| /** |
| * Licensed to the Apache Software Foundation (ASF) under one |
| * or more contributor license agreements. See the NOTICE file |
| * distributed with this work for additional information |
| * regarding copyright ownership. The ASF licenses this file |
| * to you under the Apache License, Version 2.0 (the |
| * "License"); you may not use this file except in compliance |
| * with the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| package backtype.storm.security.auth; |
| |
| import java.util.Map; |
| import java.util.Set; |
| import java.util.concurrent.atomic.AtomicInteger; |
| import java.net.InetAddress; |
| import com.google.common.annotations.VisibleForTesting; |
| import org.slf4j.Logger; |
| import org.slf4j.LoggerFactory; |
| |
| import java.security.AccessControlContext; |
| import java.security.AccessController; |
| import java.security.Principal; |
| import javax.security.auth.Subject; |
| |
| /** |
| * context request context includes info about |
| * (1) remote address, |
| * (2) remote subject and primary principal |
| * (3) request ID |
| */ |
| public class ReqContext { |
| private static final AtomicInteger uniqueId = new AtomicInteger(0); |
| private Subject _subject; |
| private InetAddress _remoteAddr; |
| private Integer _reqID; |
| private Map _storm_conf; |
| private Principal realPrincipal; |
| |
| private static final Logger LOG = LoggerFactory.getLogger(ReqContext.class); |
| |
| |
| /** |
| * Get a request context associated with current thread |
| * @return |
| */ |
| public static ReqContext context() { |
| return ctxt.get(); |
| } |
| |
| //each thread will have its own request context |
| private static final ThreadLocal < ReqContext > ctxt = |
| new ThreadLocal < ReqContext > () { |
| @Override |
| protected ReqContext initialValue() { |
| return new ReqContext(AccessController.getContext()); |
| } |
| }; |
| |
| //private constructor |
| @VisibleForTesting |
| public ReqContext(AccessControlContext acl_ctxt) { |
| _subject = Subject.getSubject(acl_ctxt); |
| _reqID = uniqueId.incrementAndGet(); |
| } |
| |
| //private constructor |
| @VisibleForTesting |
| public ReqContext(Subject sub) { |
| _subject = sub; |
| _reqID = uniqueId.incrementAndGet(); |
| } |
| |
| |
| /** |
| * client address |
| */ |
| public void setRemoteAddress(InetAddress addr) { |
| _remoteAddr = addr; |
| } |
| |
| public InetAddress remoteAddress() { |
| return _remoteAddr; |
| } |
| |
| /** |
| * Set remote subject explicitly |
| */ |
| public void setSubject(Subject subject) { |
| _subject = subject; |
| } |
| |
| /** |
| * Retrieve client subject associated with this request context |
| */ |
| public Subject subject() { |
| return _subject; |
| } |
| |
| /** |
| * The primary principal associated current subject |
| */ |
| public Principal principal() { |
| if (_subject == null) return null; |
| Set<Principal> princs = _subject.getPrincipals(); |
| if (princs.size()==0) return null; |
| return (Principal) (princs.toArray()[0]); |
| } |
| |
| public void setRealPrincipal(Principal realPrincipal) { |
| this.realPrincipal = realPrincipal; |
| } |
| /** |
| * The real principal associated with the subject. |
| */ |
| public Principal realPrincipal() { |
| return this.realPrincipal; |
| } |
| |
| /** |
| * Returns true if this request is an impersonation request. |
| * @return |
| */ |
| public boolean isImpersonating() { |
| return this.realPrincipal != null; |
| } |
| |
| /** |
| * request ID of this request |
| */ |
| public Integer requestID() { |
| return _reqID; |
| } |
| |
| } |