@Test(expected = ThriftSecurityException.class) public void testWrongTokenType() throws Exception { final String principal = "root"; TCredentials tcreds = new TCredentials(principal, PasswordToken.class.getName(), ByteBuffer.allocate(0), UUID.randomUUID().toString()); UGIAssumingProcessor.rpcPrincipal.set(principal); proxy.updateArgs(new Object[] {new Object(), tcreds}); }
protected void updateArgs(Object[] args) throws ThriftSecurityException { if (args == null || args.length < 2) { return; } TCredentials tcreds = null; if (args[0] != null && args[0] instanceof TCredentials) { tcreds = (TCredentials) args[0]; } else if (args[1] != null && args[1] instanceof TCredentials) { tcreds = (TCredentials) args[1]; } if (tcreds == null) { log.trace("Did not find a TCredentials object in the first two positions" + " of the argument list, not updating principal"); return; } Class<? extends AuthenticationToken> tokenClass = getTokenClassFromName(tcreds.tokenClassName); final String principal = UGIAssumingProcessor.rpcPrincipal(); if (UGIAssumingProcessor.rpcMechanism() == SaslMechanism.DIGEST_MD5 && DelegationTokenImpl.class.isAssignableFrom(tokenClass)) { if (!principal.equals(tcreds.principal)) { log.warn("{} issued RPC with delegation token over DIGEST-MD5 as the " + "Accumulo principal {}. Disallowing RPC", principal, tcreds.principal); throw new ThriftSecurityException("RPC principal did not match provided Accumulo principal", SecurityErrorCode.BAD_CREDENTIALS); } return; } if (!KerberosToken.class.isAssignableFrom(tokenClass) && !SystemToken.class.isAssignableFrom(tokenClass)) { log.debug("Will not update principal on authentication tokens other than" + " KerberosToken. Received {}", tokenClass); throw new ThriftSecurityException("Did not receive a valid token", SecurityErrorCode.BAD_CREDENTIALS); } if (principal == null) { log.debug( "Found KerberosToken in TCredentials, but did not receive principal from SASL processor"); throw new ThriftSecurityException("Did not extract principal from Thrift SASL processor", SecurityErrorCode.BAD_CREDENTIALS); } if (!principal.equals(tcreds.principal)) { UsersWithHosts usersWithHosts = impersonation.get(principal); if (usersWithHosts == null) { principalMismatch(principal, tcreds.principal); } if (!usersWithHosts.getUsers().contains(tcreds.principal)) { principalMismatch(principal, tcreds.principal); } String clientAddr = TServerUtils.clientAddress.get(); if (!usersWithHosts.getHosts().contains(clientAddr)) { final String msg = "Principal in credentials object allowed mismatched" + " Kerberos principals, but not on " + clientAddr; log.warn(msg); throw new ThriftSecurityException(msg, SecurityErrorCode.BAD_CREDENTIALS); } } }
TCredentialsUpdatingInvocationHandler implements InvocationHandler { protected void updateArgs(Object[] args) throws ThriftSecurityException { if (args == null || args.length < 2) { return; } TCredentials tcreds = null; if (args[0] != null && args[0] instanceof TCredentials) { tcreds = (TCredentials) args[0]; } else if (args[1] != null && args[1] instanceof TCredentials) { tcreds = (TCredentials) args[1]; } if (tcreds == null) { log.trace("Did not find a TCredentials object in the first two positions" + " of the argument list, not updating principal"); return; } Class<? extends AuthenticationToken> tokenClass = getTokenClassFromName(tcreds.tokenClassName); final String principal = UGIAssumingProcessor.rpcPrincipal(); if (UGIAssumingProcessor.rpcMechanism() == SaslMechanism.DIGEST_MD5 && DelegationTokenImpl.class.isAssignableFrom(tokenClass)) { if (!principal.equals(tcreds.principal)) { log.warn("{} issued RPC with delegation token over DIGEST-MD5 as the " + "Accumulo principal {}. Disallowing RPC", principal, tcreds.principal); throw new ThriftSecurityException("RPC principal did not match provided Accumulo principal", SecurityErrorCode.BAD_CREDENTIALS); } return; } if (!KerberosToken.class.isAssignableFrom(tokenClass) && !SystemToken.class.isAssignableFrom(tokenClass)) { log.debug("Will not update principal on authentication tokens other than" + " KerberosToken. Received {}", tokenClass); throw new ThriftSecurityException("Did not receive a valid token", SecurityErrorCode.BAD_CREDENTIALS); } if (principal == null) { log.debug( "Found KerberosToken in TCredentials, but did not receive principal from SASL processor"); throw new ThriftSecurityException("Did not extract principal from Thrift SASL processor", SecurityErrorCode.BAD_CREDENTIALS); } if (!principal.equals(tcreds.principal)) { UsersWithHosts usersWithHosts = impersonation.get(principal); if (usersWithHosts == null) { principalMismatch(principal, tcreds.principal); } if (!usersWithHosts.getUsers().contains(tcreds.principal)) { principalMismatch(principal, tcreds.principal); } String clientAddr = TServerUtils.clientAddress.get(); if (!usersWithHosts.getHosts().contains(clientAddr)) { final String msg = "Principal in credentials object allowed mismatched" + " Kerberos principals, but not on " + clientAddr; log.warn(msg); throw new ThriftSecurityException(msg, SecurityErrorCode.BAD_CREDENTIALS); } } } }
TCredentialsUpdatingInvocationHandler implements InvocationHandler { protected void updateArgs(Object[] args) throws ThriftSecurityException { if (args == null || args.length < 2) { return; } TCredentials tcreds = null; if (args[0] != null && args[0] instanceof TCredentials) { tcreds = (TCredentials) args[0]; } else if (args[1] != null && args[1] instanceof TCredentials) { tcreds = (TCredentials) args[1]; } if (tcreds == null) { log.trace("Did not find a TCredentials object in the first two positions" + " of the argument list, not updating principal"); return; } Class<? extends AuthenticationToken> tokenClass = getTokenClassFromName(tcreds.tokenClassName); final String principal = UGIAssumingProcessor.rpcPrincipal(); if (UGIAssumingProcessor.rpcMechanism() == SaslMechanism.DIGEST_MD5 && DelegationTokenImpl.class.isAssignableFrom(tokenClass)) { if (!principal.equals(tcreds.principal)) { log.warn("{} issued RPC with delegation token over DIGEST-MD5 as the " + "Accumulo principal {}. Disallowing RPC", principal, tcreds.principal); throw new ThriftSecurityException("RPC principal did not match provided Accumulo principal", SecurityErrorCode.BAD_CREDENTIALS); } return; } if (!KerberosToken.class.isAssignableFrom(tokenClass) && !SystemToken.class.isAssignableFrom(tokenClass)) { log.debug("Will not update principal on authentication tokens other than" + " KerberosToken. Received {}", tokenClass); throw new ThriftSecurityException("Did not receive a valid token", SecurityErrorCode.BAD_CREDENTIALS); } if (principal == null) { log.debug( "Found KerberosToken in TCredentials, but did not receive principal from SASL processor"); throw new ThriftSecurityException("Did not extract principal from Thrift SASL processor", SecurityErrorCode.BAD_CREDENTIALS); } if (!principal.equals(tcreds.principal)) { UsersWithHosts usersWithHosts = impersonation.get(principal); if (usersWithHosts == null) { principalMismatch(principal, tcreds.principal); } if (!usersWithHosts.getUsers().contains(tcreds.principal)) { principalMismatch(principal, tcreds.principal); } String clientAddr = TServerUtils.clientAddress.get(); if (!usersWithHosts.getHosts().contains(clientAddr)) { final String msg = "Principal in credentials object allowed mismatched" + " Kerberos principals, but not on " + clientAddr; log.warn(msg); throw new ThriftSecurityException(msg, SecurityErrorCode.BAD_CREDENTIALS); } } } protected  TCredentialsUpdatingInvocationHandler(final I serverInstance,
      AccumuloConfiguration conf); }
TCredentialsUpdatingInvocationHandler implements InvocationHandler { protected void updateArgs(Object[] args) throws ThriftSecurityException { if (args == null || args.length < 2) { return; } TCredentials tcreds = null; if (args[0] != null && args[0] instanceof TCredentials) { tcreds = (TCredentials) args[0]; } else if (args[1] != null && args[1] instanceof TCredentials) { tcreds = (TCredentials) args[1]; } if (tcreds == null) { log.trace("Did not find a TCredentials object in the first two positions" + " of the argument list, not updating principal"); return; } Class<? extends AuthenticationToken> tokenClass = getTokenClassFromName(tcreds.tokenClassName); final String principal = UGIAssumingProcessor.rpcPrincipal(); if (UGIAssumingProcessor.rpcMechanism() == SaslMechanism.DIGEST_MD5 && DelegationTokenImpl.class.isAssignableFrom(tokenClass)) { if (!principal.equals(tcreds.principal)) { log.warn("{} issued RPC with delegation token over DIGEST-MD5 as the " + "Accumulo principal {}. Disallowing RPC", principal, tcreds.principal); throw new ThriftSecurityException("RPC principal did not match provided Accumulo principal", SecurityErrorCode.BAD_CREDENTIALS); } return; } if (!KerberosToken.class.isAssignableFrom(tokenClass) && !SystemToken.class.isAssignableFrom(tokenClass)) { log.debug("Will not update principal on authentication tokens other than" + " KerberosToken. Received {}", tokenClass); throw new ThriftSecurityException("Did not receive a valid token", SecurityErrorCode.BAD_CREDENTIALS); } if (principal == null) { log.debug( "Found KerberosToken in TCredentials, but did not receive principal from SASL processor"); throw new ThriftSecurityException("Did not extract principal from Thrift SASL processor", SecurityErrorCode.BAD_CREDENTIALS); } if (!principal.equals(tcreds.principal)) { UsersWithHosts usersWithHosts = impersonation.get(principal); if (usersWithHosts == null) { principalMismatch(principal, tcreds.principal); } if (!usersWithHosts.getUsers().contains(tcreds.principal)) { principalMismatch(principal, tcreds.principal); } String clientAddr = TServerUtils.clientAddress.get(); if (!usersWithHosts.getHosts().contains(clientAddr)) { final String msg = "Principal in credentials object allowed mismatched" + " Kerberos principals, but not on " + clientAddr; log.warn(msg); throw new ThriftSecurityException(msg, SecurityErrorCode.BAD_CREDENTIALS); } } } protected  TCredentialsUpdatingInvocationHandler(final I serverInstance,
      AccumuloConfiguration conf); @Override Object invoke(Object proxy, Method method, Object[] args); }
TCredentialsUpdatingInvocationHandler implements InvocationHandler { protected void updateArgs(Object[] args) throws ThriftSecurityException { if (args == null || args.length < 2) { return; } TCredentials tcreds = null; if (args[0] != null && args[0] instanceof TCredentials) { tcreds = (TCredentials) args[0]; } else if (args[1] != null && args[1] instanceof TCredentials) { tcreds = (TCredentials) args[1]; } if (tcreds == null) { log.trace("Did not find a TCredentials object in the first two positions" + " of the argument list, not updating principal"); return; } Class<? extends AuthenticationToken> tokenClass = getTokenClassFromName(tcreds.tokenClassName); final String principal = UGIAssumingProcessor.rpcPrincipal(); if (UGIAssumingProcessor.rpcMechanism() == SaslMechanism.DIGEST_MD5 && DelegationTokenImpl.class.isAssignableFrom(tokenClass)) { if (!principal.equals(tcreds.principal)) { log.warn("{} issued RPC with delegation token over DIGEST-MD5 as the " + "Accumulo principal {}. Disallowing RPC", principal, tcreds.principal); throw new ThriftSecurityException("RPC principal did not match provided Accumulo principal", SecurityErrorCode.BAD_CREDENTIALS); } return; } if (!KerberosToken.class.isAssignableFrom(tokenClass) && !SystemToken.class.isAssignableFrom(tokenClass)) { log.debug("Will not update principal on authentication tokens other than" + " KerberosToken. Received {}", tokenClass); throw new ThriftSecurityException("Did not receive a valid token", SecurityErrorCode.BAD_CREDENTIALS); } if (principal == null) { log.debug( "Found KerberosToken in TCredentials, but did not receive principal from SASL processor"); throw new ThriftSecurityException("Did not extract principal from Thrift SASL processor", SecurityErrorCode.BAD_CREDENTIALS); } if (!principal.equals(tcreds.principal)) { UsersWithHosts usersWithHosts = impersonation.get(principal); if (usersWithHosts == null) { principalMismatch(principal, tcreds.principal); } if (!usersWithHosts.getUsers().contains(tcreds.principal)) { principalMismatch(principal, tcreds.principal); } String clientAddr = TServerUtils.clientAddress.get(); if (!usersWithHosts.getHosts().contains(clientAddr)) { final String msg = "Principal in credentials object allowed mismatched" + " Kerberos principals, but not on " + clientAddr; log.warn(msg); throw new ThriftSecurityException(msg, SecurityErrorCode.BAD_CREDENTIALS); } } } protected  TCredentialsUpdatingInvocationHandler(final I serverInstance,
      AccumuloConfiguration conf); @Override Object invoke(Object proxy, Method method, Object[] args);  }