src/java/org/apache/cassandra/auth/jmx/AuthenticationProxy.java

/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.apache.cassandra.auth.jmx;

import java.security.AccessController;
import java.security.PrivilegedAction;
import javax.management.remote.JMXAuthenticator;
import javax.security.auth.Subject;
import javax.security.auth.callback.*;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import org.apache.cassandra.exceptions.ConfigurationException;

/**
 * An alternative to the JAAS based implementation of JMXAuthenticator provided
 * by the JDK (JMXPluggableAuthenticator).
 *
 * Authentication is performed via delegation to a LoginModule. The JAAS login
 * config is specified by passing its identifier in a custom system property:
 *     cassandra.jmx.remote.login.config
 *
 * The location of the JAAS configuration file containing that config is
 * specified in the standard way, using the java.security.auth.login.config
 * system property.
 *
 * If authentication is successful then a Subject containing one or more
 * Principals is returned. This Subject may then be used during authorization
 * if a JMX authorization is enabled.
 */
public final class AuthenticationProxy implements JMXAuthenticator
{
    private static Logger logger = LoggerFactory.getLogger(AuthenticationProxy.class);

    // Identifier of JAAS configuration to be used for subject authentication
    private final String loginConfigName;

    /**
     * Creates an instance of <code>JMXPluggableAuthenticator</code>
     * and initializes it with a {@link LoginContext}.
     *
     * @param loginConfigName name of the specifig JAAS login configuration to
     *                        use when authenticating JMX connections
     * @throws SecurityException if the authentication mechanism cannot be
     *         initialized.
     */
    public AuthenticationProxy(String loginConfigName)
    {
        if (loginConfigName == null)
            throw new ConfigurationException("JAAS login configuration missing for JMX authenticator setup");

        this.loginConfigName = loginConfigName;
    }

    /**
     * Perform authentication of the client opening the {@code}MBeanServerConnection{@code}
     *
     * @param credentials optionally these credentials may be supplied by the JMX user.
     *                    Out of the box, the JDK's {@code}RMIServerImpl{@code} is capable
     *                    of supplying a two element String[], containing username and password.
     *                    If present, these credentials will be made available to configured
     *                    {@code}LoginModule{@code}s via {@code}JMXCallbackHandler{@code}.
     *
     * @return the authenticated subject containing any {@code}Principal{@code}s added by
     *the {@code}LoginModule{@code}s
     *
     * @throws SecurityException if the server cannot authenticate the user
     *         with the provided credentials.
     */
    public Subject authenticate(Object credentials)
    {
        // The credentials object is expected to be a string array holding the subject's
        // username & password. Those values are made accessible to LoginModules via the
        // JMXCallbackHandler.
        JMXCallbackHandler callbackHandler = new JMXCallbackHandler(credentials);
        try
        {
            LoginContext loginContext = new LoginContext(loginConfigName, callbackHandler);
            loginContext.login();
            final Subject subject = loginContext.getSubject();
            if (!subject.isReadOnly())
            {
                AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
                    subject.setReadOnly();
                    return null;
                });
            }

            return subject;
        }
        catch (LoginException e)
        {
            logger.trace("Authentication exception", e);
            throw new SecurityException("Authentication error", e);
        }
    }

    /**
     * This callback handler supplies the username and password (which was
     * optionally supplied by the JMX user) to the JAAS login module performing
     * the authentication, should it require them . No interactive user
     * prompting is necessary because the credentials are already available to
     * this class (via its enclosing class).
     */
    private static final class JMXCallbackHandler implements CallbackHandler
    {
        private char[] username;
        private char[] password;
        private JMXCallbackHandler(Object credentials)
        {
            // if username/password credentials were supplied, store them in
            // the relevant variables to make them accessible to LoginModules
            // via JMXCallbackHandler
            if (credentials instanceof String[])
            {
                String[] strings = (String[]) credentials;
                if (strings[0] != null)
                    username = strings[0].toCharArray();
                if (strings[1] != null)
                    password = strings[1].toCharArray();
            }
        }

        public void handle(Callback[] callbacks) throws UnsupportedCallbackException
        {
            for (int i = 0; i < callbacks.length; i++)
            {
                if (callbacks[i] instanceof NameCallback)
                    ((NameCallback)callbacks[i]).setName(username == null ? null : new String(username));
                else if (callbacks[i] instanceof PasswordCallback)
                    ((PasswordCallback)callbacks[i]).setPassword(password == null ? null : password);
                else
                    throw new UnsupportedCallbackException(callbacks[i], "Unrecognized Callback: " + callbacks[i].getClass().getName());
            }
        }
    }
}