You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@drill.apache.org by sohami <gi...@git.apache.org> on 2017/09/26 19:09:01 UTC
[GitHub] drill pull request #962: DRILL-5820: Add support for libpam4j Pam Authentica...
GitHub user sohami opened a pull request:
https://github.com/apache/drill/pull/962
DRILL-5820: Add support for libpam4j Pam Authenticator
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/sohami/drill DRILL-5820
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/drill/pull/962.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #962
----
commit 6efa28f63e56e7996d76cba19c577fadca3d9d1f
Author: Sorabh Hamirwasia <sh...@maprtech.com>
Date: 2017-09-21T00:38:08Z
DRILL-5820: Add support for libpam4j Pam Authenticator
----
---
[GitHub] drill pull request #962: DRILL-5820: Add support for libpam4j Pam Authentica...
Posted by sohami <gi...@git.apache.org>.
Github user sohami commented on a diff in the pull request:
https://github.com/apache/drill/pull/962#discussion_r141411354
--- Diff: exec/java-exec/src/main/java/org/apache/drill/exec/rpc/user/security/Pam4jUserAuthenticator.java ---
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.drill.exec.rpc.user.security;
+
+import org.apache.drill.common.config.DrillConfig;
+import org.apache.drill.exec.ExecConstants;
+import org.apache.drill.exec.exception.DrillbitStartupException;
+import org.jvnet.libpam.PAM;
+import org.jvnet.libpam.PAMException;
+import org.jvnet.libpam.UnixUser;
+
+import java.io.IOException;
+import java.util.List;
+
+/**
+ * Implement {@link org.apache.drill.exec.rpc.user.security.UserAuthenticator} based on Pluggable Authentication
+ * Module (PAM) configuration. Configure the PAM profiles using "drill.exec.security.user.auth.pam_profiles" BOOT
+ * option. Ex. value <i>[ "login", "sudo" ]</i> (value is an array of strings).
+ */
+@UserAuthenticatorTemplate(type = "pam4j")
+public class Pam4jUserAuthenticator implements UserAuthenticator {
+ private static final org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger(Pam4jUserAuthenticator.class);
+
+ private List<String> profiles;
+
+ @Override
+ public void setup(DrillConfig drillConfig) throws DrillbitStartupException {
+ profiles = drillConfig.getStringList(ExecConstants.PAM_AUTHENTICATOR_PROFILES);
+ }
+
+ @Override
+ public void authenticate(String user, String password) throws UserAuthenticationException {
+ for (String profile : profiles) {
+ PAM pam = null;
+ UnixUser unixUser;
+ try {
+ pam = new PAM(profile);
+ unixUser = pam.authenticate(user, password);
+ } catch (PAMException ex) {
+ logger.error("PAM auth failed for user: {} against {} profile. Exception: {}", user, profile, ex.getMessage());
+ throw new UserAuthenticationException(String.format("PAM auth failed for user: %s using profile: %s",
+ user, profile));
+ } finally {
+ if (pam != null) {
+ pam.dispose();
+ }
+ }
+
+ if (!user.equals(unixUser.getUserName())) {
+ throw new UserAuthenticationException(String.format("Unexpected error from pam module. Input user %s is " +
+ "different from authenticated output user %s of pam module libpam4j", user, unixUser.getUserName()));
+ }
+
+ if (logger.isTraceEnabled()) {
--- End diff --
Removed.
---
[GitHub] drill pull request #962: DRILL-5820: Add support for libpam4j Pam Authentica...
Posted by asfgit <gi...@git.apache.org>.
Github user asfgit closed the pull request at:
https://github.com/apache/drill/pull/962
---
[GitHub] drill pull request #962: DRILL-5820: Add support for libpam4j Pam Authentica...
Posted by sohami <gi...@git.apache.org>.
Github user sohami commented on a diff in the pull request:
https://github.com/apache/drill/pull/962#discussion_r141406080
--- Diff: distribution/src/resources/drill-override-example.conf ---
@@ -133,6 +133,8 @@ drill.exec: {
security.user.auth {
enabled: false,
packages += "org.apache.drill.exec.rpc.user.security",
+ # There are 2 implementations available "pam" using JPAM
+ # and "pam4j" using libpam4j
--- End diff --
Updated the comment here to reflect the Annotation name `UserAuthenticatorTemplate`
---
[GitHub] drill issue #962: DRILL-5820: Add support for libpam4j Pam Authenticator
Posted by sohami <gi...@git.apache.org>.
Github user sohami commented on the issue:
https://github.com/apache/drill/pull/962
@parthchandra - Please help to review
---
[GitHub] drill pull request #962: DRILL-5820: Add support for libpam4j Pam Authentica...
Posted by sohami <gi...@git.apache.org>.
Github user sohami commented on a diff in the pull request:
https://github.com/apache/drill/pull/962#discussion_r141406449
--- Diff: exec/java-exec/src/main/java/org/apache/drill/exec/rpc/user/security/Pam4jUserAuthenticator.java ---
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.drill.exec.rpc.user.security;
+
+import org.apache.drill.common.config.DrillConfig;
+import org.apache.drill.exec.ExecConstants;
+import org.apache.drill.exec.exception.DrillbitStartupException;
+import org.jvnet.libpam.PAM;
+import org.jvnet.libpam.PAMException;
+import org.jvnet.libpam.UnixUser;
+
+import java.io.IOException;
+import java.util.List;
+
+/**
+ * Implement {@link org.apache.drill.exec.rpc.user.security.UserAuthenticator} based on Pluggable Authentication
+ * Module (PAM) configuration. Configure the PAM profiles using "drill.exec.security.user.auth.pam_profiles" BOOT
+ * option. Ex. value <i>[ "login", "sudo" ]</i> (value is an array of strings).
+ */
+@UserAuthenticatorTemplate(type = "pam4j")
+public class Pam4jUserAuthenticator implements UserAuthenticator {
+ private static final org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger(Pam4jUserAuthenticator.class);
+
+ private List<String> profiles;
--- End diff --
cannot be final since it is initialized in `setup(..)` method
---
[GitHub] drill pull request #962: DRILL-5820: Add support for libpam4j Pam Authentica...
Posted by paul-rogers <gi...@git.apache.org>.
Github user paul-rogers commented on a diff in the pull request:
https://github.com/apache/drill/pull/962#discussion_r141197203
--- Diff: exec/java-exec/src/main/java/org/apache/drill/exec/rpc/user/security/Pam4jUserAuthenticator.java ---
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.drill.exec.rpc.user.security;
+
+import org.apache.drill.common.config.DrillConfig;
+import org.apache.drill.exec.ExecConstants;
+import org.apache.drill.exec.exception.DrillbitStartupException;
+import org.jvnet.libpam.PAM;
+import org.jvnet.libpam.PAMException;
+import org.jvnet.libpam.UnixUser;
+
+import java.io.IOException;
+import java.util.List;
+
+/**
+ * Implement {@link org.apache.drill.exec.rpc.user.security.UserAuthenticator} based on Pluggable Authentication
+ * Module (PAM) configuration. Configure the PAM profiles using "drill.exec.security.user.auth.pam_profiles" BOOT
+ * option. Ex. value <i>[ "login", "sudo" ]</i> (value is an array of strings).
+ */
+@UserAuthenticatorTemplate(type = "pam4j")
+public class Pam4jUserAuthenticator implements UserAuthenticator {
+ private static final org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger(Pam4jUserAuthenticator.class);
+
+ private List<String> profiles;
--- End diff --
`final`?
---
[GitHub] drill pull request #962: DRILL-5820: Add support for libpam4j Pam Authentica...
Posted by paul-rogers <gi...@git.apache.org>.
Github user paul-rogers commented on a diff in the pull request:
https://github.com/apache/drill/pull/962#discussion_r141196893
--- Diff: distribution/src/resources/drill-override-example.conf ---
@@ -133,6 +133,8 @@ drill.exec: {
security.user.auth {
enabled: false,
packages += "org.apache.drill.exec.rpc.user.security",
+ # There are 2 implementations available "pam" using JPAM
+ # and "pam4j" using libpam4j
--- End diff --
As discussed in person, perhaps explain how the `impl` property here related to the implementation class. (Evidently via an annotation. So, maybe just name the annotation used.)
---
[GitHub] drill pull request #962: DRILL-5820: Add support for libpam4j Pam Authentica...
Posted by sohami <gi...@git.apache.org>.
Github user sohami commented on a diff in the pull request:
https://github.com/apache/drill/pull/962#discussion_r141411850
--- Diff: exec/java-exec/src/main/java/org/apache/drill/exec/rpc/user/security/Pam4jUserAuthenticator.java ---
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.drill.exec.rpc.user.security;
+
+import org.apache.drill.common.config.DrillConfig;
+import org.apache.drill.exec.ExecConstants;
+import org.apache.drill.exec.exception.DrillbitStartupException;
+import org.jvnet.libpam.PAM;
+import org.jvnet.libpam.PAMException;
+import org.jvnet.libpam.UnixUser;
+
+import java.io.IOException;
+import java.util.List;
+
+/**
+ * Implement {@link org.apache.drill.exec.rpc.user.security.UserAuthenticator} based on Pluggable Authentication
+ * Module (PAM) configuration. Configure the PAM profiles using "drill.exec.security.user.auth.pam_profiles" BOOT
+ * option. Ex. value <i>[ "login", "sudo" ]</i> (value is an array of strings).
+ */
+@UserAuthenticatorTemplate(type = "pam4j")
+public class Pam4jUserAuthenticator implements UserAuthenticator {
+ private static final org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger(Pam4jUserAuthenticator.class);
+
+ private List<String> profiles;
+
+ @Override
+ public void setup(DrillConfig drillConfig) throws DrillbitStartupException {
+ profiles = drillConfig.getStringList(ExecConstants.PAM_AUTHENTICATOR_PROFILES);
+ }
+
+ @Override
+ public void authenticate(String user, String password) throws UserAuthenticationException {
+ for (String profile : profiles) {
+ PAM pam = null;
+ UnixUser unixUser;
+ try {
+ pam = new PAM(profile);
+ unixUser = pam.authenticate(user, password);
+ } catch (PAMException ex) {
+ logger.error("PAM auth failed for user: {} against {} profile. Exception: {}", user, profile, ex.getMessage());
+ throw new UserAuthenticationException(String.format("PAM auth failed for user: %s using profile: %s",
+ user, profile));
+ } finally {
+ if (pam != null) {
+ pam.dispose();
+ }
+ }
+
+ if (!user.equals(unixUser.getUserName())) {
--- End diff --
Some *Nix systems supports case sensitive usernames and some doesn't. Like Mac is case insensitive while linux is case sensitive. So I think username should be then treated as case sensitive. I will remove this check since looks like it's redundant and the pam module authenticate should take care of this.
---
[GitHub] drill pull request #962: DRILL-5820: Add support for libpam4j Pam Authentica...
Posted by sohami <gi...@git.apache.org>.
Github user sohami commented on a diff in the pull request:
https://github.com/apache/drill/pull/962#discussion_r141405678
--- Diff: exec/java-exec/src/main/java/org/apache/drill/exec/rpc/user/security/PamUserAuthenticator.java ---
@@ -59,7 +59,8 @@ public void authenticate(String user, String password) throws UserAuthentication
for (String pamProfile : profiles) {
Pam pam = new Pam(pamProfile);
if (!pam.authenticateSuccessful(user, password)) {
- throw new UserAuthenticationException(String.format("PAM profile '%s' validation failed", pamProfile));
+ throw new UserAuthenticationException(String.format("PAM profile '%s' validation failed for user %s",
--- End diff --
No the exceptions thrown here is directly mapped to Sasl Exception and sent back to client with AUTH_FAILED status.
---
[GitHub] drill pull request #962: DRILL-5820: Add support for libpam4j Pam Authentica...
Posted by paul-rogers <gi...@git.apache.org>.
Github user paul-rogers commented on a diff in the pull request:
https://github.com/apache/drill/pull/962#discussion_r141198807
--- Diff: exec/java-exec/src/main/java/org/apache/drill/exec/rpc/user/security/Pam4jUserAuthenticator.java ---
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.drill.exec.rpc.user.security;
+
+import org.apache.drill.common.config.DrillConfig;
+import org.apache.drill.exec.ExecConstants;
+import org.apache.drill.exec.exception.DrillbitStartupException;
+import org.jvnet.libpam.PAM;
+import org.jvnet.libpam.PAMException;
+import org.jvnet.libpam.UnixUser;
+
+import java.io.IOException;
+import java.util.List;
+
+/**
+ * Implement {@link org.apache.drill.exec.rpc.user.security.UserAuthenticator} based on Pluggable Authentication
+ * Module (PAM) configuration. Configure the PAM profiles using "drill.exec.security.user.auth.pam_profiles" BOOT
+ * option. Ex. value <i>[ "login", "sudo" ]</i> (value is an array of strings).
+ */
+@UserAuthenticatorTemplate(type = "pam4j")
+public class Pam4jUserAuthenticator implements UserAuthenticator {
+ private static final org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger(Pam4jUserAuthenticator.class);
+
+ private List<String> profiles;
+
+ @Override
+ public void setup(DrillConfig drillConfig) throws DrillbitStartupException {
+ profiles = drillConfig.getStringList(ExecConstants.PAM_AUTHENTICATOR_PROFILES);
+ }
+
+ @Override
+ public void authenticate(String user, String password) throws UserAuthenticationException {
+ for (String profile : profiles) {
+ PAM pam = null;
+ UnixUser unixUser;
+ try {
+ pam = new PAM(profile);
+ unixUser = pam.authenticate(user, password);
+ } catch (PAMException ex) {
+ logger.error("PAM auth failed for user: {} against {} profile. Exception: {}", user, profile, ex.getMessage());
+ throw new UserAuthenticationException(String.format("PAM auth failed for user: %s using profile: %s",
+ user, profile));
+ } finally {
+ if (pam != null) {
+ pam.dispose();
+ }
+ }
+
+ if (!user.equals(unixUser.getUserName())) {
+ throw new UserAuthenticationException(String.format("Unexpected error from pam module. Input user %s is " +
+ "different from authenticated output user %s of pam module libpam4j", user, unixUser.getUserName()));
+ }
+
+ if (logger.isTraceEnabled()) {
--- End diff --
Can omit this if statement, `logger.trace()` will do teh right thing.
---
[GitHub] drill pull request #962: DRILL-5820: Add support for libpam4j Pam Authentica...
Posted by paul-rogers <gi...@git.apache.org>.
Github user paul-rogers commented on a diff in the pull request:
https://github.com/apache/drill/pull/962#discussion_r141199041
--- Diff: exec/java-exec/src/main/java/org/apache/drill/exec/rpc/user/security/PamUserAuthenticator.java ---
@@ -59,7 +59,8 @@ public void authenticate(String user, String password) throws UserAuthentication
for (String pamProfile : profiles) {
Pam pam = new Pam(pamProfile);
if (!pam.authenticateSuccessful(user, password)) {
- throw new UserAuthenticationException(String.format("PAM profile '%s' validation failed", pamProfile));
+ throw new UserAuthenticationException(String.format("PAM profile '%s' validation failed for user %s",
--- End diff --
The module above throws an exception. Here we get a `boolean`. Does this mean that the exception was mapped to `false`, then mapped back to an exception?
---
[GitHub] drill pull request #962: DRILL-5820: Add support for libpam4j Pam Authentica...
Posted by paul-rogers <gi...@git.apache.org>.
Github user paul-rogers commented on a diff in the pull request:
https://github.com/apache/drill/pull/962#discussion_r141198653
--- Diff: exec/java-exec/src/main/java/org/apache/drill/exec/rpc/user/security/Pam4jUserAuthenticator.java ---
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.drill.exec.rpc.user.security;
+
+import org.apache.drill.common.config.DrillConfig;
+import org.apache.drill.exec.ExecConstants;
+import org.apache.drill.exec.exception.DrillbitStartupException;
+import org.jvnet.libpam.PAM;
+import org.jvnet.libpam.PAMException;
+import org.jvnet.libpam.UnixUser;
+
+import java.io.IOException;
+import java.util.List;
+
+/**
+ * Implement {@link org.apache.drill.exec.rpc.user.security.UserAuthenticator} based on Pluggable Authentication
+ * Module (PAM) configuration. Configure the PAM profiles using "drill.exec.security.user.auth.pam_profiles" BOOT
+ * option. Ex. value <i>[ "login", "sudo" ]</i> (value is an array of strings).
+ */
+@UserAuthenticatorTemplate(type = "pam4j")
+public class Pam4jUserAuthenticator implements UserAuthenticator {
+ private static final org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger(Pam4jUserAuthenticator.class);
+
+ private List<String> profiles;
+
+ @Override
+ public void setup(DrillConfig drillConfig) throws DrillbitStartupException {
+ profiles = drillConfig.getStringList(ExecConstants.PAM_AUTHENTICATOR_PROFILES);
+ }
+
+ @Override
+ public void authenticate(String user, String password) throws UserAuthenticationException {
+ for (String profile : profiles) {
+ PAM pam = null;
+ UnixUser unixUser;
+ try {
+ pam = new PAM(profile);
+ unixUser = pam.authenticate(user, password);
+ } catch (PAMException ex) {
+ logger.error("PAM auth failed for user: {} against {} profile. Exception: {}", user, profile, ex.getMessage());
+ throw new UserAuthenticationException(String.format("PAM auth failed for user: %s using profile: %s",
+ user, profile));
+ } finally {
+ if (pam != null) {
+ pam.dispose();
+ }
+ }
+
+ if (!user.equals(unixUser.getUserName())) {
--- End diff --
`equals` or `equalsIgnoreCase`? That is, should "Fred" match "fred"?
---