[jira] [Commented] (DRILL-4280) Kerberos Authentication

["ASF GitHub Bot (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/DRILL-4280?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15459440#comment-15459440 ] 

ASF GitHub Bot commented on DRILL-4280:
---------------------------------------

Github user gparai commented on a diff in the pull request:

    https://github.com/apache/drill/pull/578#discussion_r77403393
  
    --- Diff: exec/java-exec/src/main/java/org/apache/drill/exec/client/AuthenticationUtil.java ---
    @@ -0,0 +1,157 @@
    +/**
    + * Licensed to the Apache Software Foundation (ASF) under one
    + * or more contributor license agreements.  See the NOTICE file
    + * distributed with this work for additional information
    + * regarding copyright ownership.  The ASF licenses this file
    + * to you under the Apache License, Version 2.0 (the
    + * "License"); you may not use this file except in compliance
    + * with the License.  You may obtain a copy of the License at
    + *
    + * http://www.apache.org/licenses/LICENSE-2.0
    + *
    + * Unless required by applicable law or agreed to in writing, software
    + * distributed under the License is distributed on an "AS IS" BASIS,
    + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    + * See the License for the specific language governing permissions and
    + * limitations under the License.
    + */
    +package org.apache.drill.exec.client;
    +
    +import org.apache.drill.common.config.ConnectionParams;
    +import org.apache.hadoop.conf.Configuration;
    +import org.apache.hadoop.fs.CommonConfigurationKeys;
    +import org.apache.hadoop.security.UserGroupInformation;
    +
    +import javax.security.auth.callback.Callback;
    +import javax.security.auth.callback.CallbackHandler;
    +import javax.security.auth.callback.NameCallback;
    +import javax.security.auth.callback.PasswordCallback;
    +import javax.security.auth.callback.UnsupportedCallbackException;
    +import javax.security.sasl.Sasl;
    +import javax.security.sasl.SaslClient;
    +import javax.security.sasl.SaslException;
    +import java.io.IOException;
    +import java.lang.reflect.UndeclaredThrowableException;
    +import java.net.InetAddress;
    +import java.net.UnknownHostException;
    +import java.security.PrivilegedExceptionAction;
    +
    +public final class AuthenticationUtil {
    +  private static final org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger(AuthenticationUtil.class);
    +
    +  private static final String PLAIN_NAME = "PLAIN";
    +
    +  private static final String KERBEROS_NAME = "GSSAPI";
    +
    +
    +  public static String getMechanismFromParams(final ConnectionParams params) {
    +    if (params.getParam(ConnectionParams.AUTH_MECHANISM) != null) {
    +      return params.getParam(ConnectionParams.AUTH_MECHANISM);
    +    }
    +    if (params.getParam(ConnectionParams.PASSWORD) != null) {
    +      return PLAIN_NAME;
    +    }
    +    if (params.getParam(ConnectionParams.PRINCIPAL) != null ||
    +        (params.getParam(ConnectionParams.SERVICE_HOST) != null &&
    +            params.getParam(ConnectionParams.SERVICE_NAME) != null)) {
    +      return KERBEROS_NAME;
    +    }
    +    return null;
    +  }
    +
    +  public static SaslClient getPlainSaslClient(final String userName, final String password) throws SaslException {
    +    return Sasl.createSaslClient(new String[]{PLAIN_NAME}, null /* authorizationID */, null, null, null,
    +        new CallbackHandler() {
    +          @Override
    +          public void handle(final Callback[] callbacks) throws IOException, UnsupportedCallbackException {
    +            for (final Callback callback : callbacks) {
    +              if (callback instanceof NameCallback) {
    +                NameCallback.class.cast(callback).setName(userName);
    +                continue;
    +              }
    +              if (callback instanceof PasswordCallback) {
    +                PasswordCallback.class.cast(callback).setPassword(password.toCharArray());
    +                continue;
    +              }
    +              throw new UnsupportedCallbackException(callback);
    +            }
    +          }
    +        });
    +  }
    +
    +  public static String deriveKerberosName(final ConnectionParams params) {
    +    final String principal = params.getParam(ConnectionParams.PRINCIPAL);
    +    if (principal != null) {
    +      return principal;
    +    }
    +
    +    final StringBuilder principalBuilder = new StringBuilder();
    +    final String serviceNameProp = params.getParam(ConnectionParams.SERVICE_NAME);
    +    if (serviceNameProp != null) {
    +      principalBuilder.append(serviceNameProp);
    +    } else {
    +      principalBuilder.append(System.getProperty("drill.service.name", "drill"));
    --- End diff --
    
    Can this not be null?


> Kerberos Authentication
> -----------------------
>
>                 Key: DRILL-4280
>                 URL: https://issues.apache.org/jira/browse/DRILL-4280
>             Project: Apache Drill
>          Issue Type: Improvement
>            Reporter: Keys Botzum
>            Assignee: Sudheesh Katkam
>              Labels: security
>
> Drill should support Kerberos based authentication from clients. This means that both the ODBC and JDBC drivers as well as the web/REST interfaces should support inbound Kerberos. For Web this would most likely be SPNEGO while for ODBC and JDBC this will be more generic Kerberos.
> Since Hive and much of Hadoop supports Kerberos there is a potential for a lot of reuse of ideas if not implementation.
> Note that this is related to but not the same as https://issues.apache.org/jira/browse/DRILL-3584 



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)