GSSCallback extends SaslRpcServer.SaslGssCallbackHandler { boolean allowConnect(String principal) { String allowedPrincipals = conf.get(ServerConfig.ALLOW_CONNECT); if (allowedPrincipals == null) { return false; } String principalShortName; if (KerberosName.hasRulesBeenSet()) { try { KerberosName krbName = new KerberosName(principal); principalShortName = krbName.getShortName(); if (principalShortName.equals(principal)) { principalShortName = getShortName(principal); } } catch (NoMatchingRule e) { LoggerFactory.getLogger(GSSCallback.class) .debug("No matching rule found for principal " + principal, e); principalShortName = getShortName(principal); } catch (Exception e) { LoggerFactory.getLogger(GSSCallback.class) .debug("Cannot derive short name from KerberosName. " + "Use principal name prefix to authenticate", e); principalShortName = getShortName(principal); } } else { principalShortName = getShortName(principal); } List<String> items = Arrays.asList(allowedPrincipals.split("\\s*,\\s*")); for (String item : items) { if (comparePrincipals(item, principalShortName)) { return true; } } return false; } GSSCallback(Configuration conf); @Override void handle(Callback[] callbacks);  }
@Test public void testAllowConnectOnKerberosPrincipal() { String validPrincipal = "hive@GCE.CLOUDERA.COM"; assertTrue("Authenticate valid user", callBack.allowConnect(validPrincipal)); String invalidPrincipal = "impala@GCE.CLOUDERA.COM"; assertFalse("Do not authenticate invalid user", callBack.allowConnect(invalidPrincipal)); String ruleString = "DEFAULT"; KerberosName.setRules(ruleString); assertTrue("Authenticate valid user", callBack.allowConnect(validPrincipal)); assertFalse("Do not authenticate invalid user", callBack.allowConnect(invalidPrincipal)); }
@Test public void testAllowConnectWithRuleSet() { String ruleString = "RULE:[1:$1@$0](user1@TEST.REALM.COM)s/.*/hive/"; KerberosName.setRules(ruleString); String validPrincipal = "user1@TEST.REALM.COM"; assertTrue("Authenticate valid user", callBack.allowConnect(validPrincipal)); ruleString = "RULE:[1:$1@$0](user2@TEST.REALM.COM)s/.*/solr/"; KerberosName.setRules(ruleString); String invalidPrincipal1 = "user2@TEST.REALM.COM"; assertFalse("Do not authenticate invalid user", callBack.allowConnect(invalidPrincipal1)); String invalidPrincipal2 = "user3@TEST.REALM.COM"; assertFalse("Do not authenticate invalid user", callBack.allowConnect(invalidPrincipal2)); }