@Test public void testInvalidAuthServiceUser() { ConfigurableSpnegoLoginService mockSpnegoLoginService = mock(ConfigurableSpnegoLoginService.class); SpnegoUserPrincipal servicePrincipal = new SpnegoUserPrincipal(TEST_SERVICE_USER, ENCODED_TOKEN); Subject subject = new Subject(true, Collections.singleton(servicePrincipal), Collections.emptySet(), Collections.emptySet()); SpnegoUserIdentity result = new SpnegoUserIdentity(subject, servicePrincipal, null); expect(mockSpnegoLoginService.login(anyString(), anyObject(), anyObject())).andReturn(result); TestAuthorizer userAuthorizer = new TestAuthorizer(TEST_USER); HttpServletRequest mockRequest = mock(HttpServletRequest.class); expect(mockRequest.getParameter(DO_AS)).andReturn(TEST_USER); replay(mockSpnegoLoginService); TrustedProxyLoginService trustedProxyLoginService = new TrustedProxyLoginService(mockSpnegoLoginService, userAuthorizer); UserIdentity doAsIdentity = trustedProxyLoginService.login(null, ENCODED_TOKEN, mockRequest); assertNotNull(doAsIdentity); assertFalse(((SpnegoUserIdentity) doAsIdentity).isEstablished()); }
@Override public UserIdentity login(String username, Object credentials, ServletRequest request) { if (!(request instanceof HttpServletRequest)) { return null; } SpnegoUserIdentity serviceIdentity = (SpnegoUserIdentity) _delegateSpnegoLoginService.login(username, credentials, request); SpnegoUserPrincipal servicePrincipal = (SpnegoUserPrincipal) serviceIdentity.getUserPrincipal(); String doAsUser = request.getParameter(DO_AS); LOG.info("Authorizing proxy user {} from {} service", doAsUser, servicePrincipal.getName()); UserIdentity doAsIdentity = null; if (doAsUser != null && !doAsUser.isEmpty()) { doAsIdentity = _endUserAuthorizer.getUserIdentity((HttpServletRequest) request, doAsUser); } Principal principal = new TrustedProxyPrincipal(doAsUser, servicePrincipal); Subject subject = new Subject(READ_ONLY_SUBJECT, Collections.singleton(principal), Collections.emptySet(), Collections.emptySet()); if (!serviceIdentity.isEstablished()) { LOG.info("Service user {} isn't authorized as a trusted proxy", servicePrincipal.getName()); return new SpnegoUserIdentity(subject, principal, null); } else { if (doAsIdentity == null) { LOG.info("Couldn't authorize user {}", doAsUser); } return new SpnegoUserIdentity(subject, principal, doAsIdentity); } }
TrustedProxyLoginService extends ContainerLifeCycle implements LoginService { @Override public UserIdentity login(String username, Object credentials, ServletRequest request) { if (!(request instanceof HttpServletRequest)) { return null; } SpnegoUserIdentity serviceIdentity = (SpnegoUserIdentity) _delegateSpnegoLoginService.login(username, credentials, request); SpnegoUserPrincipal servicePrincipal = (SpnegoUserPrincipal) serviceIdentity.getUserPrincipal(); String doAsUser = request.getParameter(DO_AS); LOG.info("Authorizing proxy user {} from {} service", doAsUser, servicePrincipal.getName()); UserIdentity doAsIdentity = null; if (doAsUser != null && !doAsUser.isEmpty()) { doAsIdentity = _endUserAuthorizer.getUserIdentity((HttpServletRequest) request, doAsUser); } Principal principal = new TrustedProxyPrincipal(doAsUser, servicePrincipal); Subject subject = new Subject(READ_ONLY_SUBJECT, Collections.singleton(principal), Collections.emptySet(), Collections.emptySet()); if (!serviceIdentity.isEstablished()) { LOG.info("Service user {} isn't authorized as a trusted proxy", servicePrincipal.getName()); return new SpnegoUserIdentity(subject, principal, null); } else { if (doAsIdentity == null) { LOG.info("Couldn't authorize user {}", doAsUser); } return new SpnegoUserIdentity(subject, principal, doAsIdentity); } } }
TrustedProxyLoginService extends ContainerLifeCycle implements LoginService { @Override public UserIdentity login(String username, Object credentials, ServletRequest request) { if (!(request instanceof HttpServletRequest)) { return null; } SpnegoUserIdentity serviceIdentity = (SpnegoUserIdentity) _delegateSpnegoLoginService.login(username, credentials, request); SpnegoUserPrincipal servicePrincipal = (SpnegoUserPrincipal) serviceIdentity.getUserPrincipal(); String doAsUser = request.getParameter(DO_AS); LOG.info("Authorizing proxy user {} from {} service", doAsUser, servicePrincipal.getName()); UserIdentity doAsIdentity = null; if (doAsUser != null && !doAsUser.isEmpty()) { doAsIdentity = _endUserAuthorizer.getUserIdentity((HttpServletRequest) request, doAsUser); } Principal principal = new TrustedProxyPrincipal(doAsUser, servicePrincipal); Subject subject = new Subject(READ_ONLY_SUBJECT, Collections.singleton(principal), Collections.emptySet(), Collections.emptySet()); if (!serviceIdentity.isEstablished()) { LOG.info("Service user {} isn't authorized as a trusted proxy", servicePrincipal.getName()); return new SpnegoUserIdentity(subject, principal, null); } else { if (doAsIdentity == null) { LOG.info("Couldn't authorize user {}", doAsUser); } return new SpnegoUserIdentity(subject, principal, doAsIdentity); } } TrustedProxyLoginService(String realm, AuthorizationService userAuthorizer, List<String> trustedProxies, String trustedProxyIpPattern);   TrustedProxyLoginService(ConfigurableSpnegoLoginService delegateSpnegoLoginService, AuthorizationService userAuthorizer); }
TrustedProxyLoginService extends ContainerLifeCycle implements LoginService { @Override public UserIdentity login(String username, Object credentials, ServletRequest request) { if (!(request instanceof HttpServletRequest)) { return null; } SpnegoUserIdentity serviceIdentity = (SpnegoUserIdentity) _delegateSpnegoLoginService.login(username, credentials, request); SpnegoUserPrincipal servicePrincipal = (SpnegoUserPrincipal) serviceIdentity.getUserPrincipal(); String doAsUser = request.getParameter(DO_AS); LOG.info("Authorizing proxy user {} from {} service", doAsUser, servicePrincipal.getName()); UserIdentity doAsIdentity = null; if (doAsUser != null && !doAsUser.isEmpty()) { doAsIdentity = _endUserAuthorizer.getUserIdentity((HttpServletRequest) request, doAsUser); } Principal principal = new TrustedProxyPrincipal(doAsUser, servicePrincipal); Subject subject = new Subject(READ_ONLY_SUBJECT, Collections.singleton(principal), Collections.emptySet(), Collections.emptySet()); if (!serviceIdentity.isEstablished()) { LOG.info("Service user {} isn't authorized as a trusted proxy", servicePrincipal.getName()); return new SpnegoUserIdentity(subject, principal, null); } else { if (doAsIdentity == null) { LOG.info("Couldn't authorize user {}", doAsUser); } return new SpnegoUserIdentity(subject, principal, doAsIdentity); } } TrustedProxyLoginService(String realm, AuthorizationService userAuthorizer, List<String> trustedProxies, String trustedProxyIpPattern);   TrustedProxyLoginService(ConfigurableSpnegoLoginService delegateSpnegoLoginService, AuthorizationService userAuthorizer); void setServiceName(String serviceName); void setHostName(String hostName); void setKeyTabPath(Path path); @Override String getName(); @Override UserIdentity login(String username, Object credentials, ServletRequest request); @Override boolean validate(UserIdentity user); @Override IdentityService getIdentityService(); @Override void setIdentityService(IdentityService service); @Override void logout(UserIdentity user); }
TrustedProxyLoginService extends ContainerLifeCycle implements LoginService { @Override public UserIdentity login(String username, Object credentials, ServletRequest request) { if (!(request instanceof HttpServletRequest)) { return null; } SpnegoUserIdentity serviceIdentity = (SpnegoUserIdentity) _delegateSpnegoLoginService.login(username, credentials, request); SpnegoUserPrincipal servicePrincipal = (SpnegoUserPrincipal) serviceIdentity.getUserPrincipal(); String doAsUser = request.getParameter(DO_AS); LOG.info("Authorizing proxy user {} from {} service", doAsUser, servicePrincipal.getName()); UserIdentity doAsIdentity = null; if (doAsUser != null && !doAsUser.isEmpty()) { doAsIdentity = _endUserAuthorizer.getUserIdentity((HttpServletRequest) request, doAsUser); } Principal principal = new TrustedProxyPrincipal(doAsUser, servicePrincipal); Subject subject = new Subject(READ_ONLY_SUBJECT, Collections.singleton(principal), Collections.emptySet(), Collections.emptySet()); if (!serviceIdentity.isEstablished()) { LOG.info("Service user {} isn't authorized as a trusted proxy", servicePrincipal.getName()); return new SpnegoUserIdentity(subject, principal, null); } else { if (doAsIdentity == null) { LOG.info("Couldn't authorize user {}", doAsUser); } return new SpnegoUserIdentity(subject, principal, doAsIdentity); } } TrustedProxyLoginService(String realm, AuthorizationService userAuthorizer, List<String> trustedProxies, String trustedProxyIpPattern);   TrustedProxyLoginService(ConfigurableSpnegoLoginService delegateSpnegoLoginService, AuthorizationService userAuthorizer); void setServiceName(String serviceName); void setHostName(String hostName); void setKeyTabPath(Path path); @Override String getName(); @Override UserIdentity login(String username, Object credentials, ServletRequest request); @Override boolean validate(UserIdentity user); @Override IdentityService getIdentityService(); @Override void setIdentityService(IdentityService service); @Override void logout(UserIdentity user); static final boolean READ_ONLY_SUBJECT; }