You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@calcite.apache.org by el...@apache.org on 2017/08/04 02:13:42 UTC
[2/2] calcite-avatica git commit: [CALCITE-1915] Work around a Jetty
bug where the SPNEGO challenge is not sent
[CALCITE-1915] Work around a Jetty bug where the SPNEGO challenge is not sent
Closes #14
Project: http://git-wip-us.apache.org/repos/asf/calcite-avatica/repo
Commit: http://git-wip-us.apache.org/repos/asf/calcite-avatica/commit/bc0e8bf5
Tree: http://git-wip-us.apache.org/repos/asf/calcite-avatica/tree/bc0e8bf5
Diff: http://git-wip-us.apache.org/repos/asf/calcite-avatica/diff/bc0e8bf5
Branch: refs/heads/master
Commit: bc0e8bf5b287ca27b35df30b1568c8c389f70b4f
Parents: 0e69017
Author: Josh Elser <el...@apache.org>
Authored: Thu Aug 3 22:04:25 2017 -0400
Committer: Josh Elser <el...@apache.org>
Committed: Thu Aug 3 22:10:11 2017 -0400
----------------------------------------------------------------------
pom.xml | 5 ++
server/pom.xml | 4 +
.../server/AvaticaSpnegoAuthenticator.java | 81 ++++++++++++++++++++
.../calcite/avatica/server/HttpServer.java | 3 +-
.../server/AvaticaSpnegoAuthenticatorTest.java | 73 ++++++++++++++++++
5 files changed, 164 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/calcite-avatica/blob/bc0e8bf5/pom.xml
----------------------------------------------------------------------
diff --git a/pom.xml b/pom.xml
index 1bab08e..4efc3bc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -271,6 +271,11 @@ limitations under the License.
</dependency>
<dependency>
<groupId>org.eclipse.jetty</groupId>
+ <artifactId>jetty-http</artifactId>
+ <version>${jetty.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-security</artifactId>
<version>${jetty.version}</version>
</dependency>
http://git-wip-us.apache.org/repos/asf/calcite-avatica/blob/bc0e8bf5/server/pom.xml
----------------------------------------------------------------------
diff --git a/server/pom.xml b/server/pom.xml
index 4fa9796..fec42b5 100644
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -57,6 +57,10 @@ limitations under the License.
</dependency>
<dependency>
<groupId>org.eclipse.jetty</groupId>
+ <artifactId>jetty-http</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-security</artifactId>
</dependency>
<dependency>
http://git-wip-us.apache.org/repos/asf/calcite-avatica/blob/bc0e8bf5/server/src/main/java/org/apache/calcite/avatica/server/AvaticaSpnegoAuthenticator.java
----------------------------------------------------------------------
diff --git a/server/src/main/java/org/apache/calcite/avatica/server/AvaticaSpnegoAuthenticator.java b/server/src/main/java/org/apache/calcite/avatica/server/AvaticaSpnegoAuthenticator.java
new file mode 100644
index 0000000..af0670f
--- /dev/null
+++ b/server/src/main/java/org/apache/calcite/avatica/server/AvaticaSpnegoAuthenticator.java
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.calcite.avatica.server;
+
+import org.eclipse.jetty.http.HttpHeader;
+import org.eclipse.jetty.security.ServerAuthException;
+import org.eclipse.jetty.security.authentication.DeferredAuthentication;
+import org.eclipse.jetty.security.authentication.SpnegoAuthenticator;
+import org.eclipse.jetty.server.Authentication;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * Custom SpnegoAuthenticator which will still reponse with a WWW-Authentication: Negotiate
+ * header if the client provides some other kind of authentication header.
+ */
+public class AvaticaSpnegoAuthenticator extends SpnegoAuthenticator {
+ private static final Logger LOG = LoggerFactory.getLogger(AvaticaSpnegoAuthenticator.class);
+
+ @Override public Authentication validateRequest(ServletRequest request,
+ ServletResponse response, boolean mandatory) throws ServerAuthException {
+ final Authentication computedAuth = super.validateRequest(request, response, mandatory);
+ try {
+ return sendChallengeIfNecessary(computedAuth, request, response);
+ } catch (IOException e) {
+ throw new ServerAuthException(e);
+ }
+ }
+
+ /**
+ * Jetty has a bug in which if there is an Authorization header sent by a client which is
+ * not of the Negotiate type, Jetty does not send the challenge to negotiate. This works
+ * around that issue, forcing the challenge to be sent. Will require investigation on
+ * upgrade to a newer version of Jetty.
+ */
+ Authentication sendChallengeIfNecessary(Authentication computedAuth, ServletRequest request,
+ ServletResponse response) throws IOException {
+ if (computedAuth == Authentication.UNAUTHENTICATED) {
+ HttpServletRequest req = (HttpServletRequest) request;
+ HttpServletResponse res = (HttpServletResponse) response;
+
+ String header = req.getHeader(HttpHeader.AUTHORIZATION.asString());
+ // We have an authorization header, but it's not Negotiate
+ if (header != null && !header.startsWith(HttpHeader.NEGOTIATE.asString())) {
+ LOG.debug("Client sent Authorization header that was not for Negotiate,"
+ + " sending challenge anyways.");
+ if (DeferredAuthentication.isDeferred(res)) {
+ return Authentication.UNAUTHENTICATED;
+ }
+
+ res.setHeader(HttpHeader.WWW_AUTHENTICATE.asString(), HttpHeader.NEGOTIATE.asString());
+ res.sendError(HttpServletResponse.SC_UNAUTHORIZED);
+ return Authentication.SEND_CONTINUE;
+ }
+ }
+ return computedAuth;
+ }
+}
+
+// End AvaticaSpnegoAuthenticator.java
http://git-wip-us.apache.org/repos/asf/calcite-avatica/blob/bc0e8bf5/server/src/main/java/org/apache/calcite/avatica/server/HttpServer.java
----------------------------------------------------------------------
diff --git a/server/src/main/java/org/apache/calcite/avatica/server/HttpServer.java b/server/src/main/java/org/apache/calcite/avatica/server/HttpServer.java
index ffb67ca..627abe5 100644
--- a/server/src/main/java/org/apache/calcite/avatica/server/HttpServer.java
+++ b/server/src/main/java/org/apache/calcite/avatica/server/HttpServer.java
@@ -29,7 +29,6 @@ import org.eclipse.jetty.security.HashLoginService;
import org.eclipse.jetty.security.LoginService;
import org.eclipse.jetty.security.authentication.BasicAuthenticator;
import org.eclipse.jetty.security.authentication.DigestAuthenticator;
-import org.eclipse.jetty.security.authentication.SpnegoAuthenticator;
import org.eclipse.jetty.server.Connector;
import org.eclipse.jetty.server.Handler;
import org.eclipse.jetty.server.Server;
@@ -271,7 +270,7 @@ public class HttpServer {
final String[] allowedRealms = getAllowedRealms(realm, config);
return configureCommonAuthentication(server, connector, config, Constraint.__SPNEGO_AUTH,
- allowedRealms, new SpnegoAuthenticator(), realm, spnegoLoginService);
+ allowedRealms, new AvaticaSpnegoAuthenticator(), realm, spnegoLoginService);
}
protected String[] getAllowedRealms(String serverRealm, AvaticaServerConfiguration config) {
http://git-wip-us.apache.org/repos/asf/calcite-avatica/blob/bc0e8bf5/server/src/test/java/org/apache/calcite/avatica/server/AvaticaSpnegoAuthenticatorTest.java
----------------------------------------------------------------------
diff --git a/server/src/test/java/org/apache/calcite/avatica/server/AvaticaSpnegoAuthenticatorTest.java b/server/src/test/java/org/apache/calcite/avatica/server/AvaticaSpnegoAuthenticatorTest.java
new file mode 100644
index 0000000..586b9fd
--- /dev/null
+++ b/server/src/test/java/org/apache/calcite/avatica/server/AvaticaSpnegoAuthenticatorTest.java
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.calcite.avatica.server;
+
+import org.eclipse.jetty.http.HttpHeader;
+import org.eclipse.jetty.server.Authentication;
+import org.junit.Before;
+import org.junit.Test;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyZeroInteractions;
+import static org.mockito.Mockito.when;
+
+/**
+ * Test class for AvaticaSpnegoAuthenticator.
+ */
+public class AvaticaSpnegoAuthenticatorTest {
+
+ private HttpServletRequest request;
+ private HttpServletResponse response;
+ private AvaticaSpnegoAuthenticator authenticator;
+
+ @Before public void setup() {
+ request = mock(HttpServletRequest.class);
+ response = mock(HttpServletResponse.class);
+ authenticator = new AvaticaSpnegoAuthenticator();
+ }
+
+ @Test public void testAuthenticatedDoesNothingExtra() throws IOException {
+ List<Authentication> authsNotRequiringUpdate = Arrays.asList(Authentication.NOT_CHECKED,
+ Authentication.SEND_CONTINUE, Authentication.SEND_FAILURE, Authentication.SEND_SUCCESS);
+ for (Authentication auth : authsNotRequiringUpdate) {
+ assertEquals(auth, authenticator.sendChallengeIfNecessary(auth, request, response));
+ verifyZeroInteractions(request);
+ verifyZeroInteractions(response);
+ }
+ }
+
+ @Test public void testChallengeSendOnBasicAuthorization() throws IOException {
+ when(request.getHeader("Authorization")).thenReturn("Basic asdf");
+ assertEquals(Authentication.SEND_CONTINUE,
+ authenticator.sendChallengeIfNecessary(Authentication.UNAUTHENTICATED, request,
+ response));
+ verify(response).setHeader(HttpHeader.WWW_AUTHENTICATE.toString(),
+ HttpHeader.NEGOTIATE.asString());
+ verify(response).sendError(HttpServletResponse.SC_UNAUTHORIZED);
+ }
+}
+
+// End AvaticaSpnegoAuthenticatorTest.java