src/java/org/apache/cassandra/auth/CassandraLoginModule.java - cassandra - Git at Google

 /*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
  * regarding copyright ownership.  The ASF licenses this file
  * to you under the Apache License, Version 2.0 (the
  * "License"); you may not use this file except in compliance
  * with the License.  You may obtain a copy of the License at
  *
  *     http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
 package org.apache.cassandra.auth;

 import java.io.IOException;
 import java.util.HashMap;
 import java.util.Map;
 import javax.security.auth.Subject;
 import javax.security.auth.callback.*;
 import javax.security.auth.login.FailedLoginException;
 import javax.security.auth.login.LoginException;
 import javax.security.auth.spi.LoginModule;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import org.apache.cassandra.config.DatabaseDescriptor;
 import org.apache.cassandra.exceptions.AuthenticationException;
 import org.apache.cassandra.service.StorageService;

 /**
  * LoginModule which authenticates a user towards the Cassandra database using
  * the internal authentication mechanism.
  */
 public class CassandraLoginModule implements LoginModule
 {
     private static final Logger logger = LoggerFactory.getLogger(CassandraLoginModule.class);

     // initial state
     private Subject subject;
     private CallbackHandler callbackHandler;

     // the authentication status
     private boolean succeeded = false;
     private boolean commitSucceeded = false;

     // username and password
     private String username;
     private char[] password;

     private CassandraPrincipal principal;

     /**
      * Initialize this {@code}LoginModule{@code}.
      *
      * @param subject the {@code}Subject{@code} to be authenticated. <p>
      * @param callbackHandler a {@code}CallbackHandler{@code} for communicating
      *        with the end user (prompting for user names and passwords, for example)
      * @param sharedState shared {@code}LoginModule{@code} state. This param is unused.
      * @param options options specified in the login {@code}Configuration{@code} for this particular
      *        {@code}LoginModule{@code}. This param is unused
      */
     @Override
     public void initialize(Subject subject,
                            CallbackHandler callbackHandler,
                            Map<java.lang.String, ?> sharedState,
                            Map<java.lang.String, ?> options)
     {
         this.subject = subject;
         this.callbackHandler = callbackHandler;
     }

     /**
      * Authenticate the user, obtaining credentials from the CallbackHandler
      * supplied in {@code}initialize{@code}. As long as the configured
      * {@code}IAuthenticator{@code} supports the optional
      * {@code}legacyAuthenticate{@code} method, it can be used here.
      *
      * @return true in all cases since this {@code}LoginModule{@code}
      *         should not be ignored.
      * @exception FailedLoginException if the authentication fails.
      * @exception LoginException if this {@code}LoginModule{@code} is unable to
      * perform the authentication.
      */
     @Override
     public boolean login() throws LoginException
     {
         // prompt for a user name and password
         if (callbackHandler == null)
         {
             logger.info("No CallbackHandler available for authentication");
             throw new LoginException("Authentication failed");
         }

         NameCallback nc = new NameCallback("username: ");
         PasswordCallback pc = new PasswordCallback("password: ", false);
         try
         {
             callbackHandler.handle(new Callback[]{nc, pc});
             username = nc.getName();
             char[] tmpPassword = pc.getPassword();
             if (tmpPassword == null)
                 tmpPassword = new char[0];
             password = new char[tmpPassword.length];
             System.arraycopy(tmpPassword, 0, password, 0, tmpPassword.length);
             pc.clearPassword();
         }
         catch (IOException | UnsupportedCallbackException e)
         {
             logger.info("Unexpected exception processing authentication callbacks", e);
             throw new LoginException("Authentication failed");
         }

         // verify the credentials
         try
         {
             authenticate();
         }
         catch (AuthenticationException e)
         {
             // authentication failed -- clean up
             succeeded = false;
             cleanUpInternalState();
             throw new FailedLoginException(e.getMessage());
         }

         succeeded = true;
         return true;
     }

     private void authenticate()
     {
         if (!StorageService.instance.isAuthSetupComplete())
             throw new AuthenticationException("Cannot login as server authentication setup is not yet completed");

         IAuthenticator authenticator = DatabaseDescriptor.getAuthenticator();
         Map<String, String> credentials = new HashMap<>();
         credentials.put(PasswordAuthenticator.USERNAME_KEY, username);
         credentials.put(PasswordAuthenticator.PASSWORD_KEY, String.valueOf(password));
         AuthenticatedUser user = authenticator.legacyAuthenticate(credentials);
         // Only actual users should be allowed to authenticate for JMX
         if (user.isAnonymous() || user.isSystem())
             throw new AuthenticationException(String.format("Invalid user %s", user.getName()));

         // The LOGIN privilege is required to authenticate - c.f. ClientState::login
         if (!DatabaseDescriptor.getRoleManager().canLogin(user.getPrimaryRole()))
             throw new AuthenticationException(user.getName() + " is not permitted to log in");
     }

     /**
      * This method is called if the LoginContext's overall authentication succeeded
      * (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules
      * succeeded).
      *
      * If this LoginModule's own authentication attempt succeeded (checked by
      * retrieving the private state saved by the {@code}login{@code} method),
      * then this method associates a {@code}CassandraPrincipal{@code}
      * with the {@code}Subject{@code}.
      * If this LoginModule's own authentication attempted failed, then this
      * method removes any state that was originally saved.
      *
      * @return true if this LoginModule's own login and commit attempts succeeded, false otherwise.
      * @exception LoginException if the commit fails.
      */
     @Override
     public boolean commit() throws LoginException
     {
         if (!succeeded)
         {
             return false;
         }
         else
         {
             // add a Principal (authenticated identity)
             // to the Subject
             principal = new CassandraPrincipal(username);
             if (!subject.getPrincipals().contains(principal))
                 subject.getPrincipals().add(principal);

             cleanUpInternalState();
             commitSucceeded = true;
             return true;
         }
     }

     /**
      * This method is called if the LoginContext's  overall authentication failed.
      * (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules
      * did not succeed).
      *
      * If this LoginModule's own authentication attempt succeeded (checked by
      * retrieving the private state saved by the {@code}login{@code} and
      * {@code}commit{@code} methods), then this method cleans up any state that
      * was originally saved.
      *
      * @return false if this LoginModule's own login and/or commit attempts failed, true otherwise.
      * @throws LoginException if the abort fails.
      */
     @Override
     public boolean abort() throws LoginException
     {
         if (!succeeded)
         {
             return false;
         }
         else if (!commitSucceeded)
         {
             // login succeeded but overall authentication failed
             succeeded = false;
             cleanUpInternalState();
             principal = null;
         }
         else
         {
             // overall authentication succeeded and commit succeeded,
             // but someone else's commit failed
             logout();
         }
         return true;
     }

     /**
      * Logout the user.
      *
      * This method removes the principal that was added by the
      * {@code}commit{@code} method.
      *
      * @return true in all cases since this {@code}LoginModule{@code}
      *         should not be ignored.
      * @throws LoginException if the logout fails.
      */
     @Override
     public boolean logout() throws LoginException
     {
         subject.getPrincipals().remove(principal);
         succeeded = false;
         cleanUpInternalState();
         principal = null;
         return true;
     }

     private void cleanUpInternalState()
     {
         username = null;
         if (password != null)
         {
             for (int i = 0; i < password.length; i++)
                 password[i] = ' ';
             password = null;
         }
     }
 }
	/*
	* Licensed to the Apache Software Foundation (ASF) under one
	* or more contributor license agreements. See the NOTICE file
	* distributed with this work for additional information
	* regarding copyright ownership. The ASF licenses this file
	* to you under the Apache License, Version 2.0 (the
	* "License"); you may not use this file except in compliance
	* with the License. You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/
	package org.apache.cassandra.auth;

	import java.io.IOException;
	import java.util.HashMap;
	import java.util.Map;
	import javax.security.auth.Subject;
	import javax.security.auth.callback.*;
	import javax.security.auth.login.FailedLoginException;
	import javax.security.auth.login.LoginException;
	import javax.security.auth.spi.LoginModule;

	import org.slf4j.Logger;
	import org.slf4j.LoggerFactory;

	import org.apache.cassandra.config.DatabaseDescriptor;
	import org.apache.cassandra.exceptions.AuthenticationException;
	import org.apache.cassandra.service.StorageService;

	/**
	* LoginModule which authenticates a user towards the Cassandra database using
	* the internal authentication mechanism.
	*/
	public class CassandraLoginModule implements LoginModule
	{
	private static final Logger logger = LoggerFactory.getLogger(CassandraLoginModule.class);

	// initial state
	private Subject subject;
	private CallbackHandler callbackHandler;

	// the authentication status
	private boolean succeeded = false;
	private boolean commitSucceeded = false;

	// username and password
	private String username;
	private char[] password;

	private CassandraPrincipal principal;

	/**
	* Initialize this {@code}LoginModule{@code}.
	*
	* @param subject the {@code}Subject{@code} to be authenticated. <p>
	* @param callbackHandler a {@code}CallbackHandler{@code} for communicating
	* with the end user (prompting for user names and passwords, for example)
	* @param sharedState shared {@code}LoginModule{@code} state. This param is unused.
	* @param options options specified in the login {@code}Configuration{@code} for this particular
	* {@code}LoginModule{@code}. This param is unused
	*/
	@Override
	public void initialize(Subject subject,
	CallbackHandler callbackHandler,
	Map<java.lang.String, ?> sharedState,
	Map<java.lang.String, ?> options)
	{
	this.subject = subject;
	this.callbackHandler = callbackHandler;
	}

	/**
	* Authenticate the user, obtaining credentials from the CallbackHandler
	* supplied in {@code}initialize{@code}. As long as the configured
	* {@code}IAuthenticator{@code} supports the optional
	* {@code}legacyAuthenticate{@code} method, it can be used here.
	*
	* @return true in all cases since this {@code}LoginModule{@code}
	* should not be ignored.
	* @exception FailedLoginException if the authentication fails.
	* @exception LoginException if this {@code}LoginModule{@code} is unable to
	* perform the authentication.
	*/
	@Override
	public boolean login() throws LoginException
	{
	// prompt for a user name and password
	if (callbackHandler == null)
	{
	logger.info("No CallbackHandler available for authentication");
	throw new LoginException("Authentication failed");
	}

	NameCallback nc = new NameCallback("username: ");
	PasswordCallback pc = new PasswordCallback("password: ", false);
	try
	{
	callbackHandler.handle(new Callback[]{nc, pc});
	username = nc.getName();
	char[] tmpPassword = pc.getPassword();
	if (tmpPassword == null)
	tmpPassword = new char[0];
	password = new char[tmpPassword.length];
	System.arraycopy(tmpPassword, 0, password, 0, tmpPassword.length);
	pc.clearPassword();
	}
	catch (IOException \| UnsupportedCallbackException e)
	{
	logger.info("Unexpected exception processing authentication callbacks", e);
	throw new LoginException("Authentication failed");
	}

	// verify the credentials
	try
	{
	authenticate();
	}
	catch (AuthenticationException e)
	{
	// authentication failed -- clean up
	succeeded = false;
	cleanUpInternalState();
	throw new FailedLoginException(e.getMessage());
	}

	succeeded = true;
	return true;
	}

	private void authenticate()
	{
	if (!StorageService.instance.isAuthSetupComplete())
	throw new AuthenticationException("Cannot login as server authentication setup is not yet completed");

	IAuthenticator authenticator = DatabaseDescriptor.getAuthenticator();
	Map<String, String> credentials = new HashMap<>();
	credentials.put(PasswordAuthenticator.USERNAME_KEY, username);
	credentials.put(PasswordAuthenticator.PASSWORD_KEY, String.valueOf(password));
	AuthenticatedUser user = authenticator.legacyAuthenticate(credentials);
	// Only actual users should be allowed to authenticate for JMX
	if (user.isAnonymous() \|\| user.isSystem())
	throw new AuthenticationException(String.format("Invalid user %s", user.getName()));

	// The LOGIN privilege is required to authenticate - c.f. ClientState::login
	if (!DatabaseDescriptor.getRoleManager().canLogin(user.getPrimaryRole()))
	throw new AuthenticationException(user.getName() + " is not permitted to log in");
	}

	/**
	* This method is called if the LoginContext's overall authentication succeeded
	* (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules
	* succeeded).
	*
	* If this LoginModule's own authentication attempt succeeded (checked by
	* retrieving the private state saved by the {@code}login{@code} method),
	* then this method associates a {@code}CassandraPrincipal{@code}
	* with the {@code}Subject{@code}.
	* If this LoginModule's own authentication attempted failed, then this
	* method removes any state that was originally saved.
	*
	* @return true if this LoginModule's own login and commit attempts succeeded, false otherwise.
	* @exception LoginException if the commit fails.
	*/
	@Override
	public boolean commit() throws LoginException
	{
	if (!succeeded)
	{
	return false;
	}
	else
	{
	// add a Principal (authenticated identity)
	// to the Subject
	principal = new CassandraPrincipal(username);
	if (!subject.getPrincipals().contains(principal))
	subject.getPrincipals().add(principal);

	cleanUpInternalState();
	commitSucceeded = true;
	return true;
	}
	}

	/**
	* This method is called if the LoginContext's overall authentication failed.
	* (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules
	* did not succeed).
	*
	* If this LoginModule's own authentication attempt succeeded (checked by
	* retrieving the private state saved by the {@code}login{@code} and
	* {@code}commit{@code} methods), then this method cleans up any state that
	* was originally saved.
	*
	* @return false if this LoginModule's own login and/or commit attempts failed, true otherwise.
	* @throws LoginException if the abort fails.
	*/
	@Override
	public boolean abort() throws LoginException
	{
	if (!succeeded)
	{
	return false;
	}
	else if (!commitSucceeded)
	{
	// login succeeded but overall authentication failed
	succeeded = false;
	cleanUpInternalState();
	principal = null;
	}
	else
	{
	// overall authentication succeeded and commit succeeded,
	// but someone else's commit failed
	logout();
	}
	return true;
	}

	/**
	* Logout the user.
	*
	* This method removes the principal that was added by the
	* {@code}commit{@code} method.
	*
	* @return true in all cases since this {@code}LoginModule{@code}
	* should not be ignored.
	* @throws LoginException if the logout fails.
	*/
	@Override
	public boolean logout() throws LoginException
	{
	subject.getPrincipals().remove(principal);
	succeeded = false;
	cleanUpInternalState();
	principal = null;
	return true;
	}

	private void cleanUpInternalState()
	{
	username = null;
	if (password != null)
	{
	for (int i = 0; i < password.length; i++)
	password[i] = ' ';
	password = null;
	}
	}
	}