You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mesos.apache.org by vi...@apache.org on 2017/03/13 15:46:32 UTC
[6/6] mesos git commit: Implemented a JWT secret generator.
Implemented a JWT secret generator.
This can be used to create a 'Secret' from a 'Principal'.
The resulting secret will provide a JWT.
Review: https://reviews.apache.org/r/56754/
Project: http://git-wip-us.apache.org/repos/asf/mesos/repo
Commit: http://git-wip-us.apache.org/repos/asf/mesos/commit/f37c51df
Tree: http://git-wip-us.apache.org/repos/asf/mesos/tree/f37c51df
Diff: http://git-wip-us.apache.org/repos/asf/mesos/diff/f37c51df
Branch: refs/heads/master
Commit: f37c51dfb86cb4065c464c37eba303ff64450666
Parents: 686733d
Author: Jan Schlicht <ja...@mesosphere.io>
Authored: Mon Mar 13 16:46:14 2017 +0100
Committer: Vinod Kone <vi...@gmail.com>
Committed: Mon Mar 13 16:46:14 2017 +0100
----------------------------------------------------------------------
src/Makefile.am | 11 +++
.../executor/jwt_secret_generator.cpp | 75 ++++++++++++++++++
.../executor/jwt_secret_generator.hpp | 55 +++++++++++++
src/tests/secret_generator_tests.cpp | 83 ++++++++++++++++++++
4 files changed, 224 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/mesos/blob/f37c51df/src/Makefile.am
----------------------------------------------------------------------
diff --git a/src/Makefile.am b/src/Makefile.am
index 9be578b..2eea11a 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -1281,6 +1281,12 @@ else
EXTRA_DIST += $(MESOS_NETWORK_ISOLATOR_FILES)
endif
+if ENABLE_SSL
+libmesos_no_3rdparty_la_SOURCES += \
+ authentication/executor/jwt_secret_generator.cpp \
+ authentication/executor/jwt_secret_generator.hpp
+endif
+
libmesos_no_3rdparty_la_CPPFLAGS = $(MESOS_CPPFLAGS)
libmesos_no_3rdparty_la_LIBADD = # Initialized to enable using +=.
@@ -2381,6 +2387,11 @@ mesos_tests_SOURCES += \
tests/containerizer/routing_tests.cpp
endif
+if ENABLE_SSL
+mesos_tests_SOURCES += \
+ tests/secret_generator_tests.cpp
+endif
+
if HAS_JAVA
mesos_tests_SOURCES += \
tests/group_tests.cpp \
http://git-wip-us.apache.org/repos/asf/mesos/blob/f37c51df/src/authentication/executor/jwt_secret_generator.cpp
----------------------------------------------------------------------
diff --git a/src/authentication/executor/jwt_secret_generator.cpp b/src/authentication/executor/jwt_secret_generator.cpp
new file mode 100644
index 0000000..6aed6bd
--- /dev/null
+++ b/src/authentication/executor/jwt_secret_generator.cpp
@@ -0,0 +1,75 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "jwt_secret_generator.hpp"
+
+#include <process/jwt.hpp>
+
+#include <stout/json.hpp>
+#include <stout/stringify.hpp>
+
+namespace mesos {
+namespace http {
+namespace authentication {
+
+using process::Failure;
+using process::Future;
+
+using process::http::authentication::JWT;
+using process::http::authentication::JWTError;
+using process::http::authentication::Principal;
+
+using std::string;
+
+
+JWTSecretGenerator::JWTSecretGenerator(const std::string& secret)
+ : secret_(secret) {}
+
+
+JWTSecretGenerator::~JWTSecretGenerator() {}
+
+
+Future<Secret> JWTSecretGenerator::generate(const Principal& principal)
+{
+ if (principal.value.isSome()) {
+ return Failure("Principal has a value, but only claims are supported");
+ }
+
+ JSON::Object payload;
+
+ foreachpair (const string& key, const string& value, principal.claims) {
+ payload.values[key] = value;
+ }
+
+ Try<JWT, JWTError> jwt = JWT::create(payload, secret_);
+
+ if (jwt.isError()) {
+ return Failure("Error creating JWT: " + jwt.error().message);
+ }
+
+ Secret::Value value;
+ value.set_data(stringify(jwt.get()));
+
+ Secret result;
+ result.set_type(Secret::VALUE);
+ result.mutable_value()->CopyFrom(value);
+
+ return result;
+}
+
+} // namespace authentication {
+} // namespace http {
+} // namespace mesos {
http://git-wip-us.apache.org/repos/asf/mesos/blob/f37c51df/src/authentication/executor/jwt_secret_generator.hpp
----------------------------------------------------------------------
diff --git a/src/authentication/executor/jwt_secret_generator.hpp b/src/authentication/executor/jwt_secret_generator.hpp
new file mode 100644
index 0000000..a945358
--- /dev/null
+++ b/src/authentication/executor/jwt_secret_generator.hpp
@@ -0,0 +1,55 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef __MESOS_AUTHENTICATION_EXECUTOR_JWT_SECRET_GENERATOR_HPP__
+#define __MESOS_AUTHENTICATION_EXECUTOR_JWT_SECRET_GENERATOR_HPP__
+
+#include <string>
+
+#include <mesos/authentication/secret_generator.hpp>
+
+#include <process/authenticator.hpp>
+#include <process/future.hpp>
+
+namespace mesos {
+namespace http {
+namespace authentication {
+
+/**
+ * Creates a VALUE-type secret containing a JWT. When the secret is
+ * presented to the 'JWTAuthenticator' module, the authenticator will
+ * return the principal which is provided here as an argument.
+ */
+class JWTSecretGenerator : public SecretGenerator
+{
+public:
+ JWTSecretGenerator(const std::string& secret);
+
+ ~JWTSecretGenerator() override;
+
+ process::Future<Secret> generate(
+ const process::http::authentication::Principal& principal)
+ override;
+
+private:
+ std::string secret_;
+};
+
+} // namespace authentication {
+} // namespace http {
+} // namespace mesos {
+
+#endif // __MESOS_AUTHENTICATION_EXECUTOR_JWT_SECRET_GENERATOR_HPP__
http://git-wip-us.apache.org/repos/asf/mesos/blob/f37c51df/src/tests/secret_generator_tests.cpp
----------------------------------------------------------------------
diff --git a/src/tests/secret_generator_tests.cpp b/src/tests/secret_generator_tests.cpp
new file mode 100644
index 0000000..81fd54d
--- /dev/null
+++ b/src/tests/secret_generator_tests.cpp
@@ -0,0 +1,83 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License
+
+#include <gtest/gtest.h>
+
+#include <map>
+#include <string>
+
+#include <mesos/mesos.hpp>
+
+#include <process/authenticator.hpp>
+#include <process/future.hpp>
+#include <process/gtest.hpp>
+#include <process/jwt.hpp>
+
+#include <stout/gtest.hpp>
+#include <stout/json.hpp>
+
+#include "authentication/executor/jwt_secret_generator.hpp"
+
+namespace mesos {
+namespace internal {
+namespace tests {
+
+using mesos::http::authentication::JWTSecretGenerator;
+
+using process::Future;
+
+using process::http::authentication::JWT;
+using process::http::authentication::JWTError;
+using process::http::authentication::Principal;
+
+using std::string;
+
+
+TEST(JWTSecretGeneratorTest, Generate)
+{
+ const string secret = "secret";
+
+ JWTSecretGenerator generator(secret);
+
+ Principal principal(Option<string>::none());
+ principal.claims["sub"] = "user";
+ principal.claims["foo"] = "bar";
+
+ const Future<Secret> token = generator.generate(principal);
+
+ AWAIT_READY(token);
+
+ EXPECT_TRUE(token->has_value());
+ EXPECT_TRUE(token->value().has_data());
+
+ const Try<JWT, JWTError> jwt = JWT::parse(token->value().data(), secret);
+
+ // TODO(nfnt): Change this to `EXPECT_SOME(jwt)`
+ // once MESOS-7220 is resolved.
+ EXPECT_TRUE(jwt.isSome());
+
+ Result<JSON::String> sub = jwt->payload.at<JSON::String>("sub");
+
+ EXPECT_SOME_EQ("user", sub);
+
+ Result<JSON::String> foo = jwt->payload.at<JSON::String>("foo");
+
+ EXPECT_SOME_EQ("bar", foo);
+}
+
+} // namespace tests {
+} // namespace internal {
+} // namespace mesos {