[GitHub] [kafka] C0urante commented on a diff in pull request #12846: KAFKA-14293: Basic Auth filter should set the SecurityContext after a…

[GitBox <gi...@apache.org>]

C0urante commented on code in PR #12846:
URL: https://github.com/apache/kafka/pull/12846#discussion_r1039679491


##########
connect/basic-auth-extension/src/main/java/org/apache/kafka/connect/rest/basic/auth/extension/JaasBasicAuthFilter.java:
##########
@@ -174,4 +153,84 @@ public void handle(Callback[] callbacks) throws UnsupportedCallbackException {
                 ));
         }
     }
+
+    private void setSecurityContextForRequest(ContainerRequestContext requestContext, BasicAuthenticationCredential credential) {
+        requestContext.setSecurityContext(new SecurityContext() {
+            @Override
+            public Principal getUserPrincipal() {
+                return () -> credential.getUsername();
+            }
+
+            @Override
+            public boolean isUserInRole(String role) {
+                return false;
+            }
+
+            @Override
+            public boolean isSecure() {
+                return requestContext.getUriInfo().getRequestUri().getScheme().equalsIgnoreCase("https");
+            }
+
+            @Override
+            public String getAuthenticationScheme() {
+                return BASIC_AUTH;
+            }
+        });
+    }
+
+
+    public static class BasicAuthenticationCredential {
+        private String username;
+        private String password;
+
+        public BasicAuthenticationCredential(String authorizationHeader) {
+            final char colon = ':';
+            final char space = ' ';
+            final String authType = "basic";
+
+            initializeEmptyCredentials();
+
+            if (authorizationHeader == null) {
+                log.trace("No credentials were provided with the request");
+                return;
+            }
+
+            int spaceIndex = authorizationHeader.indexOf(space);
+            if (spaceIndex <= 0) {
+                log.trace("Request credentials were malformed; no space present in value for authorization header");
+                return;
+            }
+
+            String method = authorizationHeader.substring(0, spaceIndex);
+            if (!authType.equalsIgnoreCase(method)) {
+                log.trace("Request credentials used {} authentication, but only {} supported; ignoring", method, authType);
+                return;
+            }
+
+            authorizationHeader = authorizationHeader.substring(spaceIndex + 1);
+            authorizationHeader = new String(Base64.getDecoder().decode(authorizationHeader),
+                    StandardCharsets.UTF_8);
+            int i = authorizationHeader.indexOf(colon);
+            if (i <= 0) {
+                log.trace("Request credentials were malformed; no colon present between username and password");
+                return;
+            }
+
+            this.username = authorizationHeader.substring(0, i);
+            this.password = authorizationHeader.substring(i + 1);
+        }
+
+        private void initializeEmptyCredentials() {
+            this.username = "";
+            this.password = "";
+        }

Review Comment:
   I personally prefer final fields as that guarantees that the only logic that computes them is in the constructor, but it's not worth blocking on.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org