[3.0] Gh 0035 Oozie authentication module

authentication/pom.xml

@@ -0,0 +1,104 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Copyright (c) 2010 Yahoo! Inc. All rights reserved.
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License. See accompanying LICENSE file.
+-->
+<project>
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>com.yahoo.oozie</groupId>
+        <artifactId>oozie-main</artifactId>
+        <version>2.3.0-SNAPSHOT</version>
+    </parent>
+    <artifactId>oozie-authentication</artifactId>
+    <description>Oozie HTTP authentication</description>
+    <name>Oozie HTTP authentication</name>
+    <packaging>jar</packaging>
+
+    <licenses>
+        <license>
+            <name>The Apache Software License, Version 2.0</name>
+            <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
+        </license>
+    </licenses>
+
+    <organization>
+        <name>Yahoo</name>
+        <url>http://www.yahoo.com</url>
+    </organization>
+
+    <dependencies>
+        <dependency>
+            <groupId>commons-codec</groupId>
+            <artifactId>commons-codec</artifactId>
+            <version>1.4</version>
+            <scope>compile</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>xmlenc</groupId>
+            <artifactId>xmlenc</artifactId>
+            <version>0.52</version>
+            <scope>compile</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-api</artifactId>
+            <version>1.4.3</version>
+        </dependency>
+
+        <dependency>
+            <!-- groupId to be correct by GH-0226 -->
+            <groupId>com.yahoo.hadoop</groupId>
+            <artifactId>hadoop-core</artifactId>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.testng</groupId>
+            <artifactId>testng</artifactId>
+            <version>5.8</version>
+            <classifier>jdk15</classifier>
+            <scope>test</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.mockito</groupId>
+            <artifactId>mockito-core</artifactId>
+            <version>1.7</version>
+            <scope>test</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.easymock</groupId>
+            <artifactId>easymock</artifactId>
+            <version>2.4</version>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <artifactId>maven-assembly-plugin</artifactId>
+                <configuration>
+                    <descriptors>
+                        <descriptor>../src/main/assemblies/empty.xml</descriptor>
+                    </descriptors>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

authentication/src/main/java/org/apache/hadoop/http/authentication/AbstractAuthenticationToken.java

@@ -0,0 +1,80 @@
+/**
+ * Copyright (c) 2010 Yahoo! Inc. All rights reserved.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License. See accompanying LICENSE file.
+ */
+package org.apache.hadoop.http.authentication;
+
+/**
+ * Abstract class contains basic implementation for {@link AuthenticationToken}.
+ * <p/>
+ * To provide user-defined authentication, one token <code>AuthenticationToken</code>
+ * instance has to be provided to carry the information that authentication needs.
+ */
+public abstract class AbstractAuthenticationToken implements AuthenticationToken {
+
+    private boolean authenticated = false;
+    protected String principal;
+    protected String remoteAddr;
+    private final String token;
+
+    protected AbstractAuthenticationToken(String remoteAddr, String token) {
+        this(null, remoteAddr, token);
+    }
+
+    protected AbstractAuthenticationToken(String principal, String remoteAddr, String token) {
+        this.principal = principal;
+        this.remoteAddr = remoteAddr;
+        this.token = token;
+    }
+
+    /* (non-Javadoc)
+     * @see org.apache.hadoop.http.authentication.AuthenticationToken#isAuthenticated()
+     */
+    @Override
+    public boolean isAuthenticated() {
+        return authenticated;
+    }
+
+    /**
+     * Set true if token is authenticated
+     *
+     * @param authenticated
+     */
+    public void setAuthenticated(boolean authenticated) {
+        this.authenticated = authenticated;
+    }
+
+    /* (non-Javadoc)
+     * @see org.apache.hadoop.http.authentication.AuthenticationToken#getPrincipal()
+     */
+    @Override
+    public String getPrincipal() {
+        return principal;
+    }
+
+    /* (non-Javadoc)
+     * @see org.apache.hadoop.http.authentication.AuthenticationToken#getRemoteAddr()
+     */
+    @Override
+    public String getRemoteAddr() {
+        return remoteAddr;
+    }
+
+    /* (non-Javadoc)
+     * @see org.apache.hadoop.http.authentication.AuthenticationToken#getToken()
+     */
+    public String getToken() {
+        return token;
+    }
+
+}

authentication/src/main/java/org/apache/hadoop/http/authentication/AuthenticationProvider.java

@@ -0,0 +1,50 @@
+/**
+ * Copyright (c) 2010 Yahoo! Inc. All rights reserved.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License. See accompanying LICENSE file.
+ */
+package org.apache.hadoop.http.authentication;
+
+import javax.servlet.http.HttpServletRequest;
+import java.io.IOException;
+
+/**
+ * Provider interface for server authentication class.
+ *
+ */
+public interface AuthenticationProvider {
+
+    /**
+     * Check if this authentication provider supports client request
+     *
+     * @param httpServletRequest
+     * @return true if this authentication provider supports client request
+     */
+    boolean supports(HttpServletRequest httpServletRequest);
+
+    /**
+     * Get authentication token
+     *
+     * @param httpServletRequest httpServletRequest
+     * @return authentication token
+     * @throws IOException thrown if error to retrieve token from request
+     */
+    AuthenticationToken getAuthenticationToken(HttpServletRequest httpServletRequest) throws IOException;
+
+    /**
+     * Verify and authenticate the token
+     *
+     * @param authenticationToken authentication token
+     * @return authentication token
+     */
+    AuthenticationToken authenticate(AuthenticationToken authenticationToken);
+}

authentication/src/main/java/org/apache/hadoop/http/authentication/AuthenticationProviderFactory.java

@@ -0,0 +1,114 @@
+/**
+ * Copyright (c) 2010 Yahoo! Inc. All rights reserved.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License. See accompanying LICENSE file.
+ */
+package org.apache.hadoop.http.authentication;
+
+import org.apache.hadoop.conf.Configuration;
+import org.apache.hadoop.http.authentication.exception.AuthenticationException;
+import org.apache.hadoop.http.authentication.exception.UnknownAuthenticationSchemeException;
+import org.apache.hadoop.http.authentication.web.util.Assert;
+
+import javax.servlet.http.HttpServletRequest;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.InvocationTargetException;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * This class is instantiated by {@link AuthenticationProcessingFilter} to statically store all providers in a map.
+ * <p/>
+ * The parameter "authentication.providers" is used to specify a list of providers server can support. Filter
+ * {@link AuthenticationProcessingFilter} use this factory to get appropriate provider to authenticate request.
+ *
+ */
+public class AuthenticationProviderFactory {
+
+    private List<AuthenticationProvider> authenticationProviderList = new ArrayList<AuthenticationProvider>();
+
+    public AuthenticationProviderFactory(Configuration configuration) {
+        initializeAuthenticationProviders(configuration);
+    }
+
+    /**
+     * Initialize a list of providers specified in configuration "authentication.providers".
+     * <p/>
+     * A list of providers is stored in a map for further use.
+     *
+     * @param configuration configuration contains parameters to instantiate providers
+     */
+    private void initializeAuthenticationProviders(final Configuration configuration) {
+        String authProviderConf = configuration.get("authentication.providers");
+        Assert.notNull(authProviderConf,
+                "You should configure at least one authentication provider in authentication.providers");
+        String[] authenticationProviders = authProviderConf.split("\\s*,\\s*");
+
+        for (String authenticationProviderFQNClassName : authenticationProviders) {
+            try {
+                Class<?> providerClass = Class.forName(authenticationProviderFQNClassName);
+                Constructor<?> constructor = providerClass.getDeclaredConstructor(new Class[] { Configuration.class });
+
+                AuthenticationProvider provider = (AuthenticationProvider) constructor.newInstance(configuration);
+                authenticationProviderList.add(provider);
+            }
+            catch (InstantiationException e) {
+                throw new AuthenticationException("Unable to create instance for: "
+                        + authenticationProviderFQNClassName, e);
+            }
+            catch (IllegalAccessException e) {
+                throw new AuthenticationException("Unable to create instance for: "
+                        + authenticationProviderFQNClassName, e);
+            }
+            catch (ClassNotFoundException e) {
+                throw new AuthenticationException("Unable to create instance for: "
+                        + authenticationProviderFQNClassName, e);
+            }
+            catch (NoSuchMethodException e) {
+                throw new AuthenticationException("Unable to create instance for: "
+                        + authenticationProviderFQNClassName, e);
+            }
+            catch (InvocationTargetException e) {
+                throw new AuthenticationException("Unable to create instance for: "
+                        + authenticationProviderFQNClassName, e);
+            }
+            catch (Throwable t) {
+                throw new AuthenticationException("Unable to create instance for: "
+                        + authenticationProviderFQNClassName, t);
+            }
+        }
+    }
+
+    /**
+     * Get authentication provider if supports() return true
+     *
+     * @param httpServletRequest httpServletRequest
+     * @return authentication provider if supports() return true
+     */
+    public AuthenticationProvider getAuthenticationProvider(HttpServletRequest httpServletRequest) {
+        AuthenticationProvider supportedProvider = null;
+
+        for (AuthenticationProvider authenticationProvider : authenticationProviderList) {
+            if (authenticationProvider.supports(httpServletRequest)) {
+                supportedProvider = authenticationProvider;
+                break;
+            }
+        }
+
+        if (supportedProvider == null) {
+            throw new UnknownAuthenticationSchemeException("None of the configured providers could "
+                    + "identify a scheme in Request.");
+        }
+
+        return supportedProvider;
+    }
+}