+1", address)));
+ assertTrue(recordingAppender.logContainsAny(AUDIT_LOGGER_NAME, INFO,
+ String.format("User with address %s requested: 1+2", address)));
+ assertTrue(recordingAppender.logContainsAny(AUDIT_LOGGER_NAME, INFO,
+ String.format("User with address %s requested: 1+3", address)));
+ }
+
+ @Test
+ public void shouldAuditLogWithKrb5Authenticator() throws Exception {
+ final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+
+ final List<LoggingEvent> log = recordingAppender.getEvents();
+ final Stream<LoggingEvent> auditEvents = log.stream().filter(event -> event.getLoggerName().equals(AUDIT_LOGGER_NAME));
+ final LoggingEvent authEvent = auditEvents
+ .filter(event -> event.getMessage().toString().contains("Krb5Authenticator")).iterator().next();
+ final String authMsg = authEvent.getMessage().toString();
+ final Matcher m = Pattern.compile(".*?([\\d.:]+).*?").matcher(authMsg);
+ m.find();
+ final String address = m.group(1);
+ assertTrue(authEvent.getLevel() == INFO && authMsg.equals(
+ String.format("User %s with address %s authenticated by Krb5Authenticator", kdcServer.clientPrincipalName, address)));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+1", address))));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+2", address))));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+3", address))));
+ }
+
+ @Test
+ public void shouldNotAuditLogWhenDisabled() throws Exception {
+ final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+
+ final List<LoggingEvent> log = recordingAppender.getEvents();
+ assertFalse(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().matches("User .*? with address .*? authenticated by Krb5Authenticator")));
+ assertFalse(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().matches("User with address .*? requested: 1\\+1")));
+ assertFalse(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().matches("User with address .*? requested: 1\\+2")));
+ assertFalse(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().matches("User with address .*? requested: 1\\+3")));
+ }
+
+ @Test
+ public void shouldAuditLogWithNioTransport() throws Exception {
+ // ToDo issue (outside scope of this suite): .channelizer(Channelizer.NioChannelizer.class) fails
+ final Cluster cluster = TestClientFactory.build().channelizer(Channelizer.NioChannelizer.class.getName())
+ .jaasEntry(TESTCONSOLE).protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
+ final Client client = cluster.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+
+ final List<LoggingEvent> log = recordingAppender.getEvents();
+ final Stream<LoggingEvent> auditEvents = log.stream().filter(event -> event.getLoggerName().equals(AUDIT_LOGGER_NAME));
+ final LoggingEvent authEvent = auditEvents
+ .filter(event -> event.getMessage().toString().contains("Krb5Authenticator")).iterator().next();
+ final String authMsg = authEvent.getMessage().toString();
+ final Matcher m = Pattern.compile(".*?([\\d.:]+).*?").matcher(authMsg);
+ m.find();
+ final String address = m.group(1);
+ assertTrue(authEvent.getLevel() == INFO && authMsg.equals(
+ String.format("User %s with address %s authenticated by Krb5Authenticator", kdcServer.clientPrincipalName, address)));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+1", address))));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+2", address))));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1+3", address))));
+ }
+
+ @Test
+ public void shouldAuditLogWithHttpTransport() throws Exception {
+ final CloseableHttpClient httpclient = HttpClients.createDefault();
+ final HttpGet httpget = new HttpGet(TestClientFactory.createURLString("?gremlin=1-1"));
+ httpget.addHeader("Authorization", "Basic " + encoder.encodeToString("stephen:password".getBytes()));
+
+ final CloseableHttpResponse response = httpclient.execute(httpget);
+ assertEquals(200, response.getStatusLine().getStatusCode());
+ assertEquals("application/json", response.getEntity().getContentType().getValue());
+ final String json = EntityUtils.toString(response.getEntity());
+ final JsonNode node = mapper.readTree(json);
+ response.close();
+ assertEquals(0, node.get("result").get("data").get(0).intValue());
+
+ final List<LoggingEvent> log = recordingAppender.getEvents();
+ final Stream<LoggingEvent> auditEvents = log.stream().filter(event -> event.getLoggerName().equals(AUDIT_LOGGER_NAME));
+ final LoggingEvent authEvent = auditEvents
+ .filter(event -> event.getMessage().toString().contains("SimpleAuthenticator")).iterator().next();
+ final String authMsg = authEvent.getMessage().toString();
+ final Matcher m = Pattern.compile(".*?([\\d.:]+).*?").matcher(authMsg);
+ m.find();
+ final String address = m.group(1);
+ assertTrue(authEvent.getLevel() == INFO && authMsg.equals(
+ String.format("User %s with address %s authenticated by SimpleAuthenticator", "stephen", address)));
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == INFO &&
+ item.getMessage().toString().equals(String.format("User with address %s requested: 1-1", address))));
+ }
+
+ //ToDo: test with two clients
+}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
index b87c170..6d596af 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
@@ -19,28 +19,25 @@
package org.apache.tinkerpop.gremlin.server;
import org.apache.commons.lang.exception.ExceptionUtils;
-import org.apache.log4j.AppenderSkeleton;
import org.apache.log4j.Logger;
-import org.apache.log4j.Level;
-import org.apache.log4j.spi.LoggingEvent;
import org.apache.tinkerpop.gremlin.driver.Client;
import org.apache.tinkerpop.gremlin.driver.Cluster;
+import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
+import org.apache.tinkerpop.gremlin.util.Log4jRecordingAppender;
import org.ietf.jgss.GSSException;
import org.junit.After;
import org.junit.Before;
-import org.junit.Rule;
import org.junit.Test;
-import org.apache.tinkerpop.gremlin.driver.Client;
-import org.apache.tinkerpop.gremlin.driver.Cluster;
+import org.slf4j.LoggerFactory;
import java.io.File;
-import java.util.*;
+import java.util.HashMap;
+import java.util.Map;
import javax.security.auth.login.LoginException;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
-import org.junit.Test;
@@ -49,14 +46,84 @@ import org.junit.Test;
*
* Todo: change back to integrate test later on
*/
-public class AuthKrb5Test extends AuthKrb5TestBase {
- // Cannot use mere slf4j because need to check log output
- private final Logger rootLogger = Logger.getRootLogger();
- private final Logger logger = Logger.getLogger(AuthKrb5Test.class);
+public class AuthKrb5Test extends AbstractGremlinServerIntegrationTest {
+ private static final org.slf4j.Logger logger = LoggerFactory.getLogger(AuthKrb5Test.class);
+ private Log4jRecordingAppender recordingAppender = null;
+
+ static final String TESTCONSOLE = "GremlinConsole";
+ static final String TESTCONSOLE_NOT_LOGGED_IN = "UserNotLoggedIn";
+
+ private KdcFixture kdcServer;
+
+ @Before
+ @Override
+ public void setUp() throws Exception {
+ setupForEachTest();
+ try {
+ final String buildDir = System.getProperty("build.dir");
+ kdcServer = new KdcFixture(buildDir +
+ "/test-classes/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf");
+ kdcServer.setUp();
+ } catch(Exception e) {
+ logger.warn(e.getMessage());
+ }
+ super.setUp();
+ }
+
+ public void setupForEachTest() {
+ recordingAppender = new Log4jRecordingAppender();
+ final Logger rootLogger = Logger.getRootLogger();
+ rootLogger.addAppender(recordingAppender);
+ }
- private GremlinServerAuthKrb5Integrate server;
- private static final String TESTCONSOLE = "GremlinConsole";
- private static final String TESTCONSOLE_NOT_LOGGED_IN = "UserNotLoggedIn";
+ @After
+ public void teardownForEachTest() {
+ final Logger rootLogger = Logger.getRootLogger();
+ rootLogger.removeAppender(recordingAppender);
+ }
+
+ /**
+ * Configure specific Gremlin Server settings for specific tests.
+ */
+ @Override
+ public Settings overrideSettings(final Settings settings) {
+ settings.host = kdcServer.hostname;
+ final Settings.SslSettings sslConfig = new Settings.SslSettings();
+ sslConfig.enabled = false;
+ settings.ssl = sslConfig;
+ final Settings.AuthenticationSettings authSettings = new Settings.AuthenticationSettings();
+ settings.authentication = authSettings;
+ authSettings.className = Krb5Authenticator.class.getName();
+ final Map<String,Object> authConfig = new HashMap<>();
+ authConfig.put("principal", kdcServer.serverPrincipal);
+ authConfig.put("keytab", kdcServer.serviceKeytabFile.getAbsolutePath());
+ authSettings.config = authConfig;
+
+ final String nameOfTest = name.getMethodName();
+ switch (nameOfTest) {
+ case "shouldAuthenticateWithDefaults":
+ case "shouldFailWithoutClientJaasEntry":
+ case "shouldFailWithoutClientTicketCache":
+ break;
+ case "shouldFailWithNonexistentServerPrincipal":
+ authConfig.put("principal", "no-service");
+ break;
+ case "shouldFailWithEmptyServerKeytab":
+ final File keytabFile = new File(".", "no-file");
+ authConfig.put("keytab", keytabFile);
+ break;
+ case "shouldFailWithWrongServerKeytab":
+ final String principal = "no-principal/somehost@TEST.COM";
+ try { kdcServer.createPrincipal(principal); } catch(Exception e) {
+ logger.error("Cannot create principal in overrideSettings(): " + e.getMessage());
+ };
+ authConfig.put("principal", principal);
+ break;
+ case "shouldAuthenticateWithQop":
+ break;
+ }
+ return settings;
+ }
/**
* Defaults from TestClientFactory:
@@ -89,10 +156,8 @@ public class AuthKrb5Test extends AuthKrb5TestBase {
*/
@Test
public void shouldAuthenticateWithDefaults() throws Exception {
- server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
- server.setUp();
final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
- .protocol(getServerPrincipalName()).addContactPoint(getHostname()).create();
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
final Client client = cluster.connect();
try {
assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
@@ -100,16 +165,13 @@ public class AuthKrb5Test extends AuthKrb5TestBase {
assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
} finally {
cluster.close();
- server.tearDown();
}
}
@Test
public void shouldFailWithoutClientJaasEntry() throws Exception {
- server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
- server.setUp();
- final Cluster cluster = TestClientFactory.build().protocol(getServerPrincipalName())
- .addContactPoint(getHostname()).create();
+ final Cluster cluster = TestClientFactory.build().protocol(kdcServer.serverPrincipalName)
+ .addContactPoint(kdcServer.hostname).create();
final Client client = cluster.connect();
try {
client.submit("1+1").all().get();
@@ -119,16 +181,13 @@ public class AuthKrb5Test extends AuthKrb5TestBase {
assertEquals(GSSException.class, root.getClass());
} finally {
cluster.close();
- server.tearDown();
}
}
@Test
public void shouldFailWithoutClientTicketCache() throws Exception {
- server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
- server.setUp();
final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE_NOT_LOGGED_IN)
- .protocol(getServerPrincipalName()).addContactPoint(getHostname()).create();
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
final Client client = cluster.connect();
try {
client.submit("1+1").all().get();
@@ -138,80 +197,30 @@ public class AuthKrb5Test extends AuthKrb5TestBase {
assertEquals(LoginException.class, root.getClass());
} finally {
cluster.close();
- server.tearDown();
}
}
@Test
public void shouldFailWithNonexistentServerPrincipal() throws Exception {
- final TestAppender appender = new TestAppender();
- rootLogger.addAppender(appender);
- server = new GremlinServerAuthKrb5Integrate("no-service", serviceKeytabFile);
- server.setUp();
- server.tearDown();
-
- final List<LoggingEvent> log = appender.getLog();
- assertTrue(log.stream().anyMatch(item -> item.getLevel() == Level.WARN &&
- item.getMessage() == "Failed to login to kdc"));
- }
-
- class TestAppender extends AppenderSkeleton {
- private final List<LoggingEvent> log = new ArrayList<LoggingEvent>();
-
- @Override
- public boolean requiresLayout() {
- return false;
- }
-
- protected void append(final LoggingEvent loggingEvent) {
- log.add(loggingEvent);
- }
-
- @Override
- public void close() {
- }
-
- public List<LoggingEvent> getLog() {
- return new ArrayList<LoggingEvent>(log);
- }
+ assertTrue(recordingAppender.logContainsAny("WARN - Failed to login to kdc"));
}
@Test
public void shouldFailWithEmptyServerKeytab() throws Exception {
- final TestAppender appender = new TestAppender();
- rootLogger.addAppender(appender);
- final File keytabFile = new File(".", "no-file");
- server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), keytabFile);
- server.setUp();
- server.tearDown();
-
- final List<LoggingEvent> log = appender.getLog();
- for (LoggingEvent event: log) {
- System.out.println("Log: " + event.getLevel() + " " + event.getMessage());
- }
- assertTrue(log.stream().anyMatch(item -> item.getLevel() == Level.WARN &&
- item.getMessage() == "Failed to login to kdc"));
+ assertTrue(recordingAppender.logContainsAny("WARN - Failed to login to kdc"));
}
@Test
public void shouldFailWithWrongServerKeytab() throws Exception {
- final TestAppender appender = new TestAppender();
- rootLogger.addAppender(appender);
- final String principal = "no-principal/somehost@TEST.COM";
- getKdcServer().createPrincipal(principal);
- server = new GremlinServerAuthKrb5Integrate(principal, serviceKeytabFile);
- server.setUp();
- server.tearDown();
+ assertTrue(recordingAppender.logContainsAny("WARN - Failed to login to kdc"));
}
@Test
public void shouldAuthenticateWithQop() throws Exception {
- server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
- server.setUp();
final String oldQop = System.getProperty("javax.security.sasl.qop", "");
System.setProperty("javax.security.sasl.qop", "auth-conf");
final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
- .protocol(getServerPrincipalName()).addContactPoint(getHostname()).create();
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).create();
final Client client = cluster.connect();
try {
assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
@@ -219,7 +228,6 @@ public class AuthKrb5Test extends AuthKrb5TestBase {
assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
} finally {
cluster.close();
- server.tearDown();
System.setProperty("javax.security.sasl.qop", oldQop);
}
}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5TestBase.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5TestBase.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5TestBase.java
deleted file mode 100644
index ccf6f9f..0000000
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5TestBase.java
+++ /dev/null
@@ -1,130 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.tinkerpop.gremlin.server;
-
-import org.apache.kerby.kerberos.kerb.KrbException;
-import org.apache.kerby.kerberos.kerb.server.LoginTestBase;
-import org.apache.kerby.kerberos.kerb.server.TestKdcServer;
-import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
-
-import java.io.File;
-import java.net.Inet4Address;
-import java.net.UnknownHostException;
-import java.util.*;
-
-import org.junit.Before;
-import org.junit.Rule;
-import org.junit.rules.TestName;
-import org.slf4j.LoggerFactory;
-
-
-/**
- * @author Marc de Lignie
- */
-public class AuthKrb5TestBase extends LoginTestBase {
- private static final org.slf4j.Logger logger = LoggerFactory.getLogger(AuthKrb5TestBase.class);
-
- private String safeHostname = null;
- private String safeServerPrincipal = null;
-
- public AuthKrb5TestBase() {
- // Hostname setting must be consistent with the way gremlin-console sets gremlin-server's hostname
- // and derives gremlin-server's principal name. Also, the hostname needs to be lowercase for use
- // in principal names.
- try {
- safeHostname = Inet4Address.getLocalHost().getCanonicalHostName().toLowerCase();
- safeServerPrincipal = getServerPrincipalName() + "/" + getHostname() + "@" + TestKdcServer.KDC_REALM;
- } catch (UnknownHostException e) {
- logger.error("Hostname not found");
- }
- }
-
- @Rule
- public TestName name = new TestName();
-
- @Override
- protected String getHostname() {
- return safeHostname;
- }
-
- @Override
- protected String getServerPrincipal() { return safeServerPrincipal; }
-
- @Override
- protected void createPrincipals() throws KrbException {
- getKdcServer().createPrincipals(getServerPrincipal());
- getKdcServer().createPrincipal(getClientPrincipal(), getClientPassword());
- }
-
- @Override
- protected void deletePrincipals() throws KrbException {
- getKdcServer().getKadmin().deleteBuiltinPrincipals();
- getKdcServer().deletePrincipals(getServerPrincipal());
- getKdcServer().deletePrincipal(getClientPrincipal());
- }
-
- protected class GremlinServerAuthKrb5Integrate extends AbstractGremlinServerIntegrationTest {
-
- final String principal;
- final File keytabFile;
-
- GremlinServerAuthKrb5Integrate(String principal, File keytabFile) {
- this.principal = principal;
- this.keytabFile = keytabFile;
- }
-
- @Override
- public Settings overrideSettings(final Settings settings) {
- settings.host = getHostname();
- logger.debug("Hostname: " + settings.host);
- final Settings.AuthenticationSettings authSettings = new Settings.AuthenticationSettings();
- authSettings.className = Krb5Authenticator.class.getName();
- final Map authConfig = new HashMap<String,Object>();
- authConfig.put("keytab", keytabFile.getAbsolutePath());
- authConfig.put("principal", principal);
- authSettings.config = authConfig;
- settings.authentication = authSettings;
- final Settings.SslSettings sslConfig = new Settings.SslSettings();
- sslConfig.enabled = false;
- settings.ssl = sslConfig;
-
-// switch (nameOfTest) {
-// case "shouldAuthenticateOverSslWithKerberosTicket":
-// case "shouldFailIfSslEnabledOnServerButNotClient":
-// final Settings.SslSettings sslConfig = new Settings.SslSettings();
-// sslConfig.enabled = true;
-// settings.ssl = sslConfig;
-// break;
-// }
- return settings;
- }
- }
-
- @Before
- @Override
- public void setUp() throws Exception {
- logger.info("Starting " + name.getMethodName());
- super.setUp();
- loginServiceUsingKeytab();
- loginClientUsingTicketCache();
- final String buildDir = System.getProperty("build.dir");
- System.setProperty("java.security.auth.login.config", buildDir +
- "/test-classes/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf");
- }
-}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
new file mode 100644
index 0000000..73aa0a7
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
@@ -0,0 +1,152 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.tinkerpop.gremlin.server;
+
+import org.apache.kerby.kerberos.kerb.KrbException;
+import org.apache.kerby.kerberos.kerb.client.KrbClient;
+import org.apache.kerby.kerberos.kerb.client.KrbConfig;
+import org.apache.kerby.kerberos.kerb.client.KrbConfigKey;
+import org.apache.kerby.kerberos.kerb.server.SimpleKdcServer;
+import org.apache.kerby.kerberos.kerb.type.ticket.TgtTicket;
+import org.apache.kerby.util.NetworkUtil;
+import org.slf4j.LoggerFactory;
+
+import java.io.File;
+import java.net.Inet4Address;
+
+
+/**
+ * @author Marc de Lignie
+ *
+ * This class is derived from the following classes from https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/:
+ * - org.apache.kerby.kerberos.kerb.server.TestKdcServer
+ * - org.apache.kerby.kerberos.kerb.server.KdcTestBase
+ * - org.apache.kerby.kerberos.kerb.server.LoginTestBase.java
+ *
+ * See also: gremlin-server/src/main/static/NOTICE
+ */
+public class KdcFixture {
+
+ private static final org.slf4j.Logger logger = LoggerFactory.getLogger(KdcFixture.class);
+
+ final String clientPassword = "123456";
+ final String clientPrincipalName = "drankye";
+ final String serverPrincipalName = "test-service";
+ final String ticketCacheFileName = "test-tkt.cc";
+ final String serviceKeytabFileName = "test-service.keytab";
+
+ final String clientPrincipal;
+ final String serverPrincipal;
+ final File testDir;
+ final File ticketCacheFile;
+ final File serviceKeytabFile;
+
+ final String hostname;
+ private SimpleKdcServer kdcServer;
+
+
+ public KdcFixture(String authConfigName) throws Exception {
+ System.setProperty("java.security.auth.login.config", authConfigName);
+ hostname = findHostname();
+ serverPrincipal = serverPrincipalName + "/" + hostname + "@" + KdcFixture.TestKdcServer.KDC_REALM;
+ clientPrincipal = clientPrincipalName + "@" + KdcFixture.TestKdcServer.KDC_REALM;
+ testDir = createTestDir();
+ ticketCacheFile = new File(testDir, ticketCacheFileName);
+ serviceKeytabFile = new File(testDir, serviceKeytabFileName);
+ }
+
+ private String findHostname() {
+ // Hostname setting must be consistent with the way gremlin-console sets gremlin-server's hostname
+ // and derives gremlin-server's principal name. Also, the hostname needs to be lowercase for use
+ // in principal names.
+ String hostname = "";
+ try {
+ hostname = Inet4Address.getLocalHost().getCanonicalHostName().toLowerCase();
+ } catch (Exception e) {
+ logger.error("Hostname not found");
+ }
+ return hostname;
+ }
+
+ private File createTestDir() {
+ String basedir = System.getProperty("basedir");
+ File targetdir = new File(basedir, "target");
+ File testDir = new File(targetdir, "tmp");
+ testDir.mkdirs();
+ return testDir;
+ }
+
+ private class TestKdcServer extends SimpleKdcServer {
+ public static final String KDC_REALM = "TEST.COM";
+ public static final String HOSTNAME = "localhost";
+
+ TestKdcServer() throws KrbException {
+ setKdcRealm(KDC_REALM);
+ setKdcHost(HOSTNAME);
+ setAllowTcp(true);
+ setAllowUdp(false); // There are still udp issues in Apache Directory-Kerby 1.0.0-RC2
+ setKdcTcpPort(NetworkUtil.getServerPort());
+
+ KrbClient krbClnt = getKrbClient();
+ KrbConfig krbConfig = krbClnt.getKrbConfig();
+ krbConfig.setString(KrbConfigKey.PERMITTED_ENCTYPES,
+ "aes128-cts-hmac-sha1-96 des-cbc-crc des-cbc-md5 des3-cbc-sha1");
+ krbClnt.setTimeout(10 * 1000);
+ }
+ }
+
+ public void setUp() throws Exception {
+ setUpKdcServer();
+ setUpPrincipals();
+ }
+
+ private void setUpKdcServer() throws Exception {
+ kdcServer = new TestKdcServer();
+ kdcServer.setWorkDir(testDir);
+ kdcServer.init();
+ kdcServer.start();
+ }
+
+ private void setUpPrincipals() throws KrbException {
+ kdcServer.createPrincipals(serverPrincipal);
+ kdcServer.exportPrincipal(serverPrincipal, serviceKeytabFile);
+
+ kdcServer.createPrincipal(clientPrincipal, clientPassword);
+ TgtTicket tgt = kdcServer.getKrbClient().requestTgt(clientPrincipal, clientPassword);
+ kdcServer.getKrbClient().storeTicket(tgt, ticketCacheFile);
+ }
+
+ public void close() throws Exception {
+ deletePrincipals();
+ kdcServer.stop();
+ ticketCacheFile.delete();
+ serviceKeytabFile.delete();
+ testDir.delete();
+ }
+
+ private void deletePrincipals() throws KrbException {
+ kdcServer.getKadmin().deleteBuiltinPrincipals();
+ kdcServer.deletePrincipals(serverPrincipal);
+ kdcServer.deletePrincipal(clientPrincipal);
+ }
+
+ public void createPrincipal(final String principal) throws KrbException {
+ kdcServer.createPrincipal(principal);
+ }
+}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/util/Log4jRecordingAppender.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/util/Log4jRecordingAppender.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/util/Log4jRecordingAppender.java
index e44f72f..4a9ebd4 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/util/Log4jRecordingAppender.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/util/Log4jRecordingAppender.java
@@ -19,6 +19,7 @@
package org.apache.tinkerpop.gremlin.util;
import org.apache.log4j.AppenderSkeleton;
+import org.apache.log4j.Level;
import org.apache.log4j.PatternLayout;
import org.apache.log4j.spi.LoggingEvent;
@@ -32,6 +33,7 @@ import java.util.List;
*/
public class Log4jRecordingAppender extends AppenderSkeleton {
private final List<String> messages = new ArrayList<>();
+ private final List<LoggingEvent> events = new ArrayList<>();
public Log4jRecordingAppender() {
super();
@@ -41,6 +43,7 @@ public class Log4jRecordingAppender extends AppenderSkeleton {
@Override
protected void append(final LoggingEvent event) {
messages.add(layout.format(event));
+ events.add(event);
}
@Override
@@ -52,9 +55,9 @@ public class Log4jRecordingAppender extends AppenderSkeleton {
return true;
}
- public List<String> getMessages() {
- return messages;
- }
+ public List<String> getMessages() { return messages; }
+
+ public List<LoggingEvent> getEvents() { return events; }
public void clear() {
messages.clear();
@@ -63,4 +66,13 @@ public class Log4jRecordingAppender extends AppenderSkeleton {
public boolean logContainsAny(final String fragment) {
return messages.stream().anyMatch(m -> m.contains(fragment));
}
-}
\ No newline at end of file
+
+ public boolean logContainsAny(final String loggerName, final Level level, final String fragment) {
+ return events.stream().anyMatch(m -> m.getLoggerName().equals(loggerName) &&
+ m.getLevel().equals(level) && m.getMessage().toString().contains(fragment));
+ }
+ public boolean logMatchesAny(final String loggerName, final Level level, final String regex) {
+ return events.stream().anyMatch(m -> m.getLoggerName().equals(loggerName) &&
+ m.getLevel().equals(level) && m.getMessage().toString().matches(regex));
+ }
+}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/68eff1db/gremlin-server/src/test/resources/log4j-test.properties
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/resources/log4j-test.properties b/gremlin-server/src/test/resources/log4j-test.properties
index 5dec106..c806201 100644
--- a/gremlin-server/src/test/resources/log4j-test.properties
+++ b/gremlin-server/src/test/resources/log4j-test.properties
@@ -20,4 +20,4 @@ log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=[%p] %C - %m%n
-log4j.logger.org.apache.tinkerpop.gremlin.server.op.AbstractEvalOpProcessor=ERROR
\ No newline at end of file
+log4j.logger.org.apache.tinkerpop.gremlin.server.op.AbstractEvalOpProcessor=ERROR
[17/27] tinkerpop git commit: Adapted to TINKERPOP-1600 after rebase
Posted by sp...@apache.org.
Adapted to TINKERPOP-1600 after rebase
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/d81f0d70
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/d81f0d70
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/d81f0d70
Branch: refs/heads/master
Commit: d81f0d701f5034d0743d4341421f5e617604a4d2
Parents: 0ca1b16
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Wed Jan 18 20:12:42 2017 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 20:12:42 2017 +0100
----------------------------------------------------------------------
.../gremlin/driver/ser/AbstractGryoMessageSerializerV1d0.java | 3 ---
.../gremlin/server/GremlinServerAuthKrb5IntegrateTest.java | 2 --
2 files changed, 5 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/d81f0d70/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/ser/AbstractGryoMessageSerializerV1d0.java
----------------------------------------------------------------------
diff --git a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/ser/AbstractGryoMessageSerializerV1d0.java b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/ser/AbstractGryoMessageSerializerV1d0.java
index 4588443..ace6bb0 100644
--- a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/ser/AbstractGryoMessageSerializerV1d0.java
+++ b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/ser/AbstractGryoMessageSerializerV1d0.java
@@ -301,12 +301,9 @@ public abstract class AbstractGryoMessageSerializerV1d0 extends AbstractMessageS
if (msg.getResult().getData() == null) return "null";
// the IteratorHandler should return a collection so keep it as such
- // Sasl authentication needs byte[] to pass unchanged
final Object o = msg.getResult().getData();
if (o instanceof Collection) {
return ((Collection) o).stream().map(d -> null == d ? "null" : d.toString()).collect(Collectors.toList());
- } else if (o instanceof byte[]) {
- return o;
} else {
return o.toString();
}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/d81f0d70/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
index 22d38cd..63d464d 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
@@ -205,8 +205,6 @@ public class GremlinServerAuthKrb5IntegrateTest extends AbstractGremlinServerInt
}
}
- // This test backs a fix in gremlin-driver (see commit cd628b251f6956c826df20c89177680fe120ff99)
- // Maybe gremlin-driver needs its own test with client.submit("[1,2,3] as byte[]")
@Test
public void shouldAuthenticateWithSerializeResultToString() throws Exception {
MessageSerializer serializer = new GryoMessageSerializerV1d0();
[08/27] tinkerpop git commit: Made immutable variables final
Posted by sp...@apache.org.
Made immutable variables final
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/4544b01e
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/4544b01e
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/4544b01e
Branch: refs/heads/master
Commit: 4544b01e0414aa6b3cad5db50e9fe6a8b148f450
Parents: 202d658
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Sun Dec 11 12:16:12 2016 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 19:58:48 2017 +0100
----------------------------------------------------------------------
.../gremlin/server/auth/Krb5Authenticator.java | 18 +--
.../tinkerpop/gremlin/server/AuthKrb5Test.java | 112 +++++++++++++------
2 files changed, 85 insertions(+), 45 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/4544b01e/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
index bf09368..0f71b94 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
@@ -66,7 +66,7 @@ public class Krb5Authenticator implements Authenticator {
Krb5Authenticator.class.getName()));
}
try {
- File keytabFile = new File((String) config.get(KEYTAB_KEY));
+ final File keytabFile = new File((String) config.get(KEYTAB_KEY));
principalName = (String) config.get(PRINCIPAL_KEY);
subject = JaasKrbUtil.loginUsingKeytab(principalName, keytabFile);
} catch (Exception e) {
@@ -113,13 +113,13 @@ public class Krb5Authenticator implements Authenticator {
* http://www.roguelynn.com/words/explain-like-im-5-kerberos/
*/
private class Krb5SaslAuthenticator implements Authenticator.SaslNegotiator, CallbackHandler {
- private String mechanism = "GSSAPI";
- private String gremlinQOP = "auth";
+ private static final String mechanism = "GSSAPI";
+ private static final String gremlinQOP = "auth";
private SaslServer saslServer;
Krb5SaslAuthenticator() {
try {
- Map props = new HashMap<String, Object>();
+ final Map props = new HashMap<String, Object>();
// Set secure values for relevant sasl properties regarding GSSAPI, see:
// https://docs.oracle.com/javase/8/docs/technotes/guides/security/sasl/sasl-refguide.html#SERVER
// Rely on GSSAPI defaults for Sasl.MAX_BUFFER and "javax.security.sasl.sendmaxbuffer"
@@ -127,16 +127,16 @@ public class Krb5Authenticator implements Authenticator {
// props.put(Sasl.POLICY_NOANONYMOUS, System.getProperty(Sasl.POLICY_NOANONYMOUS, "true"));
// props.put(Sasl.POLICY_NOACTIVE, System.getProperty(Sasl.POLICY_NOACTIVE, "true"));
// props.put(Sasl.POLICY_NOPLAINTEXT, System.getProperty(Sasl.POLICY_NOPLAINTEXT, "true"));
- String[] principalParts = principalName.split("/|@");
+ final String[] principalParts = principalName.split("/|@");
if (principalParts.length < 3) throw new IllegalArgumentException("Use principal name of format 'service/fqdn@kdcrealm'");
saslServer = Sasl.createSaslServer(mechanism, principalParts[0], principalParts[1], props, Krb5SaslAuthenticator.this);
} catch(Exception e) {
logger.error("Creating sasl server failed: ", e);
}
logger.debug("SaslServer created with: " + saslServer.getMechanismName());
- // ToDo: check other Sasl.QoP values on a system with cyrus sasl
- if (System.getProperty(Sasl.QOP) != gremlinQOP)
- logger.warn("Gremlin server with libgsasl does not support Sasl.QOP security layer features, use SSL");
+ // ToDo: investigate use of Sasl.QoP values, also on a system with cyrus sasl
+ // if (!System.getProperty(Sasl.QOP).equals(gremlinQOP))
+ // logger.warn("Gremlin server with libgsasl does not support Sasl.QOP security layer features, use SSL");
}
/*
@@ -175,7 +175,7 @@ public class Krb5Authenticator implements Authenticator {
@Override
public byte[] evaluateResponse(final byte[] clientResponse) throws AuthenticationException {
logger.debug("evaluateResponse() length: " + clientResponse.length);
- byte[] response = null;
+ byte[] response;
try {
response = saslServer.evaluateResponse(clientResponse);
} catch (Exception e) {
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/4544b01e/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
index bc20b1b..bd639ef 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
@@ -20,9 +20,10 @@ package org.apache.tinkerpop.gremlin.server;
import org.apache.commons.lang.exception.ExceptionUtils;
import org.apache.kerby.kerberos.kerb.server.LoginTestBase;
-import org.apache.tinkerpop.gremlin.driver.MessageSerializer;
-import org.apache.tinkerpop.gremlin.driver.exception.ResponseException;
-import org.apache.tinkerpop.gremlin.driver.ser.GryoMessageSerializerV1d0;
+import org.apache.log4j.AppenderSkeleton;
+import org.apache.log4j.Level;
+import org.apache.log4j.Logger;
+import org.apache.log4j.spi.LoggingEvent;
import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
import org.ietf.jgss.GSSException;
import org.junit.After;
@@ -33,29 +34,29 @@ import org.apache.tinkerpop.gremlin.driver.Client;
import org.apache.tinkerpop.gremlin.driver.Cluster;
import java.io.File;
-import java.net.Inet4Address;
import java.util.*;
import org.junit.rules.TestName;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import javax.security.auth.Subject;
import javax.security.auth.login.LoginException;
-import static org.hamcrest.CoreMatchers.anyOf;
-import static org.hamcrest.MatcherAssert.assertThat;
import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
+
/**
* @author Marc de Lignie
*
* Todo: change back to integrate test later on
*/
public class AuthKrb5Test extends LoginTestBase {
- private static final Logger logger = LoggerFactory.getLogger(AuthKrb5Test.class);
+ // Cannot use mere slf4j because need to check log output
+ // Messier alternative would be to catch the console output:
+ // http://stackoverflow.com/questions/8708342/redirect-console-output-to-string-in-java
+ private final Logger rootLogger = Logger.getRootLogger();
+ private final Logger logger = Logger.getLogger(AuthKrb5Test.class);
private GremlinServerAuthKrb5Integrate server;
private static final String TESTCONSOLE = "GremlinConsole";
private static final String TESTCONSOLE_NOT_LOGGED_IN = "UserNotLoggedIn";
@@ -69,9 +70,8 @@ public class AuthKrb5Test extends LoginTestBase {
final File keytabFile;
GremlinServerAuthKrb5Integrate(String principal, File keytabFile) {
-
this.principal = principal;
- this.keytabFile =keytabFile;
+ this.keytabFile = keytabFile;
}
@Override
@@ -104,6 +104,7 @@ public class AuthKrb5Test extends LoginTestBase {
@Before
@Override
public void setUp() throws Exception {
+ logger.info("Starting " + name.getMethodName());
super.setUp();
loginServiceUsingKeytab();
loginClientUsingTicketCache();
@@ -200,38 +201,77 @@ public class AuthKrb5Test extends LoginTestBase {
}
}
-// @Test
-// public void shouldFailWithoutServerPrincipal() throws Exception {
-// String protocol = "no-service";
-// server = new GremlinServerAuthKrb5Integrate(protocol, serviceKeytabFile);
-// server.setUp();
-// final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
-// .protocol(protocol).addContactPoint(hostname).create();
-// final Client client = cluster.connect();
-// try {
-// client.submit("1+1").all().get();
-// fail("This should not succeed as the client config does not contain a JaasEntry");
-// } catch(Exception ex) {
-// final Throwable root = ExceptionUtils.getRootCause(ex);
-// assertEquals(GSSException.class, root.getClass());
-// } finally {
-// cluster.close();
-// server.tearDown();
-// }
-// }
+ @Test
+ public void shouldFailWithNonexistentServerPrincipal() throws Exception {
+ final TestAppender appender = new TestAppender();
+ rootLogger.addAppender(appender);
+ server = new GremlinServerAuthKrb5Integrate("no-service", serviceKeytabFile);
+ server.setUp();
+ server.tearDown();
-// @Test
-// public void shouldFailWithoutServerKeytab() throws Exception {
-// server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
-// server.setUp();
-// }
+ final List<LoggingEvent> log = appender.getLog();
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == Level.WARN &&
+ item.getMessage() == "Failed to login to kdc"));
+ }
+
+ class TestAppender extends AppenderSkeleton {
+ private final List<LoggingEvent> log = new ArrayList<LoggingEvent>();
+
+ @Override
+ public boolean requiresLayout() {
+ return false;
+ }
+
+ protected void append(final LoggingEvent loggingEvent) {
+ log.add(loggingEvent);
+ }
+
+ @Override
+ public void close() {
+ }
+
+ public List<LoggingEvent> getLog() {
+ return new ArrayList<LoggingEvent>(log);
+ }
+ }
+
+ @Test
+ public void shouldFailWithEmptyServerKeytab() throws Exception {
+ final TestAppender appender = new TestAppender();
+ rootLogger.addAppender(appender);
+ final File keytabFile = new File(".", "no-file");
+ server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), keytabFile);
+ server.setUp();
+ server.tearDown();
+
+ final List<LoggingEvent> log = appender.getLog();
+ for (LoggingEvent event: log) {
+ System.out.println("Log: " + event.getLevel() + " " + event.getMessage());
+ }
+ assertTrue(log.stream().anyMatch(item -> item.getLevel() == Level.WARN &&
+ item.getMessage() == "Failed to login to kdc"));
+ }
+ @Test
+ public void shouldFailWithWrongServerKeytab() throws Exception {
+ final TestAppender appender = new TestAppender();
+ rootLogger.addAppender(appender);
+ final String principal = "no-principal/somehost@TEST.COM";
+ getKdcServer().createPrincipal(principal);
+ server = new GremlinServerAuthKrb5Integrate(principal, serviceKeytabFile);
+ server.setUp();
+ server.tearDown();
+ }
+
+// ToDo: Unclear how to test this
// @Test
// public void shouldFailWithAuthIdUnequalAuthzId() throws Exception {
// server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
// server.setUp();
// }
+
+// ToDo: make this into a test for gremlin-driver
// @Test
// public void shouldAuthenticateWithSerializeResultToString() throws Exception {
// server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
[26/27] tinkerpop git commit: Merge branch 'pr-534'
Posted by sp...@apache.org.
Merge branch 'pr-534'
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/96acd8a8
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/96acd8a8
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/96acd8a8
Branch: refs/heads/master
Commit: 96acd8a89a0ea546d9844d5d07fd9d1b296adca3
Parents: 7160b66 3c321ca
Author: Stephen Mallette <sp...@genoprime.com>
Authored: Mon Feb 27 06:42:48 2017 -0500
Committer: Stephen Mallette <sp...@genoprime.com>
Committed: Mon Feb 27 06:42:48 2017 -0500
----------------------------------------------------------------------
CHANGELOG.asciidoc | 2 +
.../src/reference/gremlin-applications.asciidoc | 90 ++++-
.../tinkerpop/gremlin/driver/Handler.java | 2 +
gremlin-server/pom.xml | 6 +
.../tinkerpop/gremlin/server/GremlinServer.java | 1 +
.../tinkerpop/gremlin/server/Settings.java | 5 +
.../gremlin/server/auth/JaasKrbUtil.java | 225 +++++++++++
.../gremlin/server/auth/Krb5Authenticator.java | 197 ++++++++++
.../gremlin/server/channel/HttpChannelizer.java | 2 +-
.../gremlin/server/channel/NioChannelizer.java | 2 +-
.../server/channel/WebSocketChannelizer.java | 2 +-
.../handler/HttpBasicAuthenticationHandler.java | 20 +-
.../handler/HttpGremlinEndpointHandler.java | 6 +
.../handler/SaslAuthenticationHandler.java | 19 +-
.../server/op/AbstractEvalOpProcessor.java | 7 +
.../GremlinServerAuditLogIntegrateTest.java | 374 +++++++++++++++++++
.../server/GremlinServerAuthIntegrateTest.java | 4 +-
.../GremlinServerAuthKrb5IntegrateTest.java | 243 ++++++++++++
.../GremlinServerAuthOldIntegrateTest.java | 4 +-
.../tinkerpop/gremlin/server/KdcFixture.java | 166 ++++++++
.../gremlin/util/Log4jRecordingAppender.java | 20 +-
.../src/test/resources/log4j-test.properties | 3 +-
.../tinkerpop/gremlin/server/backend.conf | 19 +
.../gremlin/server/gremlin-console-jaas.conf | 41 ++
.../apache/tinkerpop/gremlin/server/kdc.conf | 21 ++
25 files changed, 1453 insertions(+), 28 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/96acd8a8/CHANGELOG.asciidoc
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/96acd8a8/docs/src/reference/gremlin-applications.asciidoc
----------------------------------------------------------------------
[20/27] tinkerpop git commit: Fixed failing gremlin-server
authentication integration tests
Posted by sp...@apache.org.
Fixed failing gremlin-server authentication integration tests
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/b8783189
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/b8783189
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/b8783189
Branch: refs/heads/master
Commit: b878318947d70c6369ab53309eaa00288152bf44
Parents: 6400128
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Fri Jan 20 16:59:58 2017 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Fri Jan 20 16:59:58 2017 +0100
----------------------------------------------------------------------
.../org/apache/tinkerpop/gremlin/driver/Handler.java | 11 ++++-------
.../server/GremlinServerAuthKrb5IntegrateTest.java | 4 ++--
2 files changed, 6 insertions(+), 9 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b8783189/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Handler.java
----------------------------------------------------------------------
diff --git a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Handler.java b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Handler.java
index 650bc2f..8d9cdfc 100644
--- a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Handler.java
+++ b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Handler.java
@@ -176,15 +176,12 @@ final class Handler {
/**
* Work out the Sasl mechanism based on the user supplied parameters.
- * If we have a username and password use PLAIN otherwise GSSAPI
+ * If we have a JAAS entry use GSSAPI otherwise PLAIN.
+ * Use of additional mechanisms (CRAM-MD5, DIGEST-MD5, EXTERNAL) requires the server to return the
+ * mechanism(s) it supports, so that getMechanism can get the negotiated mechanism from SaslClient.
*/
private String getMechanism() {
- if ((authProps.get(AuthProperties.Property.USERNAME) != null) &&
- (authProps.get(AuthProperties.Property.PASSWORD) != null)) {
- return "PLAIN";
- } else {
- return "GSSAPI";
- }
+ return (authProps.get(AuthProperties.Property.JAAS_ENTRY) != null) ? "GSSAPI" : "PLAIN";
}
}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b8783189/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
index e974118..4cd7a4f 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthKrb5IntegrateTest.java
@@ -23,10 +23,10 @@ import org.apache.log4j.Logger;
import org.apache.tinkerpop.gremlin.driver.Client;
import org.apache.tinkerpop.gremlin.driver.Cluster;
import org.apache.tinkerpop.gremlin.driver.MessageSerializer;
+import org.apache.tinkerpop.gremlin.driver.exception.ResponseException;
import org.apache.tinkerpop.gremlin.driver.ser.GryoMessageSerializerV1d0;
import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
import org.apache.tinkerpop.gremlin.util.Log4jRecordingAppender;
-import org.ietf.jgss.GSSException;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
@@ -154,7 +154,7 @@ public class GremlinServerAuthKrb5IntegrateTest extends AbstractGremlinServerInt
fail("This should not succeed as the client config does not contain a JaasEntry");
} catch(Exception ex) {
final Throwable root = ExceptionUtils.getRootCause(ex);
- assertEquals(GSSException.class, root.getClass());
+ assertEquals(ResponseException.class, root.getClass());
} finally {
cluster.close();
}
[25/27] tinkerpop git commit: Merge branch 'TINKERPOP-1566' of
https://github.com/vtslab/incubator-tinkerpop into TINKERPOP-1566
Posted by sp...@apache.org.
Merge branch 'TINKERPOP-1566' of https://github.com/vtslab/incubator-tinkerpop into TINKERPOP-1566
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/3c321ca8
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/3c321ca8
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/3c321ca8
Branch: refs/heads/master
Commit: 3c321ca8db74ab48263aa401aa8ed79404f5c105
Parents: 91e510c 1bbb0b2
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Wed Feb 22 20:49:08 2017 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Feb 22 20:49:08 2017 +0100
----------------------------------------------------------------------
CHANGELOG.asciidoc | 12 +
bin/validate-distribution.sh | 14 +-
docs/src/dev/developer/release.asciidoc | 23 +
docs/src/dev/io/graphson.asciidoc | 2367 ++++++++++++++++++
docs/src/recipes/centrality.asciidoc | 121 +-
.../src/reference/gremlin-applications.asciidoc | 3 +-
.../reference/implementations-hadoop.asciidoc | 10 +-
docs/src/reference/intro.asciidoc | 2 +-
docs/src/reference/preface.asciidoc | 10 +-
docs/src/reference/the-traversal.asciidoc | 10 +-
.../gremlin-language-variants/index.asciidoc | 2 +-
.../upgrade/release-3.2.x-incubating.asciidoc | 26 +-
docs/src/upgrade/release-3.3.x.asciidoc | 74 +-
docs/static/images/betweeness-example.png | Bin 8465 -> 21283 bytes
docs/static/images/filter-lambda.png | Bin 27075 -> 13440 bytes
...pache.tinkerpop.gremlin.jsr223.GremlinPlugin | 1 +
gremlin-console/src/main/bin/gremlin.sh | 4 +-
.../tinkerpop/gremlin/console/Console.groovy | 8 +-
.../gremlin/jsr223/BindingsCustomizer.java | 11 +-
.../gremlin/jsr223/BindingsGremlinPlugin.java | 101 +
.../tinkerpop/gremlin/jsr223/CoreImports.java | 45 +-
.../jsr223/DefaultBindingsCustomizer.java | 20 +-
.../DefaultGremlinScriptEngineManager.java | 34 +
.../gremlin/jsr223/LazyBindingsCustomizer.java | 20 +
.../gremlin/jsr223/ScriptCustomizer.java | 4 +
.../gremlin/jsr223/ScriptFileGremlinPlugin.java | 4 +-
.../step/map/TraversalVertexProgramStep.java | 5 +
.../MessagePassingReductionStrategy.java | 162 ++
.../process/traversal/TraversalStrategies.java | 2 +
.../traversal/step/filter/SampleGlobalStep.java | 19 +-
.../traversal/step/map/EdgeVertexStep.java | 7 +-
.../process/traversal/step/map/FlatMapStep.java | 7 +
.../process/traversal/step/map/GraphStep.java | 8 +-
.../process/traversal/step/map/GroupStep.java | 263 +-
.../traversal/step/map/OrderGlobalStep.java | 68 +-
.../traversal/step/map/PropertiesStep.java | 7 +-
.../process/traversal/step/map/VertexStep.java | 7 +-
.../step/sideEffect/GroupSideEffectStep.java | 50 +-
.../step/util/CollectingBarrierStep.java | 28 +-
.../optimization/PathRetractionStrategy.java | 66 +-
.../ComputerVerificationStrategy.java | 7 -
.../traversal/traverser/ProjectedTraverser.java | 203 ++
.../tinkerpop/gremlin/structure/Graph.java | 20 +
.../structure/io/graphson/GraphSONIo.java | 2 +-
.../structure/io/graphson/GraphSONMapper.java | 75 +-
.../structure/io/graphson/GraphSONModule.java | 206 ++
.../io/graphson/GraphSONSerializersV2d0.java | 138 +-
.../io/graphson/GraphSONSerializersV3d0.java | 584 +++++
.../structure/io/graphson/GraphSONTokens.java | 3 +-
.../structure/io/graphson/GraphSONUtil.java | 7 +
.../structure/io/graphson/GraphSONVersion.java | 3 +-
.../io/graphson/GraphSONXModuleV3d0.java | 142 ++
.../io/graphson/JavaTimeSerializersV3d0.java | 323 +++
.../io/graphson/JavaUtilSerializersV3d0.java | 85 +
.../io/graphson/TraversalSerializersV3d0.java | 390 +++
.../gremlin/structure/io/gryo/GryoVersion.java | 20 +-
.../structure/util/CloseableIterator.java | 11 +
.../util/reference/ReferenceVertexProperty.java | 10 +-
.../tinkerpop/gremlin/util/CoreImports.java | 47 +-
.../gremlin/util/function/MultiComparator.java | 75 +
.../MessagePassingReductionStrategyTest.java | 135 +
.../PathRetractionStrategyTest.java | 18 +-
.../util/function/MultiComparatorTest.java | 69 +
.../ser/GraphSONMessageSerializerV3d0.java | 115 +
.../tinkerpop/gremlin/driver/ser/SerTokens.java | 1 +
.../gremlin/driver/ser/Serializers.java | 8 +-
.../ser/GraphSONMessageSerializerV2d0Test.java | 29 +-
.../ser/GraphSONMessageSerializerV3d0Test.java | 342 +++
.../step/sideEffect/GroovyGroupTest.groovy | 10 +
.../groovy/GroovyEnvironmentIntegrateSuite.java | 2 +
.../gremlin/groovy/GroovyEnvironmentSuite.java | 2 +
.../process/GroovyProcessComputerSuite.java | 2 +
.../process/GroovyProcessStandardSuite.java | 2 +
.../gremlin/groovy/engine/GremlinExecutor.java | 20 +-
.../gremlin/groovy/engine/ScriptEngines.java | 12 +-
.../groovy/jsr223/GremlinGroovyClassLoader.java | 24 +-
.../jsr223/ManagedConcurrentValueMap.java | 4 +
.../gremlin/groovy/plugin/GremlinPlugin.java | 1 +
.../GremlinGroovyScriptEngineIntegrateTest.java | 55 +
.../driver/driver_remote_connection.py | 4 +-
.../gremlin_python/structure/io/graphson.py | 16 +-
gremlin-python/src/main/jython/setup.py | 2 +-
.../jython/tests/structure/io/test_graphson.py | 2 +-
.../jsr223/PythonGraphSONJavaTranslator.java | 4 +-
.../gremlin/python/jsr223/PythonProvider.java | 1 +
.../driver/gremlin-server-modern-secure-py.yaml | 2 +-
gremlin-server/conf/gremlin-server-classic.yaml | 12 +-
.../conf/gremlin-server-modern-py.yaml | 12 +-
.../conf/gremlin-server-modern-readonly.yaml | 12 +-
gremlin-server/conf/gremlin-server-modern.yaml | 12 +-
gremlin-server/conf/gremlin-server-neo4j.yaml | 12 +-
.../conf/gremlin-server-rest-modern.yaml | 6 +-
.../conf/gremlin-server-rest-secure.yaml | 6 +-
gremlin-server/conf/gremlin-server-secure.yaml | 12 +-
gremlin-server/conf/gremlin-server-spark.yaml | 12 +-
gremlin-server/conf/gremlin-server.yaml | 12 +-
.../gremlin/server/AbstractChannelizer.java | 9 +-
.../tinkerpop/gremlin/server/Settings.java | 6 +
.../server/auth/SimpleAuthenticator.java | 2 +-
.../handler/SaslAuthenticationHandler.java | 1 +
.../gremlin/server/op/session/Session.java | 17 +-
.../server/util/ServerGremlinExecutor.java | 12 +
.../server/GremlinServerAuthIntegrateTest.java | 25 +-
.../GremlinServerAuthOldIntegrateTest.java | 21 +-
.../server/GremlinServerHttpIntegrateTest.java | 76 +-
.../server/GremlinServerIntegrateTest.java | 90 +-
gremlin-server/src/test/resources/client.crt | 40 +
.../src/test/resources/client.key.pk8 | 47 +
.../remote/gremlin-server-integration.yaml | 6 +-
.../server/gremlin-server-integration.yaml | 6 +-
gremlin-server/src/test/resources/server.crt | 41 +
.../src/test/resources/server.key.pk8 | 47 +
.../jsr223/BindingsScriptEngineTest.java | 95 +
.../jsr223/GremlinScriptEngineSuite.java | 1 +
.../traversal/step/sideEffect/GroupTest.java | 60 +-
.../gremlin/structure/SerializationTest.java | 229 +-
.../gremlin/structure/io/IoCustomTest.java | 3 +
.../gremlin/structure/io/IoEdgeTest.java | 3 +
.../gremlin/structure/io/IoGraphTest.java | 1 +
.../gremlin/structure/io/IoPropertyTest.java | 18 +-
.../tinkerpop/gremlin/structure/io/IoTest.java | 266 +-
.../gremlin/structure/io/IoVertexTest.java | 3 +
.../tinkerpop-classic-normalized-v3d0.json | 6 +
gremlin-tools/gremlin-io-test/pom.xml | 20 +-
.../tinkerpop/gremlin/structure/io/Model.java | 15 +-
.../io/graphson/GraphSONCompatibility.java | 3 +-
.../GraphSONTypedCompatibilityTest.java | 9 +-
.../_3_3_0/authenticationchallenge-v3d0.json | 12 +
.../authenticationresponse-v2d0-partial.json | 5 +-
.../_3_3_0/authenticationresponse-v3d0.json | 9 +
.../io/graphson/_3_3_0/barrier-v3d0.json | 4 +
.../io/graphson/_3_3_0/bigdecimal-v3d0.json | 4 +
.../io/graphson/_3_3_0/biginteger-v3d0.json | 4 +
.../io/graphson/_3_3_0/binding-v3d0.json | 10 +
.../structure/io/graphson/_3_3_0/byte-v3d0.json | 4 +
.../io/graphson/_3_3_0/bytebuffer-v3d0.json | 4 +
.../io/graphson/_3_3_0/bytecode-v3d0.json | 6 +
.../io/graphson/_3_3_0/cardinality-v3d0.json | 4 +
.../structure/io/graphson/_3_3_0/char-v3d0.json | 4 +
.../io/graphson/_3_3_0/class-v3d0.json | 4 +
.../io/graphson/_3_3_0/column-v3d0.json | 4 +
.../structure/io/graphson/_3_3_0/date-v3d0.json | 4 +
.../io/graphson/_3_3_0/direction-v3d0.json | 4 +
.../io/graphson/_3_3_0/double-v3d0.json | 4 +
.../io/graphson/_3_3_0/duration-v3d0.json | 4 +
.../io/graphson/_3_3_0/edge-v2d0-no-types.json | 5 +-
.../io/graphson/_3_3_0/edge-v2d0-partial.json | 10 +-
.../structure/io/graphson/_3_3_0/edge-v3d0.json | 32 +
.../io/graphson/_3_3_0/float-v3d0.json | 4 +
.../io/graphson/_3_3_0/inetaddress-v3d0.json | 4 +
.../io/graphson/_3_3_0/instant-v3d0.json | 4 +
.../io/graphson/_3_3_0/integer-v3d0.json | 4 +
.../io/graphson/_3_3_0/lambda-v3d0.json | 8 +
.../io/graphson/_3_3_0/localdate-v3d0.json | 4 +
.../io/graphson/_3_3_0/localdatetime-v3d0.json | 4 +
.../io/graphson/_3_3_0/localtime-v3d0.json | 4 +
.../structure/io/graphson/_3_3_0/long-v3d0.json | 4 +
.../io/graphson/_3_3_0/metrics-v3d0.json | 54 +
.../io/graphson/_3_3_0/monthday-v3d0.json | 4 +
.../io/graphson/_3_3_0/offsetdatetime-v3d0.json | 4 +
.../io/graphson/_3_3_0/offsettime-v3d0.json | 4 +
.../io/graphson/_3_3_0/operator-v3d0.json | 4 +
.../io/graphson/_3_3_0/order-v3d0.json | 4 +
.../structure/io/graphson/_3_3_0/p-v3d0.json | 10 +
.../structure/io/graphson/_3_3_0/pand-v3d0.json | 25 +
.../io/graphson/_3_3_0/path-v2d0-no-types.json | 7 -
.../io/graphson/_3_3_0/path-v2d0-partial.json | 28 -
.../structure/io/graphson/_3_3_0/path-v3d0.json | 150 ++
.../io/graphson/_3_3_0/period-v3d0.json | 4 +
.../structure/io/graphson/_3_3_0/pick-v3d0.json | 4 +
.../structure/io/graphson/_3_3_0/pop-v3d0.json | 4 +
.../structure/io/graphson/_3_3_0/por-v3d0.json | 31 +
.../graphson/_3_3_0/property-v2d0-no-types.json | 11 +-
.../graphson/_3_3_0/property-v2d0-partial.json | 18 -
.../io/graphson/_3_3_0/property-v3d0.json | 25 +
.../io/graphson/_3_3_0/scope-v3d0.json | 4 +
.../_3_3_0/sessionclose-v2d0-partial.json | 5 +-
.../io/graphson/_3_3_0/sessionclose-v3d0.json | 11 +
.../_3_3_0/sessioneval-v2d0-partial.json | 5 +-
.../io/graphson/_3_3_0/sessioneval-v3d0.json | 19 +
.../_3_3_0/sessionevalaliased-v2d0-partial.json | 5 +-
.../_3_3_0/sessionevalaliased-v3d0.json | 22 +
.../_3_3_0/sessionlesseval-v2d0-partial.json | 5 +-
.../graphson/_3_3_0/sessionlesseval-v3d0.json | 15 +
.../sessionlessevalaliased-v2d0-partial.json | 5 +-
.../_3_3_0/sessionlessevalaliased-v3d0.json | 18 +
.../io/graphson/_3_3_0/short-v3d0.json | 4 +
.../_3_3_0/standardresult-v2d0-no-types.json | 5 -
.../_3_3_0/standardresult-v2d0-partial.json | 20 -
.../io/graphson/_3_3_0/standardresult-v3d0.json | 91 +
.../_3_3_0/stargraph-v2d0-no-types.json | 5 -
.../graphson/_3_3_0/stargraph-v2d0-partial.json | 20 -
.../io/graphson/_3_3_0/stargraph-v3d0.json | 82 +
.../structure/io/graphson/_3_3_0/t-v3d0.json | 4 +
.../io/graphson/_3_3_0/timestamp-v3d0.json | 4 +
.../_3_3_0/tinkergraph-v2d0-no-types.json | 85 +-
.../_3_3_0/tinkergraph-v2d0-partial.json | 210 +-
.../io/graphson/_3_3_0/tinkergraph-v3d0.json | 829 ++++++
.../graphson/_3_3_0/traversalmetrics-v3d0.json | 114 +
.../_3_3_0/traverser-v2d0-no-types.json | 5 -
.../graphson/_3_3_0/traverser-v2d0-partial.json | 20 -
.../io/graphson/_3_3_0/traverser-v3d0.json | 109 +
.../io/graphson/_3_3_0/tree-v2d0-no-types.json | 7 -
.../io/graphson/_3_3_0/tree-v2d0-partial.json | 28 -
.../structure/io/graphson/_3_3_0/tree-v3d0.json | 165 ++
.../structure/io/graphson/_3_3_0/uuid-v3d0.json | 4 +
.../graphson/_3_3_0/vertex-v2d0-no-types.json | 5 -
.../io/graphson/_3_3_0/vertex-v2d0-partial.json | 20 -
.../io/graphson/_3_3_0/vertex-v3d0.json | 100 +
.../_3_3_0/vertexproperty-v2d0-no-types.json | 1 -
.../_3_3_0/vertexproperty-v2d0-partial.json | 4 -
.../io/graphson/_3_3_0/vertexproperty-v3d0.json | 11 +
.../structure/io/graphson/_3_3_0/year-v3d0.json | 4 +
.../io/graphson/_3_3_0/yearmonth-v3d0.json | 4 +
.../io/graphson/_3_3_0/zoneddatetime-v3d0.json | 4 +
.../io/graphson/_3_3_0/zoneoffset-v3d0.json | 4 +
.../neo4j/jsr223/Neo4jGremlinPlugin.java | 6 +
.../spark/jsr223/SparkGremlinPlugin.java | 6 +
.../SparkSingleIterationStrategy.java | 15 +-
.../SparkSingleIterationStrategyTest.java | 118 +-
.../jsr223/TinkerGraphGremlinPlugin.java | 42 +-
.../tinkergraph/structure/TinkerGraph.java | 2 +-
.../structure/TinkerIoRegistryV3d0.java | 217 ++
223 files changed, 10037 insertions(+), 1167 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/3c321ca8/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/SaslAuthenticationHandler.java
----------------------------------------------------------------------
[27/27] tinkerpop git commit: NOTICE fixup after addition of Apache
Kerby CTR
Posted by sp...@apache.org.
NOTICE fixup after addition of Apache Kerby CTR
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/c5b9680e
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/c5b9680e
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/c5b9680e
Branch: refs/heads/master
Commit: c5b9680e70d696d000b945abbd72a3b8a3f97256
Parents: 96acd8a
Author: Stephen Mallette <sp...@genoprime.com>
Authored: Mon Feb 27 07:01:21 2017 -0500
Committer: Stephen Mallette <sp...@genoprime.com>
Committed: Mon Feb 27 07:01:21 2017 -0500
----------------------------------------------------------------------
NOTICE | 12 +++++++++++-
.../tinkerpop/gremlin/server/auth/JaasKrbUtil.java | 2 --
2 files changed, 11 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/c5b9680e/NOTICE
----------------------------------------------------------------------
diff --git a/NOTICE b/NOTICE
index 38cc440..81ee6a5 100644
--- a/NOTICE
+++ b/NOTICE
@@ -12,4 +12,14 @@ Copyright 2010-2014 Alfresco Software, Ltd.
gremlin-core/src/main/java/org/apache/tinkerpop/gremlin/structure/io/graphml/GraphMLWriterHelper.java
contains DelegatingXMLStreamWriter.java and IndentingXMLStreamWriter.java from
-modules/activiti-bpmn-converter/src/main/java/org/activiti/bpmn/converter/
\ No newline at end of file
+https://github.com/Activiti/Activiti/tree/activiti-5.16/modules/activiti-bpmn-converter/src/main/java/org/activiti/bpmn/converter
+
+------------------------------------------------------------------------
+Apache Kerby
+------------------------------------------------------------------------
+Apache Kerby
+Copyright 2015-2016 The Apache Software Foundation
+
+gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
+from
+https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/kerby-kerb/kerb-simplekdc/src/main/java/org/apache/kerby/kerberos/kerb/client/JaasKrbUtil.java
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/c5b9680e/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
index 6a2e8d3..ecc4599 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
@@ -44,8 +44,6 @@ import java.util.Set;
* package org.apache.kerby.kerberos.kerb.client, see:
* https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/kerby-kerb/kerb-simplekdc/
* src/main/java/org/apache/kerby/kerberos/kerb/client/JaasKrbUtil.java
- *
- * See also: gremlin-server/src/main/static/NOTICE
*/
public final class JaasKrbUtil {
[11/27] tinkerpop git commit: KdcFixture closing
Posted by sp...@apache.org.
KdcFixture closing
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/5c735d8f
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/5c735d8f
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/5c735d8f
Branch: refs/heads/master
Commit: 5c735d8fdf7ff4f92f031afb2d30c4361c964750
Parents: 68eff1d
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Sun Jan 8 09:50:37 2017 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 20:05:40 2017 +0100
----------------------------------------------------------------------
.../java/org/apache/tinkerpop/gremlin/server/AuditLogTest.java | 6 +++---
.../java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java | 3 ++-
.../java/org/apache/tinkerpop/gremlin/server/KdcFixture.java | 1 +
3 files changed, 6 insertions(+), 4 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/5c735d8f/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuditLogTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuditLogTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuditLogTest.java
index d8337e8..b2f0fe8 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuditLogTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuditLogTest.java
@@ -97,9 +97,10 @@ public class AuditLogTest extends AbstractGremlinServerIntegrationTest {
}
@After
- public void teardownForEachTest() {
+ public void teardownForEachTest() throws Exception {
final Logger rootLogger = Logger.getRootLogger();
rootLogger.removeAppender(recordingAppender);
+ kdcServer.close();
}
/**
@@ -151,8 +152,7 @@ public class AuditLogTest extends AbstractGremlinServerIntegrationTest {
@Test
public void shouldAuditLogWithAllowAllAuthenticator() throws Exception {
- final Cluster cluster = TestClientFactory.build().credentials("sdfsdf", "")
- .addContactPoint(kdcServer.hostname).create();
+ final Cluster cluster = TestClientFactory.build().addContactPoint(kdcServer.hostname).create();
final Client client = cluster.connect();
try {
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/5c735d8f/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
index 6d596af..7c86bcd 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
@@ -77,9 +77,10 @@ public class AuthKrb5Test extends AbstractGremlinServerIntegrationTest {
}
@After
- public void teardownForEachTest() {
+ public void teardownForEachTest() throws Exception {
final Logger rootLogger = Logger.getRootLogger();
rootLogger.removeAppender(recordingAppender);
+ kdcServer.close();
}
/**
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/5c735d8f/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
index 73aa0a7..7ff2f06 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
@@ -138,6 +138,7 @@ public class KdcFixture {
ticketCacheFile.delete();
serviceKeytabFile.delete();
testDir.delete();
+ System.clearProperty("java.security.auth.login.config");
}
private void deletePrincipals() throws KrbException {
[21/27] tinkerpop git commit: Deleted unnecessary Kerberos config file
Posted by sp...@apache.org.
Deleted unnecessary Kerberos config file
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/0e299b06
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/0e299b06
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/0e299b06
Branch: refs/heads/master
Commit: 0e299b062a1151aee25943efbf050f4db1a992fd
Parents: b878318
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Sat Jan 21 20:47:28 2017 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Sat Jan 21 21:13:43 2017 +0100
----------------------------------------------------------------------
.../apache/tinkerpop/gremlin/server/krb5.conf | 33 --------------------
1 file changed, 33 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/0e299b06/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/krb5.conf
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/krb5.conf b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/krb5.conf
deleted file mode 100644
index 9fc21d8..0000000
--- a/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/krb5.conf
+++ /dev/null
@@ -1,33 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-[libdefaults]
- kdc_realm = TEST.COM
- default_realm = TEST.COM
- udp_preference_limit = _UDP_LIMIT_
- #_KDC_TCP_PORT_
- #_KDC_UDP_PORT_
- dns_lookup_realm = false
- dns_lookup_kdc = false
- rdns = false
- canonicalize = true
-
-[realms]
- TEST.COM = {
- kdc = localhost:88
- }
\ No newline at end of file
[10/27] tinkerpop git commit: Fixed issue for byte[] when using
serializeResultToString
Posted by sp...@apache.org.
Fixed issue for byte[] when using serializeResultToString
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/c3646438
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/c3646438
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/c3646438
Branch: refs/heads/master
Commit: c36464381101197ab92b51e725d1bf947e709e2a
Parents: 5c735d8
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Sun Jan 8 17:56:15 2017 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 20:05:40 2017 +0100
----------------------------------------------------------------------
.../ser/AbstractGryoMessageSerializerV1d0.java | 3 ++
.../AbstractGremlinServerIntegrationTest.java | 1 -
.../tinkerpop/gremlin/server/AuthKrb5Test.java | 41 +++++++++-----------
3 files changed, 22 insertions(+), 23 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/c3646438/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/ser/AbstractGryoMessageSerializerV1d0.java
----------------------------------------------------------------------
diff --git a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/ser/AbstractGryoMessageSerializerV1d0.java b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/ser/AbstractGryoMessageSerializerV1d0.java
index ace6bb0..4588443 100644
--- a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/ser/AbstractGryoMessageSerializerV1d0.java
+++ b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/ser/AbstractGryoMessageSerializerV1d0.java
@@ -301,9 +301,12 @@ public abstract class AbstractGryoMessageSerializerV1d0 extends AbstractMessageS
if (msg.getResult().getData() == null) return "null";
// the IteratorHandler should return a collection so keep it as such
+ // Sasl authentication needs byte[] to pass unchanged
final Object o = msg.getResult().getData();
if (o instanceof Collection) {
return ((Collection) o).stream().map(d -> null == d ? "null" : d.toString()).collect(Collectors.toList());
+ } else if (o instanceof byte[]) {
+ return o;
} else {
return o.toString();
}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/c3646438/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AbstractGremlinServerIntegrationTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AbstractGremlinServerIntegrationTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AbstractGremlinServerIntegrationTest.java
index 56a599f..12fadb6 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AbstractGremlinServerIntegrationTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AbstractGremlinServerIntegrationTest.java
@@ -18,7 +18,6 @@
*/
package org.apache.tinkerpop.gremlin.server;
-import org.apache.tinkerpop.gremlin.util.Log4jRecordingAppender;
import org.junit.After;
import org.junit.Before;
import org.junit.Rule;
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/c3646438/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
index 7c86bcd..11b873c 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5Test.java
@@ -22,6 +22,8 @@ import org.apache.commons.lang.exception.ExceptionUtils;
import org.apache.log4j.Logger;
import org.apache.tinkerpop.gremlin.driver.Client;
import org.apache.tinkerpop.gremlin.driver.Cluster;
+import org.apache.tinkerpop.gremlin.driver.MessageSerializer;
+import org.apache.tinkerpop.gremlin.driver.ser.GryoMessageSerializerV1d0;
import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
import org.apache.tinkerpop.gremlin.util.Log4jRecordingAppender;
import org.ietf.jgss.GSSException;
@@ -241,26 +243,21 @@ public class AuthKrb5Test extends AbstractGremlinServerIntegrationTest {
// }
-// ToDo: make this into a test for gremlin-driver
-// @Test
-// public void shouldAuthenticateWithSerializeResultToString() throws Exception {
-// server = new GremlinServerAuthKrb5Integrate(getServerPrincipal(), serviceKeytabFile);
-// server.setUp();
-// loginServiceUsingKeytab();
-// loginClientUsingTicketCache();
-// MessageSerializer serializer = new GryoMessageSerializerV1d0();
-// Map config = new HashMap<String, Object>();
-// config.put("serializeResultToString", true);
-// serializer.configure(config, null);
-// final Cluster cluster = Cluster.build().jaasEntry(TESTCONSOLE)
-// .protocol(getServerPrincipalName()).addContactPoint(serverHostname).port(45940).enableSsl(false).serializer(serializer).create();
-// final Client client = cluster.connect();
-// try {
-// assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
-// assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
-// assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
-// } finally {
-// cluster.close();
-// }
-// }
+ @Test
+ public void shouldAuthenticateWithSerializeResultToString() throws Exception {
+ MessageSerializer serializer = new GryoMessageSerializerV1d0();
+ Map config = new HashMap<String, Object>();
+ config.put("serializeResultToString", true);
+ serializer.configure(config, null);
+ final Cluster cluster = TestClientFactory.build().jaasEntry(TESTCONSOLE)
+ .protocol(kdcServer.serverPrincipalName).addContactPoint(kdcServer.hostname).serializer(serializer).create();
+ final Client client = cluster.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+ }
}
[23/27] tinkerpop git commit: Merge branch 'master' into
TINKERPOP-1566
Posted by sp...@apache.org.
Merge branch 'master' into TINKERPOP-1566
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/1bbb0b2e
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/1bbb0b2e
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/1bbb0b2e
Branch: refs/heads/master
Commit: 1bbb0b2ebe421bb66d427e6f8921894f1bb34614
Parents: 4e40df9 fc12700
Author: vtslab <vt...@xs4all.nl>
Authored: Thu Feb 2 20:04:40 2017 +0100
Committer: GitHub <no...@github.com>
Committed: Thu Feb 2 20:04:40 2017 +0100
----------------------------------------------------------------------
CHANGELOG.asciidoc | 12 +
bin/validate-distribution.sh | 14 +-
docs/src/dev/developer/release.asciidoc | 23 +
docs/src/dev/io/graphson.asciidoc | 2367 ++++++++++++++++++
docs/src/recipes/centrality.asciidoc | 121 +-
.../src/reference/gremlin-applications.asciidoc | 3 +-
.../reference/implementations-hadoop.asciidoc | 10 +-
docs/src/reference/intro.asciidoc | 2 +-
docs/src/reference/preface.asciidoc | 10 +-
docs/src/reference/the-traversal.asciidoc | 10 +-
.../gremlin-language-variants/index.asciidoc | 2 +-
.../upgrade/release-3.2.x-incubating.asciidoc | 26 +-
docs/src/upgrade/release-3.3.x.asciidoc | 74 +-
docs/static/images/betweeness-example.png | Bin 8465 -> 21283 bytes
docs/static/images/filter-lambda.png | Bin 27075 -> 13440 bytes
...pache.tinkerpop.gremlin.jsr223.GremlinPlugin | 1 +
gremlin-console/src/main/bin/gremlin.sh | 4 +-
.../tinkerpop/gremlin/console/Console.groovy | 8 +-
.../gremlin/jsr223/BindingsCustomizer.java | 11 +-
.../gremlin/jsr223/BindingsGremlinPlugin.java | 101 +
.../tinkerpop/gremlin/jsr223/CoreImports.java | 45 +-
.../jsr223/DefaultBindingsCustomizer.java | 20 +-
.../DefaultGremlinScriptEngineManager.java | 34 +
.../gremlin/jsr223/LazyBindingsCustomizer.java | 20 +
.../gremlin/jsr223/ScriptCustomizer.java | 4 +
.../gremlin/jsr223/ScriptFileGremlinPlugin.java | 4 +-
.../step/map/TraversalVertexProgramStep.java | 5 +
.../MessagePassingReductionStrategy.java | 162 ++
.../process/traversal/TraversalStrategies.java | 2 +
.../traversal/step/filter/SampleGlobalStep.java | 19 +-
.../traversal/step/map/EdgeVertexStep.java | 7 +-
.../process/traversal/step/map/FlatMapStep.java | 7 +
.../process/traversal/step/map/GraphStep.java | 8 +-
.../process/traversal/step/map/GroupStep.java | 263 +-
.../traversal/step/map/OrderGlobalStep.java | 68 +-
.../traversal/step/map/PropertiesStep.java | 7 +-
.../process/traversal/step/map/VertexStep.java | 7 +-
.../step/sideEffect/GroupSideEffectStep.java | 50 +-
.../step/util/CollectingBarrierStep.java | 28 +-
.../optimization/PathRetractionStrategy.java | 66 +-
.../ComputerVerificationStrategy.java | 7 -
.../traversal/traverser/ProjectedTraverser.java | 203 ++
.../tinkerpop/gremlin/structure/Graph.java | 20 +
.../structure/io/graphson/GraphSONIo.java | 2 +-
.../structure/io/graphson/GraphSONMapper.java | 75 +-
.../structure/io/graphson/GraphSONModule.java | 206 ++
.../io/graphson/GraphSONSerializersV2d0.java | 138 +-
.../io/graphson/GraphSONSerializersV3d0.java | 584 +++++
.../structure/io/graphson/GraphSONTokens.java | 3 +-
.../structure/io/graphson/GraphSONUtil.java | 7 +
.../structure/io/graphson/GraphSONVersion.java | 3 +-
.../io/graphson/GraphSONXModuleV3d0.java | 142 ++
.../io/graphson/JavaTimeSerializersV3d0.java | 323 +++
.../io/graphson/JavaUtilSerializersV3d0.java | 85 +
.../io/graphson/TraversalSerializersV3d0.java | 390 +++
.../gremlin/structure/io/gryo/GryoVersion.java | 20 +-
.../structure/util/CloseableIterator.java | 11 +
.../util/reference/ReferenceVertexProperty.java | 10 +-
.../tinkerpop/gremlin/util/CoreImports.java | 47 +-
.../gremlin/util/function/MultiComparator.java | 75 +
.../MessagePassingReductionStrategyTest.java | 135 +
.../PathRetractionStrategyTest.java | 18 +-
.../util/function/MultiComparatorTest.java | 69 +
.../ser/GraphSONMessageSerializerV3d0.java | 115 +
.../tinkerpop/gremlin/driver/ser/SerTokens.java | 1 +
.../gremlin/driver/ser/Serializers.java | 8 +-
.../ser/GraphSONMessageSerializerV2d0Test.java | 29 +-
.../ser/GraphSONMessageSerializerV3d0Test.java | 342 +++
.../step/sideEffect/GroovyGroupTest.groovy | 10 +
.../groovy/GroovyEnvironmentIntegrateSuite.java | 2 +
.../gremlin/groovy/GroovyEnvironmentSuite.java | 2 +
.../process/GroovyProcessComputerSuite.java | 2 +
.../process/GroovyProcessStandardSuite.java | 2 +
.../gremlin/groovy/engine/GremlinExecutor.java | 20 +-
.../gremlin/groovy/engine/ScriptEngines.java | 12 +-
.../groovy/jsr223/GremlinGroovyClassLoader.java | 24 +-
.../jsr223/ManagedConcurrentValueMap.java | 4 +
.../gremlin/groovy/plugin/GremlinPlugin.java | 1 +
.../GremlinGroovyScriptEngineIntegrateTest.java | 55 +
.../driver/driver_remote_connection.py | 4 +-
.../gremlin_python/structure/io/graphson.py | 16 +-
gremlin-python/src/main/jython/setup.py | 2 +-
.../jython/tests/structure/io/test_graphson.py | 2 +-
.../jsr223/PythonGraphSONJavaTranslator.java | 4 +-
.../gremlin/python/jsr223/PythonProvider.java | 1 +
.../driver/gremlin-server-modern-secure-py.yaml | 2 +-
gremlin-server/conf/gremlin-server-classic.yaml | 12 +-
.../conf/gremlin-server-modern-py.yaml | 12 +-
.../conf/gremlin-server-modern-readonly.yaml | 12 +-
gremlin-server/conf/gremlin-server-modern.yaml | 12 +-
gremlin-server/conf/gremlin-server-neo4j.yaml | 12 +-
.../conf/gremlin-server-rest-modern.yaml | 6 +-
.../conf/gremlin-server-rest-secure.yaml | 6 +-
gremlin-server/conf/gremlin-server-secure.yaml | 12 +-
gremlin-server/conf/gremlin-server-spark.yaml | 12 +-
gremlin-server/conf/gremlin-server.yaml | 12 +-
.../gremlin/server/AbstractChannelizer.java | 9 +-
.../tinkerpop/gremlin/server/Settings.java | 6 +
.../server/auth/SimpleAuthenticator.java | 2 +-
.../handler/SaslAuthenticationHandler.java | 1 +
.../gremlin/server/op/session/Session.java | 17 +-
.../server/util/ServerGremlinExecutor.java | 12 +
.../server/GremlinServerAuthIntegrateTest.java | 25 +-
.../GremlinServerAuthOldIntegrateTest.java | 21 +-
.../server/GremlinServerHttpIntegrateTest.java | 76 +-
.../server/GremlinServerIntegrateTest.java | 90 +-
gremlin-server/src/test/resources/client.crt | 40 +
.../src/test/resources/client.key.pk8 | 47 +
.../remote/gremlin-server-integration.yaml | 6 +-
.../server/gremlin-server-integration.yaml | 6 +-
gremlin-server/src/test/resources/server.crt | 41 +
.../src/test/resources/server.key.pk8 | 47 +
.../jsr223/BindingsScriptEngineTest.java | 95 +
.../jsr223/GremlinScriptEngineSuite.java | 1 +
.../traversal/step/sideEffect/GroupTest.java | 60 +-
.../gremlin/structure/SerializationTest.java | 229 +-
.../gremlin/structure/io/IoCustomTest.java | 3 +
.../gremlin/structure/io/IoEdgeTest.java | 3 +
.../gremlin/structure/io/IoGraphTest.java | 1 +
.../gremlin/structure/io/IoPropertyTest.java | 18 +-
.../tinkerpop/gremlin/structure/io/IoTest.java | 266 +-
.../gremlin/structure/io/IoVertexTest.java | 3 +
.../tinkerpop-classic-normalized-v3d0.json | 6 +
gremlin-tools/gremlin-io-test/pom.xml | 20 +-
.../tinkerpop/gremlin/structure/io/Model.java | 15 +-
.../io/graphson/GraphSONCompatibility.java | 3 +-
.../GraphSONTypedCompatibilityTest.java | 9 +-
.../_3_3_0/authenticationchallenge-v3d0.json | 12 +
.../authenticationresponse-v2d0-partial.json | 5 +-
.../_3_3_0/authenticationresponse-v3d0.json | 9 +
.../io/graphson/_3_3_0/barrier-v3d0.json | 4 +
.../io/graphson/_3_3_0/bigdecimal-v3d0.json | 4 +
.../io/graphson/_3_3_0/biginteger-v3d0.json | 4 +
.../io/graphson/_3_3_0/binding-v3d0.json | 10 +
.../structure/io/graphson/_3_3_0/byte-v3d0.json | 4 +
.../io/graphson/_3_3_0/bytebuffer-v3d0.json | 4 +
.../io/graphson/_3_3_0/bytecode-v3d0.json | 6 +
.../io/graphson/_3_3_0/cardinality-v3d0.json | 4 +
.../structure/io/graphson/_3_3_0/char-v3d0.json | 4 +
.../io/graphson/_3_3_0/class-v3d0.json | 4 +
.../io/graphson/_3_3_0/column-v3d0.json | 4 +
.../structure/io/graphson/_3_3_0/date-v3d0.json | 4 +
.../io/graphson/_3_3_0/direction-v3d0.json | 4 +
.../io/graphson/_3_3_0/double-v3d0.json | 4 +
.../io/graphson/_3_3_0/duration-v3d0.json | 4 +
.../io/graphson/_3_3_0/edge-v2d0-no-types.json | 5 +-
.../io/graphson/_3_3_0/edge-v2d0-partial.json | 10 +-
.../structure/io/graphson/_3_3_0/edge-v3d0.json | 32 +
.../io/graphson/_3_3_0/float-v3d0.json | 4 +
.../io/graphson/_3_3_0/inetaddress-v3d0.json | 4 +
.../io/graphson/_3_3_0/instant-v3d0.json | 4 +
.../io/graphson/_3_3_0/integer-v3d0.json | 4 +
.../io/graphson/_3_3_0/lambda-v3d0.json | 8 +
.../io/graphson/_3_3_0/localdate-v3d0.json | 4 +
.../io/graphson/_3_3_0/localdatetime-v3d0.json | 4 +
.../io/graphson/_3_3_0/localtime-v3d0.json | 4 +
.../structure/io/graphson/_3_3_0/long-v3d0.json | 4 +
.../io/graphson/_3_3_0/metrics-v3d0.json | 54 +
.../io/graphson/_3_3_0/monthday-v3d0.json | 4 +
.../io/graphson/_3_3_0/offsetdatetime-v3d0.json | 4 +
.../io/graphson/_3_3_0/offsettime-v3d0.json | 4 +
.../io/graphson/_3_3_0/operator-v3d0.json | 4 +
.../io/graphson/_3_3_0/order-v3d0.json | 4 +
.../structure/io/graphson/_3_3_0/p-v3d0.json | 10 +
.../structure/io/graphson/_3_3_0/pand-v3d0.json | 25 +
.../io/graphson/_3_3_0/path-v2d0-no-types.json | 7 -
.../io/graphson/_3_3_0/path-v2d0-partial.json | 28 -
.../structure/io/graphson/_3_3_0/path-v3d0.json | 150 ++
.../io/graphson/_3_3_0/period-v3d0.json | 4 +
.../structure/io/graphson/_3_3_0/pick-v3d0.json | 4 +
.../structure/io/graphson/_3_3_0/pop-v3d0.json | 4 +
.../structure/io/graphson/_3_3_0/por-v3d0.json | 31 +
.../graphson/_3_3_0/property-v2d0-no-types.json | 11 +-
.../graphson/_3_3_0/property-v2d0-partial.json | 18 -
.../io/graphson/_3_3_0/property-v3d0.json | 25 +
.../io/graphson/_3_3_0/scope-v3d0.json | 4 +
.../_3_3_0/sessionclose-v2d0-partial.json | 5 +-
.../io/graphson/_3_3_0/sessionclose-v3d0.json | 11 +
.../_3_3_0/sessioneval-v2d0-partial.json | 5 +-
.../io/graphson/_3_3_0/sessioneval-v3d0.json | 19 +
.../_3_3_0/sessionevalaliased-v2d0-partial.json | 5 +-
.../_3_3_0/sessionevalaliased-v3d0.json | 22 +
.../_3_3_0/sessionlesseval-v2d0-partial.json | 5 +-
.../graphson/_3_3_0/sessionlesseval-v3d0.json | 15 +
.../sessionlessevalaliased-v2d0-partial.json | 5 +-
.../_3_3_0/sessionlessevalaliased-v3d0.json | 18 +
.../io/graphson/_3_3_0/short-v3d0.json | 4 +
.../_3_3_0/standardresult-v2d0-no-types.json | 5 -
.../_3_3_0/standardresult-v2d0-partial.json | 20 -
.../io/graphson/_3_3_0/standardresult-v3d0.json | 91 +
.../_3_3_0/stargraph-v2d0-no-types.json | 5 -
.../graphson/_3_3_0/stargraph-v2d0-partial.json | 20 -
.../io/graphson/_3_3_0/stargraph-v3d0.json | 82 +
.../structure/io/graphson/_3_3_0/t-v3d0.json | 4 +
.../io/graphson/_3_3_0/timestamp-v3d0.json | 4 +
.../_3_3_0/tinkergraph-v2d0-no-types.json | 85 +-
.../_3_3_0/tinkergraph-v2d0-partial.json | 210 +-
.../io/graphson/_3_3_0/tinkergraph-v3d0.json | 829 ++++++
.../graphson/_3_3_0/traversalmetrics-v3d0.json | 114 +
.../_3_3_0/traverser-v2d0-no-types.json | 5 -
.../graphson/_3_3_0/traverser-v2d0-partial.json | 20 -
.../io/graphson/_3_3_0/traverser-v3d0.json | 109 +
.../io/graphson/_3_3_0/tree-v2d0-no-types.json | 7 -
.../io/graphson/_3_3_0/tree-v2d0-partial.json | 28 -
.../structure/io/graphson/_3_3_0/tree-v3d0.json | 165 ++
.../structure/io/graphson/_3_3_0/uuid-v3d0.json | 4 +
.../graphson/_3_3_0/vertex-v2d0-no-types.json | 5 -
.../io/graphson/_3_3_0/vertex-v2d0-partial.json | 20 -
.../io/graphson/_3_3_0/vertex-v3d0.json | 100 +
.../_3_3_0/vertexproperty-v2d0-no-types.json | 1 -
.../_3_3_0/vertexproperty-v2d0-partial.json | 4 -
.../io/graphson/_3_3_0/vertexproperty-v3d0.json | 11 +
.../structure/io/graphson/_3_3_0/year-v3d0.json | 4 +
.../io/graphson/_3_3_0/yearmonth-v3d0.json | 4 +
.../io/graphson/_3_3_0/zoneddatetime-v3d0.json | 4 +
.../io/graphson/_3_3_0/zoneoffset-v3d0.json | 4 +
.../neo4j/jsr223/Neo4jGremlinPlugin.java | 6 +
.../spark/jsr223/SparkGremlinPlugin.java | 6 +
.../SparkSingleIterationStrategy.java | 15 +-
.../SparkSingleIterationStrategyTest.java | 118 +-
.../jsr223/TinkerGraphGremlinPlugin.java | 42 +-
.../tinkergraph/structure/TinkerGraph.java | 2 +-
.../structure/TinkerIoRegistryV3d0.java | 217 ++
223 files changed, 10037 insertions(+), 1167 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/1bbb0b2e/CHANGELOG.asciidoc
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/1bbb0b2e/docs/src/reference/gremlin-applications.asciidoc
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/1bbb0b2e/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/Settings.java
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/1bbb0b2e/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/SaslAuthenticationHandler.java
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/1bbb0b2e/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthIntegrateTest.java
----------------------------------------------------------------------
diff --cc gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthIntegrateTest.java
index 574c789,8488f28..37c4095
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthIntegrateTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthIntegrateTest.java
@@@ -23,7 -23,8 +23,9 @@@ import org.apache.tinkerpop.gremlin.dri
import org.apache.tinkerpop.gremlin.driver.Cluster;
import org.apache.tinkerpop.gremlin.driver.exception.ResponseException;
import org.apache.tinkerpop.gremlin.server.auth.SimpleAuthenticator;
+import org.ietf.jgss.GSSException;
+ import org.apache.tinkerpop.gremlin.structure.Property;
+ import org.apache.tinkerpop.gremlin.structure.Vertex;
import org.junit.Test;
import java.util.HashMap;
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/1bbb0b2e/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthOldIntegrateTest.java
----------------------------------------------------------------------
diff --cc gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthOldIntegrateTest.java
index 5313bda,7fd3c61..3852ca1
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthOldIntegrateTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuthOldIntegrateTest.java
@@@ -24,7 -24,8 +24,9 @@@ import org.apache.tinkerpop.gremlin.dri
import org.apache.tinkerpop.gremlin.driver.exception.ResponseException;
import org.apache.tinkerpop.gremlin.driver.ser.Serializers;
import org.apache.tinkerpop.gremlin.server.auth.SimpleAuthenticator;
+import org.ietf.jgss.GSSException;
+ import org.apache.tinkerpop.gremlin.structure.Property;
+ import org.apache.tinkerpop.gremlin.structure.Vertex;
import org.junit.Test;
import java.util.HashMap;
[05/27] tinkerpop git commit: Kerberos authenticator files added
Posted by sp...@apache.org.
Kerberos authenticator files added
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/b3cb7e97
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/b3cb7e97
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/b3cb7e97
Branch: refs/heads/master
Commit: b3cb7e978a1f1a3f4edec1c9fb049345b3634f2b
Parents: d1f0889
Author: vtslab <vt...@xs4all.nl>
Authored: Fri Nov 25 11:48:32 2016 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Jan 18 19:58:48 2017 +0100
----------------------------------------------------------------------
gremlin-server/pom.xml | 18 ++
.../gremlin/server/auth/JaasKrbUtil.java | 101 ++++++++++
.../gremlin/server/auth/Krb5Authenticator.java | 201 +++++++++++++++++++
.../kerb/integration/test/AppClient.java | 70 +++++++
.../kerb/integration/test/AppServer.java | 87 ++++++++
.../kerberos/kerb/integration/test/AppTest.java | 87 ++++++++
.../kerb/integration/test/SaslAppTest.java | 55 +++++
.../kerb/integration/test/Transport.java | 137 +++++++++++++
.../integration/test/sasl/SaslAppClient.java | 106 ++++++++++
.../integration/test/sasl/SaslAppServer.java | 139 +++++++++++++
.../kerby/kerberos/kerb/server/KdcTestBase.java | 176 ++++++++++++++++
.../kerberos/kerb/server/LoginTestBase.java | 83 ++++++++
.../kerberos/kerb/server/TestKdcServer.java | 54 +++++
.../gremlin/server/AuthKrb5IntegrateTest.java | 146 ++++++++++++++
.../tinkerpop/gremlin/server/backend.conf | 19 ++
.../gremlin/server/gremlin-console-jaas.conf | 25 +++
.../apache/tinkerpop/gremlin/server/kdc.conf | 21 ++
.../apache/tinkerpop/gremlin/server/krb5.conf | 33 +++
18 files changed, 1558 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/pom.xml
----------------------------------------------------------------------
diff --git a/gremlin-server/pom.xml b/gremlin-server/pom.xml
index dc40bab..3cae525 100644
--- a/gremlin-server/pom.xml
+++ b/gremlin-server/pom.xml
@@ -110,6 +110,24 @@ limitations under the License.
<version>${project.version}</version>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>org.apache.kerby</groupId>
+ <artifactId>kerb-simplekdc</artifactId>
+ <version>1.0.0-RC2</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.kerby</groupId>
+ <artifactId>client-tool</artifactId>
+ <version>1.0.0-RC2</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.assertj</groupId>
+ <artifactId>assertj-core</artifactId>
+ <version>2.3.0</version>
+ <scope>test</scope>
+ </dependency>
</dependencies>
<build>
<directory>${basedir}/target</directory>
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
new file mode 100644
index 0000000..3a8099a
--- /dev/null
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
@@ -0,0 +1,101 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.tinkerpop.gremlin.server.auth;
+
+import javax.security.auth.Subject;
+import javax.security.auth.kerberos.KerberosPrincipal;
+import javax.security.auth.login.AppConfigurationEntry;
+import javax.security.auth.login.Configuration;
+import javax.security.auth.login.LoginContext;
+import javax.security.auth.login.LoginException;
+import java.io.File;
+import java.security.Principal;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+
+
+/**
+ * JAAS utilities for Kerberos login.
+ *
+ * Pruned but otherwise literal copy from package org.apache.kerby.kerberos.kerb.client, see:
+ * https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/kerby-kerb/kerb-simplekdc/
+ * src/main/java/org/apache/kerby/kerberos/kerb/client/JaasKrbUtil.java
+ *
+ * ToDo: isIniator=true is probably wrong for keytab login, but passes the test
+ * ToDo: consider making JaasKrbUtil an explicit project dependency
+ */
+public final class JaasKrbUtil {
+
+ public static final boolean ENABLE_DEBUG = false;
+
+ private JaasKrbUtil() { }
+
+ public static Subject loginUsingKeytab(String principal, File keytabFile) throws LoginException {
+ Set<Principal> principals = new HashSet<Principal>();
+ principals.add(new KerberosPrincipal(principal));
+ Subject subject = new Subject(false, principals, new HashSet<Object>(), new HashSet<Object>());
+ Configuration conf = useKeytab(principal, keytabFile);
+ String confName = "KeytabConf";
+ LoginContext loginContext = new LoginContext(confName, subject, null, conf);
+ loginContext.login();
+ return loginContext.getSubject();
+ }
+
+ public static Configuration useKeytab(String principal, File keytabFile) {
+ return new KeytabJaasConf(principal, keytabFile);
+ }
+
+ private static String getKrb5LoginModuleName() {
+ return System.getProperty("java.vendor").contains("IBM")
+ ? "com.ibm.security.auth.module.Krb5LoginModule"
+ : "com.sun.security.auth.module.Krb5LoginModule";
+ }
+
+ static class KeytabJaasConf extends Configuration {
+ private String principal;
+ private File keytabFile;
+
+ KeytabJaasConf(String principal, File keytab) {
+ this.principal = principal;
+ this.keytabFile = keytab;
+ }
+
+ @Override
+ public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
+ Map<String, String> options = new HashMap<String, String>();
+ options.put("keyTab", keytabFile.getAbsolutePath());
+ options.put("principal", principal);
+ options.put("useKeyTab", "true");
+ options.put("storeKey", "true");
+ options.put("doNotPrompt", "true");
+ options.put("renewTGT", "false");
+ options.put("refreshKrb5Config", "true");
+ options.put("isInitiator", "true");
+ options.put("debug", String.valueOf(ENABLE_DEBUG));
+
+ return new AppConfigurationEntry[]{
+ new AppConfigurationEntry(getKrb5LoginModuleName(),
+ AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
+ options)};
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
new file mode 100644
index 0000000..bf09368
--- /dev/null
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
@@ -0,0 +1,201 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.tinkerpop.gremlin.server.auth;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.security.auth.Subject;
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.UnsupportedCallbackException;
+import javax.security.sasl.AuthorizeCallback;
+import javax.security.sasl.Sasl;
+import javax.security.sasl.SaslServer;
+import java.io.File;
+import java.net.InetAddress;
+import java.security.PrivilegedAction;
+import java.util.HashMap;
+import java.util.Map;
+
+
+/**
+ * A Kerberos implementation of an {@link Authenticator}
+ *
+ * @author Marc de Lignie
+ */
+public class Krb5Authenticator implements Authenticator {
+ private static final Logger logger = LoggerFactory.getLogger(Krb5Authenticator.class);
+ private Subject subject;
+ private String principalName;
+
+ @Override
+ public boolean requireAuthentication() {
+ return true;
+ }
+
+ /**
+ * Called once on server startup with the authentication.config from the *.yaml file
+ */
+ @Override
+ public void setup(final Map<String, Object> config) {
+ final String KEYTAB_KEY = "keytab";
+ final String PRINCIPAL_KEY = "principal";
+
+ logger.info("Config: {}", config);
+
+ if (null == config || !config.containsKey(KEYTAB_KEY) || !config.containsKey(PRINCIPAL_KEY)) {
+ throw new IllegalArgumentException(String.format(
+ "Could not configure a %s - provide a 'config' in the 'authentication' settings",
+ Krb5Authenticator.class.getName()));
+ }
+ try {
+ File keytabFile = new File((String) config.get(KEYTAB_KEY));
+ principalName = (String) config.get(PRINCIPAL_KEY);
+ subject = JaasKrbUtil.loginUsingKeytab(principalName, keytabFile);
+ } catch (Exception e) {
+ logger.warn("Failed to login to kdc");
+ }
+ logger.debug("Done logging in to kdc");
+ }
+
+ @Override
+ public SaslNegotiator newSaslNegotiator(final InetAddress remoteAddress) {
+ logger.debug("newSaslNegotiator() called");
+ return Subject.doAs(subject,
+ new PrivilegedAction<SaslNegotiator>() {
+ public SaslNegotiator run() {
+ return new Krb5SaslAuthenticator();
+ }
+ }
+ );
+ }
+
+ /**
+ * @deprecated As of release 3.1.1-incubating, replaced by {@link #newSaslNegotiator(InetAddress)}.
+ */
+ @Override
+ @Deprecated
+ public SaslNegotiator newSaslNegotiator() {
+ return null;
+ }
+
+ public AuthenticatedUser authenticate(final Map<String, String> credentials) throws AuthenticationException {
+ logger.error("Authenticate() should not be called. Use getAuthenticatedUser() when isComplete() is true.");
+ return null;
+ }
+
+ /*
+ * Invoked by:
+ * https://github.com/apache/tinkerpop/blob/3.1.1-incubating/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/SaslAuthenticationHandler.java
+ * Negotiates with evaluateChallenge() of the generic sasl handler in gremlin console:
+ * https://github.com/apache/tinkerpop/blob/3.1.1-incubating/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Handler.java
+ * See also:
+ * https://docs.oracle.com/javase/8/docs/technotes/guides/security/sasl/sasl-refguide.html
+ * https://docs.oracle.com/javase/8/docs/api/org/ietf/jgss/GSSContext.html
+ * Kerberos authentication/authorization message flow:
+ * http://www.roguelynn.com/words/explain-like-im-5-kerberos/
+ */
+ private class Krb5SaslAuthenticator implements Authenticator.SaslNegotiator, CallbackHandler {
+ private String mechanism = "GSSAPI";
+ private String gremlinQOP = "auth";
+ private SaslServer saslServer;
+
+ Krb5SaslAuthenticator() {
+ try {
+ Map props = new HashMap<String, Object>();
+ // Set secure values for relevant sasl properties regarding GSSAPI, see:
+ // https://docs.oracle.com/javase/8/docs/technotes/guides/security/sasl/sasl-refguide.html#SERVER
+ // Rely on GSSAPI defaults for Sasl.MAX_BUFFER and "javax.security.sasl.sendmaxbuffer"
+ // ToDo: check impact of policies on a system with cyrus sasl
+// props.put(Sasl.POLICY_NOANONYMOUS, System.getProperty(Sasl.POLICY_NOANONYMOUS, "true"));
+// props.put(Sasl.POLICY_NOACTIVE, System.getProperty(Sasl.POLICY_NOACTIVE, "true"));
+// props.put(Sasl.POLICY_NOPLAINTEXT, System.getProperty(Sasl.POLICY_NOPLAINTEXT, "true"));
+ String[] principalParts = principalName.split("/|@");
+ if (principalParts.length < 3) throw new IllegalArgumentException("Use principal name of format 'service/fqdn@kdcrealm'");
+ saslServer = Sasl.createSaslServer(mechanism, principalParts[0], principalParts[1], props, Krb5SaslAuthenticator.this);
+ } catch(Exception e) {
+ logger.error("Creating sasl server failed: ", e);
+ }
+ logger.debug("SaslServer created with: " + saslServer.getMechanismName());
+ // ToDo: check other Sasl.QoP values on a system with cyrus sasl
+ if (System.getProperty(Sasl.QOP) != gremlinQOP)
+ logger.warn("Gremlin server with libgsasl does not support Sasl.QOP security layer features, use SSL");
+ }
+
+ /*
+ * This method is based on the handle() method from:
+ * https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/kerby-kerb/integration-test/src/main/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppServer.java
+ * Other example sources:
+ * https://gist.github.com/honza889/1347ddee89311dd636d5 (APL)
+ * https://github.com/wildfly-security/jboss-sasl/blob/master/src/test/java/org/jboss/sasl/test/ServerCallbackHandler.java (GPL)
+ */
+ @Override
+ public void handle(Callback[] callbacks) throws UnsupportedCallbackException {
+ logger.debug("Krb5 AuthorizeCallback number: " + callbacks.length);
+ AuthorizeCallback ac = null;
+ for (Callback callback : callbacks) {
+ if (callback instanceof AuthorizeCallback) {
+ ac = (AuthorizeCallback) callback;
+ } else {
+ throw new UnsupportedCallbackException(callback, "Unrecognized SASL GSSAPI Callback");
+ }
+ }
+ if (ac != null) {
+ String authid = ac.getAuthenticationID();
+ String authzid = ac.getAuthorizationID();
+ if (authid.equals(authzid)) { // Check whether the service ticket belongs to the authenticated user
+ ac.setAuthorized(true);
+ } else {
+ ac.setAuthorized(false);
+ }
+ if (ac.isAuthorized()) { // Get user name from his principal name
+ String[] authidParts = authid.split("@");
+ ac.setAuthorizedID(authidParts[0]);
+ }
+ }
+ }
+
+ @Override
+ public byte[] evaluateResponse(final byte[] clientResponse) throws AuthenticationException {
+ logger.debug("evaluateResponse() length: " + clientResponse.length);
+ byte[] response = null;
+ try {
+ response = saslServer.evaluateResponse(clientResponse);
+ } catch (Exception e) {
+ logger.warn("Sasl krb5 evaluateResponse failed: " + e);
+ throw new AuthenticationException(e);
+ }
+ return response;
+ }
+
+ @Override
+ public boolean isComplete() {
+ return saslServer.isComplete();
+ }
+
+ @Override
+ // todo: apply for audit logging, see related todo in gremlin-server/.../SaslAuthenticationHandler.java
+ public AuthenticatedUser getAuthenticatedUser() throws AuthenticationException {
+ logger.debug("getAuthenticatedUser called: " + saslServer.getAuthorizationID());
+ return new AuthenticatedUser(saslServer.getAuthorizationID());
+ }
+
+ }
+}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppClient.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppClient.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppClient.java
new file mode 100644
index 0000000..c0a636a
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppClient.java
@@ -0,0 +1,70 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kerb.integration.test;
+
+import java.io.IOException;
+
+public abstract class AppClient {
+ private Transport.Connection conn;
+ private boolean isTestOK = false;
+
+ public AppClient(String[] args) throws Exception {
+ usage(args);
+
+ String hostName = args[0];
+ int port = Integer.parseInt(args[1]);
+
+ this.conn = Transport.Connector.connect(hostName, port);
+ }
+
+ protected void usage(String[] args) {
+ if (args.length < 2) {
+ System.err.println("Usage: java <options> AppClient "
+ + "<server-host> <server-port>");
+ throw new RuntimeException("Arguments are invalid.");
+ }
+ }
+
+ public void run() {
+ // System.out.println("Connected to server");
+
+ try {
+ withConnection(conn);
+ } catch (Exception e) {
+ e.printStackTrace();
+ } finally {
+ try {
+ conn.close();
+ } catch (IOException e) {
+ e.printStackTrace();
+ }
+ }
+ }
+
+ protected abstract void withConnection(Transport.Connection conn) throws Exception;
+
+ public boolean isTestOK() {
+ return isTestOK;
+ }
+
+ protected synchronized void setTestOK(boolean isOK) {
+ this.isTestOK = isOK;
+ }
+}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppServer.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppServer.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppServer.java
new file mode 100644
index 0000000..77abc65
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppServer.java
@@ -0,0 +1,87 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kerb.integration.test;
+
+import java.io.IOException;
+
+/**
+ * Making it runnable because the server will be launched in a separate thread
+ * in a test.
+ */
+public abstract class AppServer implements Runnable {
+ protected Transport.Acceptor acceptor;
+ private boolean terminated = false;
+
+ public AppServer(String[] args) throws IOException {
+ usage(args);
+
+ int listenPort = Integer.parseInt(args[0]);
+ this.acceptor = new Transport.Acceptor(listenPort);
+ }
+
+ protected void usage(String[] args) {
+ if (args.length < 1) {
+ System.err.println("Usage: AppServer <ListenPort>");
+ throw new RuntimeException("Usage: AppServer <ListenPort>");
+ }
+ }
+
+ public synchronized void start() {
+ new Thread(this).start();
+ }
+
+ public synchronized void stop() {
+ terminated = true;
+ }
+
+ @Override
+ public void run() {
+ try {
+ synchronized (this) {
+ while (!terminated) {
+ runOnce();
+ }
+ }
+ } finally {
+ acceptor.close();
+ }
+ }
+
+ private void runOnce() {
+ // System.out.println("Waiting for incoming connection...");
+
+ Transport.Connection conn = acceptor.accept();
+ // System.out.println("Got connection from client");
+
+ try {
+ onConnection(conn);
+ } catch (Exception e) {
+ e.printStackTrace();
+ } finally {
+ try {
+ conn.close();
+ } catch (IOException e) {
+ e.printStackTrace();
+ }
+ }
+ }
+
+ protected abstract void onConnection(Transport.Connection conn) throws Exception;
+}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppTest.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppTest.java
new file mode 100644
index 0000000..0964598
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/AppTest.java
@@ -0,0 +1,87 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kerb.integration.test;
+
+import org.apache.kerby.kerberos.kerb.server.LoginTestBase;
+import org.apache.kerby.util.NetworkUtil;
+import org.junit.Assert;
+import org.junit.Before;
+
+import javax.security.auth.Subject;
+import java.security.PrivilegedAction;
+
+public abstract class AppTest extends LoginTestBase {
+ private int serverPort;
+ protected AppClient appClient;
+ protected AppServer appServer;
+
+ @Before
+ @Override
+ public void setUp() throws Exception {
+ super.setUp();
+
+ serverPort = NetworkUtil.getServerPort();
+
+ setupAppServer();
+ }
+
+ protected int getServerPort() {
+ return serverPort;
+ }
+
+ protected void setupAppServer() throws Exception {
+ Subject subject = loginServiceUsingKeytab();
+ Subject.doAs(subject, new PrivilegedAction<Object>() {
+ @Override
+ public Object run() {
+ try {
+ appServer = createAppServer();
+ appServer.start();
+ } catch (Exception e) {
+ e.printStackTrace();
+ }
+ return null;
+ }
+ });
+ }
+
+ protected abstract AppServer createAppServer() throws Exception;
+
+ protected void runAppClient() throws Exception {
+ Subject subject = loginClientUsingTicketCache();
+ Subject.doAs(subject, new PrivilegedAction<Object>() {
+ @Override
+ public Object run() {
+ try {
+ appClient = createAppClient();
+ appClient.run();
+ } catch (Exception e) {
+ e.printStackTrace();
+ }
+ return null;
+ }
+ });
+
+ Assert.assertTrue("Client successfully connected and authenticated to server",
+ appClient.isTestOK());
+ }
+
+ protected abstract AppClient createAppClient() throws Exception;
+}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/SaslAppTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/SaslAppTest.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/SaslAppTest.java
new file mode 100644
index 0000000..332d046
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/SaslAppTest.java
@@ -0,0 +1,55 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kerb.integration.test;
+
+import org.apache.kerby.kerberos.kerb.integration.test.sasl.SaslAppClient;
+import org.apache.kerby.kerberos.kerb.integration.test.sasl.SaslAppServer;
+import org.junit.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+
+public class SaslAppTest extends AppTest {
+
+ @Override
+ protected AppServer createAppServer() throws Exception {
+ return new SaslAppServer(new String[] {
+ String.valueOf(getServerPort()),
+ getServerPrincipalName(),
+ getHostname()
+ });
+ }
+
+ @Override
+ protected AppClient createAppClient() throws Exception {
+ return new SaslAppClient(new String[] {
+ getHostname(),
+ String.valueOf(getServerPort()),
+ getServerPrincipalName(),
+ getHostname()
+ });
+ }
+
+ @Test
+ //TODO: not robust enough, with "ICMP Port Unreachable" exception.
+ public void test() throws Exception {
+ runAppClient();
+ }
+}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/Transport.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/Transport.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/Transport.java
new file mode 100644
index 0000000..50bad1a
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/Transport.java
@@ -0,0 +1,137 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kerb.integration.test;
+
+import java.io.DataInputStream;
+import java.io.DataOutputStream;
+import java.io.IOException;
+import java.net.ServerSocket;
+import java.net.Socket;
+import java.nio.charset.StandardCharsets;
+
+public class Transport {
+
+ public static class Acceptor {
+ ServerSocket serverSocket;
+
+ public Acceptor(int listenPort) throws IOException {
+ this.serverSocket = new ServerSocket(listenPort);
+ }
+
+ public Connection accept() {
+ try {
+ Socket socket = serverSocket.accept();
+ return new Connection(socket);
+ } catch (IOException ioe) {
+ throw new RuntimeException(ioe);
+ }
+ }
+
+ public void close() {
+ try {
+ serverSocket.close();
+ } catch (IOException e) {
+ e.printStackTrace();
+ }
+ }
+ }
+
+ public static class Connector {
+ public static Connection connect(String host,
+ int port) throws IOException {
+ Socket socket = new Socket(host, port);
+ return new Connection(socket);
+ }
+ }
+
+ public static class Connection {
+ private Socket socket;
+ private DataInputStream instream;
+ private DataOutputStream outstream;
+
+ public Connection(Socket socket) throws IOException {
+ this.socket = socket;
+ instream = new DataInputStream(socket.getInputStream());
+ outstream = new DataOutputStream(socket.getOutputStream());
+ }
+
+ public void close() throws IOException {
+ socket.close();
+ }
+
+ public void sendToken(byte[] token) throws IOException {
+ if (token != null) {
+ outstream.writeInt(token.length);
+ outstream.write(token);
+ } else {
+ outstream.writeInt(0);
+ }
+ outstream.flush();
+ }
+
+ public void sendMessage(Message msg) throws IOException {
+ if (msg != null) {
+ sendToken(msg.header);
+ sendToken(msg.body);
+ }
+ }
+
+ public void sendMessage(byte[] header, byte[] body) throws IOException {
+ sendMessage(new Message(header, body));
+ }
+
+ public void sendMessage(String header, byte[] body) throws IOException {
+ sendMessage(new Message(header, body));
+ }
+
+ public byte[] recvToken() throws IOException {
+ int len = instream.readInt();
+ if (len > 0) {
+ byte[] token = new byte[len];
+ instream.readFully(token);
+ return token;
+ }
+ return null;
+ }
+
+ public Message recvMessage() throws IOException {
+ byte[] header = recvToken();
+ byte[] body = recvToken();
+ Message msg = new Message(header, body);
+ return msg;
+ }
+ }
+
+ public static class Message {
+ public byte[] header;
+ public byte[] body;
+
+
+ Message(byte[] header, byte[] body) {
+ this.header = header;
+ this.body = body;
+ }
+
+ public Message(String header, byte[] body) {
+ this.header = header.getBytes(StandardCharsets.UTF_8);
+ this.body = body;
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppClient.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppClient.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppClient.java
new file mode 100644
index 0000000..b928e01
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppClient.java
@@ -0,0 +1,106 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kerb.integration.test.sasl;
+
+import org.apache.kerby.kerberos.kerb.integration.test.AppClient;
+import org.apache.kerby.kerberos.kerb.integration.test.Transport;
+
+import javax.security.sasl.Sasl;
+import javax.security.sasl.SaslClient;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.Map;
+
+public class SaslAppClient extends AppClient {
+ private SaslClient saslClient;
+
+ public SaslAppClient(String[] args) throws Exception {
+ super(args);
+
+ String protocol = args[2];
+ String serverFqdn = args[3];
+ Map<String, String> props = new HashMap<String, String>();
+ props.put(Sasl.QOP, "auth");
+
+ this.saslClient = Sasl.createSaslClient(new String[]{"GSSAPI"}, null,
+ protocol, serverFqdn, props, null);
+ }
+
+ public static void main(String[] args) throws Exception {
+ new SaslAppClient(args).run();
+ }
+
+ @Override
+ protected void usage(String[] args) {
+ if (args.length < 4) {
+ System.err.println("Usage: SaslAppClient "
+ + "<server-host> <server-port> <service-protocol> <server-fqdn>");
+ throw new RuntimeException("Usage: SaslAppClient "
+ + "<server-host> <server-port> <service-protocol> <server-fqdn>");
+ }
+ }
+
+ @Override
+ protected void withConnection(Transport.Connection conn) throws Exception {
+ byte[] token = saslClient.hasInitialResponse() ? new byte[0] : null;
+ token = saslClient.evaluateChallenge(token);
+ conn.sendMessage("CONT", token);
+
+ Transport.Message msg = conn.recvMessage();
+ while (!saslClient.isComplete() && (isContinue(msg) || isOK(msg))) {
+ byte[] respToken = saslClient.evaluateChallenge(msg.body);
+
+ if (isOK(msg)) {
+ if (respToken != null) {
+ throw new IOException("Attempting to send response after completion");
+ }
+ break;
+ } else {
+ conn.sendMessage("CONT", respToken);
+ msg = conn.recvMessage();
+ }
+ }
+
+ //System.out.println("Context Established! ");
+
+ token = "Hello There!\0".getBytes(StandardCharsets.UTF_8);
+ //System.out.println("Will send wrap token of size " + token.length);
+
+ conn.sendToken(token);
+ setTestOK(true);
+
+ saslClient.dispose();
+ }
+
+ private boolean isOK(Transport.Message msg) {
+ if (msg.header != null) {
+ return new String(msg.header, StandardCharsets.UTF_8).equals("OK");
+ }
+ return false;
+ }
+
+ private boolean isContinue(Transport.Message msg) {
+ if (msg.header != null) {
+ return new String(msg.header, StandardCharsets.UTF_8).equals("CONT");
+ }
+ return false;
+ }
+}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppServer.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppServer.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppServer.java
new file mode 100644
index 0000000..8c4c646
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppServer.java
@@ -0,0 +1,139 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kerb.integration.test.sasl;
+
+import org.apache.kerby.kerberos.kerb.integration.test.AppServer;
+import org.apache.kerby.kerberos.kerb.integration.test.Transport;
+
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.UnsupportedCallbackException;
+import javax.security.sasl.AuthorizeCallback;
+import javax.security.sasl.Sasl;
+import javax.security.sasl.SaslException;
+import javax.security.sasl.SaslServer;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+public class SaslAppServer extends AppServer {
+ private String mechanism;
+ private String serviceProtocol;
+ private String serverFqdn;
+
+ public SaslAppServer(String[] args) throws Exception {
+ super(args);
+
+ this.mechanism = "GSSAPI";
+ this.serviceProtocol = args[1];
+ this.serverFqdn = args[2];
+ }
+
+ public static void main(String[] args) throws Exception {
+ new SaslAppServer(args).run();
+ }
+
+ @Override
+ protected void usage(String[] args) {
+ if (args.length < 3) {
+ System.err.println("Usage: SaslAppServer "
+ + "<ListenPort> <service-protocol> <server-fqdn>");
+ throw new RuntimeException("Usage: SaslAppServer "
+ + "<ListenPort> <service-protocol> <server-fqdn>");
+ }
+ }
+
+ @Override
+ protected void onConnection(Transport.Connection conn) throws Exception {
+ // System.out.print("Starting negotiating security context");
+
+ //mechanism, protocol, serverId, saslProperties, callback
+ CallbackHandler callbackHandler = new SaslGssCallbackHandler();
+ Map<String, Object> props = new HashMap<String, Object>();
+ props.put(Sasl.QOP, "auth");
+
+ SaslServer ss = Sasl.createSaslServer(mechanism,
+ serviceProtocol, serverFqdn, props, callbackHandler);
+ System.out.println("!!!! " + mechanism + ", " + serviceProtocol + ", " + serverFqdn);
+ Transport.Message msg = conn.recvMessage();
+ while (!ss.isComplete()) {
+ try {
+ byte[] respToken = ss.evaluateResponse(msg.body);
+ if (ss.isComplete()) {
+ conn.sendMessage("OK", respToken);
+ } else {
+ conn.sendMessage("CONT", respToken);
+ msg = conn.recvMessage();
+ }
+
+ } catch (SaslException e) {
+ conn.sendMessage("ERR", null);
+ ss.dispose();
+ break;
+ }
+ }
+
+ // System.out.print("Context Established! ");
+
+ doWith(ss, props, conn);
+
+ ss.dispose();
+ }
+
+ protected void doWith(SaslServer ss, Map<String, Object> props,
+ Transport.Connection conn) throws IOException, Exception {
+ conn.recvToken();
+ //byte[] token = conn.recvToken();
+ //String str = new String(token, StandardCharsets.UTF_8);
+ // System.out.println("Received data \""
+ // + str + "\" of length " + str.length());
+ }
+
+ public static class SaslGssCallbackHandler implements CallbackHandler {
+
+ @Override
+ public void handle(Callback[] callbacks) throws
+ UnsupportedCallbackException {
+ AuthorizeCallback ac = null;
+ for (Callback callback : callbacks) {
+ if (callback instanceof AuthorizeCallback) {
+ ac = (AuthorizeCallback) callback;
+ } else {
+ throw new UnsupportedCallbackException(callback,
+ "Unrecognized SASL GSSAPI Callback");
+ }
+ }
+ if (ac != null) {
+ String authid = ac.getAuthenticationID();
+ String authzid = ac.getAuthorizationID();
+ if (authid.equals(authzid)) {
+ ac.setAuthorized(true);
+ } else {
+ ac.setAuthorized(false);
+ }
+ if (ac.isAuthorized()) {
+ // System.out.println("SASL server GSSAPI callback: setting "
+ //+ "canonicalized client ID: " + authzid);
+ ac.setAuthorizedID(authzid);
+ }
+ }
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
new file mode 100644
index 0000000..d50f420
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/KdcTestBase.java
@@ -0,0 +1,176 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kerb.server;
+
+import org.apache.kerby.kerberos.kerb.KrbException;
+import org.apache.kerby.kerberos.kerb.client.KrbClient;
+import org.apache.kerby.kerberos.kerb.client.KrbPkinitClient;
+import org.apache.kerby.kerberos.kerb.client.KrbTokenClient;
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.Inet4Address;
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+
+public abstract class KdcTestBase {
+ private static final Logger logger = LoggerFactory.getLogger(KdcTestBase.class);
+
+ private static File testDir;
+ private static String hostname;
+ private static final String clientPassword = "123456";
+ private static final String clientPrincipalName = "drankye";
+ private static final String clientPrincipal = clientPrincipalName + "@" + TestKdcServer.KDC_REALM;
+ private static final String serverPrincipalName = "test-service";
+ private static String serverPrincipal = null;
+
+ private SimpleKdcServer kdcServer;
+
+ KdcTestBase() {
+ // Hostname setting must be consistent with the way gremlin-console sets gremlin-server's hostname
+ // and derives gremlin-server's principal name
+ try {
+ hostname = Inet4Address.getLocalHost().getCanonicalHostName();
+ serverPrincipal = serverPrincipalName + "/" + hostname + "@" + TestKdcServer.KDC_REALM;
+ } catch (UnknownHostException e) {
+ logger.error("Hostname not found");
+ }
+ }
+
+ @BeforeClass
+ public static void createTestDir() throws IOException {
+ String basedir = System.getProperty("basedir");
+ if (basedir == null) {
+ basedir = new File(".").getCanonicalPath();
+ }
+ File targetdir = new File(basedir, "target");
+ testDir = new File(targetdir, "tmp");
+ testDir.mkdirs();
+ System.out.println("Testdir: " + basedir);
+ }
+
+ @AfterClass
+ public static void deleteTestDir() throws IOException {
+ testDir.delete();
+ }
+
+ protected File getTestDir() {
+ return testDir;
+ }
+
+ protected SimpleKdcServer getKdcServer() {
+ return kdcServer;
+ }
+
+ protected KrbClient getKrbClient() {
+ return kdcServer.getKrbClient();
+ }
+
+ protected KrbPkinitClient getPkinitClient() {
+ return kdcServer.getPkinitClient();
+ }
+
+ protected KrbTokenClient getTokenClient() {
+ return kdcServer.getTokenClient();
+ }
+
+ protected String getClientPrincipalName() {
+ return clientPrincipalName;
+ }
+
+ protected String getClientPrincipal() {
+ return clientPrincipal;
+ }
+
+ protected String getServerPrincipalName() {
+ return serverPrincipalName;
+ }
+
+ protected String getClientPassword() {
+ return clientPassword;
+ }
+
+ protected String getServerPrincipal() {
+ return serverPrincipal;
+ }
+
+ protected String getHostname() {
+ return hostname;
+ }
+
+ protected boolean allowUdp() { return false; } //}true;}
+
+ protected boolean allowTcp() {
+ return true;
+ }
+
+ @Before
+ public void setUp() throws Exception {
+ setUpKdcServer();
+
+ createPrincipals();
+
+ setUpClient();
+ }
+
+ protected void prepareKdc() throws KrbException {
+ kdcServer.init();
+ }
+
+ protected void configKdcSeverAndClient() {
+ kdcServer.setWorkDir(testDir);
+ }
+
+ protected void setUpKdcServer() throws Exception {
+ kdcServer = new TestKdcServer(allowTcp(), allowUdp());
+
+ configKdcSeverAndClient();
+
+ prepareKdc();
+
+ kdcServer.start();
+ }
+
+ protected void setUpClient() throws Exception {
+ }
+
+ protected void createPrincipals() throws KrbException {
+ kdcServer.createPrincipals(serverPrincipal);
+ kdcServer.createPrincipal(clientPrincipal, clientPassword);
+ }
+
+ protected void deletePrincipals() throws KrbException {
+ kdcServer.getKadmin().deleteBuiltinPrincipals();
+ kdcServer.deletePrincipals(serverPrincipal);
+ kdcServer.deletePrincipal(clientPrincipal);
+ }
+
+ @After
+ public void tearDown() throws Exception {
+ deletePrincipals();
+ kdcServer.stop();
+ }
+}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
new file mode 100644
index 0000000..f5bdb80
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/LoginTestBase.java
@@ -0,0 +1,83 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kerb.server;
+
+import org.apache.kerby.kerberos.kerb.client.JaasKrbUtil;
+import org.apache.kerby.kerberos.kerb.type.ticket.TgtTicket;
+import org.junit.After;
+import org.junit.Before;
+
+import javax.security.auth.Subject;
+import javax.security.auth.login.LoginException;
+import java.io.File;
+import java.security.Principal;
+import java.util.Set;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+public class LoginTestBase extends KdcTestBase {
+
+ protected File ticketCacheFile;
+ protected File serviceKeytabFile;
+
+ @Before
+ @Override
+ public void setUp() throws Exception {
+ super.setUp();
+
+ ticketCacheFile = new File(getTestDir(), "test-tkt.cc");
+ serviceKeytabFile = new File(getTestDir(), "test-service.keytab");
+ }
+
+ protected Subject loginClientUsingPassword() throws LoginException {
+ return JaasKrbUtil.loginUsingPassword(getClientPrincipal(),
+ getClientPassword());
+ }
+
+ protected Subject loginClientUsingTicketCache() throws Exception {
+ TgtTicket tgt = getKrbClient().requestTgt(getClientPrincipal(),
+ getClientPassword());
+ getKrbClient().storeTicket(tgt, ticketCacheFile);
+
+ return JaasKrbUtil.loginUsingTicketCache(getClientPrincipal(),
+ ticketCacheFile);
+ }
+
+ protected Subject loginServiceUsingKeytab() throws Exception {
+ getKdcServer().exportPrincipal(getServerPrincipal(), serviceKeytabFile);
+ return JaasKrbUtil.loginUsingKeytab(getServerPrincipal(),
+ serviceKeytabFile);
+ }
+
+ protected void checkSubject(Subject subject) {
+ Set<Principal> clientPrincipals = subject.getPrincipals();
+ assertThat(clientPrincipals);
+ }
+
+ @After
+ @Override
+ public void tearDown() throws Exception {
+// ticketCacheFile.delete(); easier for debugging
+// serviceKeytabFile.delete(); easier for debugging
+
+ super.tearDown();
+ }
+}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java
new file mode 100644
index 0000000..76f9bc1
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/kerby/kerberos/kerb/server/TestKdcServer.java
@@ -0,0 +1,54 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kerb.server;
+
+import org.apache.kerby.kerberos.kerb.KrbException;
+import org.apache.kerby.kerberos.kerb.client.KrbClient;
+import org.apache.kerby.kerberos.kerb.client.KrbConfig;
+import org.apache.kerby.kerberos.kerb.client.KrbConfigKey;
+import org.apache.kerby.util.NetworkUtil;
+
+public class TestKdcServer extends SimpleKdcServer {
+ public static final String KDC_REALM = "TEST.COM";
+ public static final String HOSTNAME = "localhost";
+
+ public TestKdcServer(boolean allowTcp, boolean allowUdp) throws KrbException {
+ super();
+
+ setKdcRealm(KDC_REALM);
+ setKdcHost(HOSTNAME);
+ setAllowTcp(allowTcp);
+ setAllowUdp(allowUdp);
+
+ if (allowTcp) {
+ setKdcTcpPort(NetworkUtil.getServerPort());
+ }
+ if (allowUdp) {
+ setKdcUdpPort(NetworkUtil.getServerPort());
+ }
+
+ KrbClient krbClnt = getKrbClient();
+ KrbConfig krbConfig = krbClnt.getKrbConfig();
+ krbConfig.setString(KrbConfigKey.PERMITTED_ENCTYPES,
+ "aes128-cts-hmac-sha1-96 des-cbc-crc des-cbc-md5 des3-cbc-sha1");
+
+ krbClnt.setTimeout(10 * 1000);
+ }
+}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5IntegrateTest.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5IntegrateTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5IntegrateTest.java
new file mode 100644
index 0000000..64cfb29
--- /dev/null
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/AuthKrb5IntegrateTest.java
@@ -0,0 +1,146 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.tinkerpop.gremlin.server;
+
+import org.apache.kerby.kerberos.kerb.server.LoginTestBase;
+import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.apache.tinkerpop.gremlin.driver.Client;
+import org.apache.tinkerpop.gremlin.driver.Cluster;
+
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.InputStream;
+import java.net.Inet4Address;
+import java.net.InetAddress;
+import java.util.*;
+
+import org.junit.rules.TestName;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.security.auth.Subject;
+
+import static org.hamcrest.CoreMatchers.anyOf;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.fail;
+
+
+/**
+ * @author Marc de Lignie
+ */
+public class AuthKrb5IntegrateTest extends LoginTestBase {
+ private static final Logger logger = LoggerFactory.getLogger(AuthKrb5IntegrateTest.class);
+ private GremlinServerAuthKrb5Integrate server;
+ private String serverHostname = null;
+ private static final String TESTCONSOLE = "GremlinConsole";
+
+ @Rule
+ public TestName name = new TestName();
+
+ private class GremlinServerAuthKrb5Integrate extends AbstractGremlinServerIntegrationTest {
+
+ private final String nameOfTest;
+
+ GremlinServerAuthKrb5Integrate(String nameOfTest) {
+ this.nameOfTest = nameOfTest;
+ }
+
+ @Override
+ public Settings overrideSettings(final Settings settings) {
+ logger.debug("Testname: " + nameOfTest);
+ try { // See hostname setting in KdcTestBase
+ serverHostname = Inet4Address.getLocalHost().getCanonicalHostName();
+ settings.host = serverHostname;
+ } catch(Exception e) {
+ logger.error("Hostname not found");
+ }
+ logger.debug("Hostname: " + settings.host);
+ final Settings.AuthenticationSettings authSettings = new Settings.AuthenticationSettings();
+ authSettings.className = Krb5Authenticator.class.getName();
+ final Map<String,Object> authConfig = new HashMap<>();
+ final String buildDir = System.getProperty("build.dir");
+ authConfig.put("keytab", serviceKeytabFile.getAbsolutePath());
+ authConfig.put("principal", getServerPrincipal());
+ authSettings.config = authConfig;
+ settings.authentication = authSettings;
+ final Settings.SslSettings sslConfig = new Settings.SslSettings();
+ sslConfig.enabled = false;
+ settings.ssl = sslConfig;
+
+// switch (nameOfTest) {
+// case "shouldAuthenticateOverSslWithKerberosTicket":
+// case "shouldFailIfSslEnabledOnServerButNotClient":
+// final Settings.SslSettings sslConfig = new Settings.SslSettings();
+// sslConfig.enabled = true;
+// settings.ssl = sslConfig;
+// break;
+// }
+ return settings;
+ }
+ }
+
+ @Before
+ @Override
+ public void setUp() throws Exception {
+ super.setUp();
+ // Create keytab for gremlinServer and ticketcache for gremlinConsole
+ Subject gremlinServer = loginServiceUsingKeytab();
+ Subject gremlinConsole = loginClientUsingTicketCache();
+ logger.debug("Done creating keytab and ticketcache");
+
+ // ToDo: how to set java.security.auth.login.config when using gremlin-console with krb5LoginModule
+ final String buildDir = System.getProperty("build.dir");
+ System.setProperty("java.security.auth.login.config", buildDir +
+ "/test-classes/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf");
+ logger.debug("java.security.auth.login.config: " + System.getProperty("java.security.auth.login.config"));
+ logger.debug("project.build.directory: " + System.getProperty("project.build.directory"));
+ server = new GremlinServerAuthKrb5Integrate(name.getMethodName());
+ server.setUp();
+ }
+
+ @After
+ public void tearDown() throws Exception {
+ server.tearDown();
+ super.tearDown();
+ }
+
+ @Test
+ public void testRemoteLogin() throws Exception {
+ File f = new File(".");
+ logger.debug("Working dir: " + f.getCanonicalPath());
+ // ToDo: try TestClientFactory
+ final Cluster cluster = Cluster.build().jaasEntry(TESTCONSOLE)
+ .protocol("test-service").addContactPoint(serverHostname).port(45940).enableSsl(false).create();
+ final Client client = cluster.connect();
+ try {
+ assertEquals(2, client.submit("1+1").all().get().get(0).getInt());
+ assertEquals(3, client.submit("1+2").all().get().get(0).getInt());
+ assertEquals(4, client.submit("1+3").all().get().get(0).getInt());
+ } finally {
+ cluster.close();
+ }
+ }
+ // ToDo: test client login fails as wanted without a valid ticket
+ // ToDo: test with System.setProperty("javax.security.sasl.qop", "auth-conf");
+}
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/backend.conf
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/backend.conf b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/backend.conf
new file mode 100644
index 0000000..db1e075
--- /dev/null
+++ b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/backend.conf
@@ -0,0 +1,19 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+kdc_identity_backend = org.apache.kerby.kerberos.kerb.identity.backend.MemoryIdentityBackend
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf
new file mode 100644
index 0000000..1890af8
--- /dev/null
+++ b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf
@@ -0,0 +1,25 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+GremlinConsole {
+ com.sun.security.auth.module.Krb5LoginModule required
+ doNotPrompt=true
+ useTicketCache=true
+ ticketCache="target/tmp/test-tkt.cc";
+};
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/kdc.conf
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/kdc.conf b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/kdc.conf
new file mode 100644
index 0000000..313cda7
--- /dev/null
+++ b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/kdc.conf
@@ -0,0 +1,21 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+[kdcdefaults]
+ kdc_tcp_port = 34455
+ kdc_realm = EXAMPLE.COM
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/b3cb7e97/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/krb5.conf
----------------------------------------------------------------------
diff --git a/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/krb5.conf b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/krb5.conf
new file mode 100644
index 0000000..9fc21d8
--- /dev/null
+++ b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/krb5.conf
@@ -0,0 +1,33 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+[libdefaults]
+ kdc_realm = TEST.COM
+ default_realm = TEST.COM
+ udp_preference_limit = _UDP_LIMIT_
+ #_KDC_TCP_PORT_
+ #_KDC_UDP_PORT_
+ dns_lookup_realm = false
+ dns_lookup_kdc = false
+ rdns = false
+ canonicalize = true
+
+[realms]
+ TEST.COM = {
+ kdc = localhost:88
+ }
\ No newline at end of file
[24/27] tinkerpop git commit: Fixed use of socket address for audit
logging
Posted by sp...@apache.org.
Fixed use of socket address for audit logging
Project: http://git-wip-us.apache.org/repos/asf/tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/tinkerpop/commit/91e510cb
Tree: http://git-wip-us.apache.org/repos/asf/tinkerpop/tree/91e510cb
Diff: http://git-wip-us.apache.org/repos/asf/tinkerpop/diff/91e510cb
Branch: refs/heads/master
Commit: 91e510cbcf33ead3ac1ea30d76d51cf70d5d3fdc
Parents: 4e40df9
Author: HadoopMarc <vt...@xs4all.nl>
Authored: Wed Feb 22 20:31:44 2017 +0100
Committer: HadoopMarc <vt...@xs4all.nl>
Committed: Wed Feb 22 20:31:44 2017 +0100
----------------------------------------------------------------------
.../server/handler/HttpBasicAuthenticationHandler.java | 9 +++++----
.../gremlin/server/handler/HttpGremlinEndpointHandler.java | 3 ++-
.../gremlin/server/handler/SaslAuthenticationHandler.java | 6 ++++--
.../gremlin/server/op/AbstractEvalOpProcessor.java | 3 ++-
4 files changed, 13 insertions(+), 8 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/91e510cb/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpBasicAuthenticationHandler.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpBasicAuthenticationHandler.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpBasicAuthenticationHandler.java
index 1beb7cf..d8cbd5c 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpBasicAuthenticationHandler.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpBasicAuthenticationHandler.java
@@ -26,7 +26,6 @@ import io.netty.handler.codec.http.FullHttpMessage;
import io.netty.util.ReferenceCountUtil;
import org.apache.tinkerpop.gremlin.server.GremlinServer;
import org.apache.tinkerpop.gremlin.server.Settings;
-import org.apache.tinkerpop.gremlin.server.auth.AuthenticatedUser;
import org.apache.tinkerpop.gremlin.server.auth.AuthenticationException;
import org.apache.tinkerpop.gremlin.server.auth.Authenticator;
import org.slf4j.Logger;
@@ -105,9 +104,11 @@ public class HttpBasicAuthenticationHandler extends ChannelInboundHandlerAdapter
// User name logged with the remote socket address and authenticator classname for audit logging
if (authenticationSettings.enableAuditLog) {
- String[] authClassParts = authenticator.getClass().toString().split("[.]");
- auditLogger.info("User {} with address {} authenticated by {}", credentials.get(PROPERTY_USERNAME),
- ctx.channel().remoteAddress().toString().substring(1), authClassParts[authClassParts.length - 1]);
+ String address = ctx.channel().remoteAddress().toString();
+ if (address.startsWith("/") && address.length() > 1) address = address.substring(1);
+ final String[] authClassParts = authenticator.getClass().toString().split("[.]");
+ auditLogger.info("User {} with address {} authenticated by {}",
+ credentials.get(PROPERTY_USERNAME), address, authClassParts[authClassParts.length - 1]);
}
} catch (AuthenticationException ae) {
sendError(ctx, msg);
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/91e510cb/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpGremlinEndpointHandler.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpGremlinEndpointHandler.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpGremlinEndpointHandler.java
index 2afe4b5..b698191 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpGremlinEndpointHandler.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/HttpGremlinEndpointHandler.java
@@ -190,7 +190,8 @@ public class HttpGremlinEndpointHandler extends ChannelInboundHandlerAdapter {
logger.debug("Processing request containing script [{}] and bindings of [{}] on {}",
requestArguments.getValue0(), requestArguments.getValue1(), Thread.currentThread().getName());
if (settings.authentication.enableAuditLog) {
- final String address = ctx.channel().remoteAddress().toString().substring(1);
+ String address = ctx.channel().remoteAddress().toString();
+ if (address.startsWith("/") && address.length() > 1) address = address.substring(1);
auditLogger.info("User with address {} requested: {}", address, requestArguments.getValue0());
}
final ChannelPromise promise = ctx.channel().newPromise();
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/91e510cb/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/SaslAuthenticationHandler.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/SaslAuthenticationHandler.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/SaslAuthenticationHandler.java
index 0878246..ef81d4c 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/SaslAuthenticationHandler.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/handler/SaslAuthenticationHandler.java
@@ -105,9 +105,11 @@ public class SaslAuthenticationHandler extends ChannelInboundHandlerAdapter {
final AuthenticatedUser user = negotiator.get().getAuthenticatedUser();
// User name logged with the remote socket address and authenticator classname for audit logging
if (authenticationSettings.enableAuditLog) {
+ String address = ctx.channel().remoteAddress().toString();
+ if (address.startsWith("/") && address.length() > 1) address = address.substring(1);
String[] authClassParts = authenticator.getClass().toString().split("[.]");
- auditLogger.info("User {} with address {} authenticated by {}", user.getName(),
- ctx.channel().remoteAddress().toString().substring(1), authClassParts[authClassParts.length - 1]);
+ auditLogger.info("User {} with address {} authenticated by {}",
+ user.getName(), address, authClassParts[authClassParts.length - 1]);
}
// If we have got here we are authenticated so remove the handler and pass
// the original message down the pipeline for processing
http://git-wip-us.apache.org/repos/asf/tinkerpop/blob/91e510cb/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/op/AbstractEvalOpProcessor.java
----------------------------------------------------------------------
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/op/AbstractEvalOpProcessor.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/op/AbstractEvalOpProcessor.java
index baff5b7..2b12406 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/op/AbstractEvalOpProcessor.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/op/AbstractEvalOpProcessor.java
@@ -246,7 +246,8 @@ public abstract class AbstractEvalOpProcessor extends AbstractOpProcessor {
logger.debug("Preparing to iterate results from - {} - in thread [{}]", msg, Thread.currentThread().getName());
if (settings.authentication.enableAuditLog) {
- final String address = context.getChannelHandlerContext().channel().remoteAddress().toString().substring(1);
+ String address = context.getChannelHandlerContext().channel().remoteAddress().toString();
+ if (address.startsWith("/") && address.length() > 1) address = address.substring(1);
auditLogger.info("User with address {} requested: {}", address, script);
}