| /* |
| * Licensed to the Apache Software Foundation (ASF) under one |
| * or more contributor license agreements. See the NOTICE file |
| * distributed with this work for additional information |
| * regarding copyright ownership. The ASF licenses this file |
| * to you under the Apache License, Version 2.0 (the |
| * "License"); you may not use this file except in compliance |
| * with the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| package org.apache.storm.security.auth; |
| |
| import java.net.InetAddress; |
| import java.security.AccessControlContext; |
| import java.security.AccessController; |
| import java.security.Principal; |
| import java.util.Set; |
| import java.util.concurrent.atomic.AtomicInteger; |
| import javax.security.auth.Subject; |
| import org.apache.storm.shade.com.google.common.annotations.VisibleForTesting; |
| |
| /** |
| * Request context. Context request context includes info about: |
| * <ol> |
| * <li>remote address</li> |
| * <li>remote subject and primary principal |
| * <li>request ID</li> |
| * </ol> |
| */ |
| public class ReqContext { |
| private static final AtomicInteger uniqueId = new AtomicInteger(0); |
| //each thread will have its own request context |
| private static final ThreadLocal<ReqContext> ctxt = |
| ThreadLocal.withInitial(() -> new ReqContext(AccessController.getContext())); |
| private Subject subject; |
| private InetAddress remoteAddr; |
| private final int reqId; |
| private Principal realPrincipal; |
| |
| //private constructor |
| @VisibleForTesting |
| public ReqContext(AccessControlContext aclCtxt) { |
| subject = Subject.getSubject(aclCtxt); |
| reqId = uniqueId.incrementAndGet(); |
| } |
| |
| //private constructor |
| @VisibleForTesting |
| public ReqContext(Subject sub) { |
| subject = sub; |
| reqId = uniqueId.incrementAndGet(); |
| } |
| |
| /** |
| * Copy Constructor. |
| */ |
| @VisibleForTesting |
| public ReqContext(ReqContext other) { |
| subject = other.subject; |
| remoteAddr = other.remoteAddr; |
| reqId = other.reqId; |
| realPrincipal = other.realPrincipal; |
| } |
| |
| /** |
| * Get context. |
| * @return a request context associated with current thread |
| */ |
| public static ReqContext context() { |
| return ctxt.get(); |
| } |
| |
| /** |
| * Reset the context back to a default. used for testing. |
| */ |
| public static void reset() { |
| ctxt.remove(); |
| } |
| |
| @Override |
| public String toString() { |
| return "ReqContext{" |
| + "realPrincipal=" + ((realPrincipal != null) ? realPrincipal.getName() : "null") |
| + ", reqId=" + reqId |
| + ", remoteAddr=" + remoteAddr |
| + ", authZPrincipal=" + ((principal() != null) ? principal().getName() : "null") |
| + ", ThreadId=" + Thread.currentThread().toString() |
| + '}'; |
| } |
| |
| /** |
| * client address. |
| */ |
| public void setRemoteAddress(InetAddress addr) { |
| remoteAddr = addr; |
| } |
| |
| public InetAddress remoteAddress() { |
| return remoteAddr; |
| } |
| |
| /** |
| * Set remote subject explicitly. |
| */ |
| public void setSubject(Subject subject) { |
| this.subject = subject; |
| } |
| |
| /** |
| * Retrieve client subject associated with this request context. |
| */ |
| public Subject subject() { |
| return subject; |
| } |
| |
| /** |
| * The primary principal associated current subject. |
| */ |
| public Principal principal() { |
| if (subject == null) { |
| return null; |
| } |
| Set<Principal> princs = subject.getPrincipals(); |
| if (princs.size() == 0) { |
| return null; |
| } |
| return (Principal) (princs.toArray()[0]); |
| } |
| |
| public void setRealPrincipal(Principal realPrincipal) { |
| this.realPrincipal = realPrincipal; |
| } |
| |
| /** |
| * The real principal associated with the subject. |
| */ |
| public Principal realPrincipal() { |
| return this.realPrincipal; |
| } |
| |
| /** |
| * Check whether context is impersonating. |
| * @return true if this request is an impersonation request. |
| */ |
| public boolean isImpersonating() { |
| return this.realPrincipal != null && !this.realPrincipal.equals(this.principal()); |
| } |
| |
| /** |
| * request ID of this request. |
| */ |
| @SuppressWarnings("checkstyle:AbbreviationAsWordInName") |
| public int requestID() { |
| return reqId; |
| } |
| } |