-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Feature/Identity] Adds Basic Auth mechanism via Internal IdP (#4798)
[Feature/Identity] Adds Basic Auth mechanism via Internal IdP (#4798) Signed-off-by: Darshit Chanpura <dchanp@amazon.com> Signed-off-by: Darshit Chanpura <35282393+DarshitChanpura@users.noreply.github.com>
- Loading branch information
1 parent
71281f1
commit acb5e4d
Showing
33 changed files
with
660 additions
and
28 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
76 changes: 76 additions & 0 deletions
76
sandbox/libs/authn/src/main/java/org/opensearch/authn/AuthenticationTokenHandler.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| package org.opensearch.authn; | ||
|
|
||
| import org.apache.logging.log4j.LogManager; | ||
| import org.apache.logging.log4j.Logger; | ||
| import org.apache.shiro.authc.AuthenticationToken; | ||
| import org.apache.shiro.authc.UsernamePasswordToken; | ||
| import org.opensearch.authn.tokens.BasicAuthToken; | ||
|
|
||
| import java.nio.charset.StandardCharsets; | ||
| import java.util.Base64; | ||
|
|
||
| /** | ||
| * Extracts Shiro's {@link AuthenticationToken} from different types of auth headers | ||
| * | ||
| * @opensearch.experimental | ||
| */ | ||
| public class AuthenticationTokenHandler { | ||
|
|
||
| private static final Logger logger = LogManager.getLogger(AuthenticationTokenHandler.class); | ||
|
|
||
| /** | ||
| * Extracts shiro auth token from the given header token | ||
| * @param authenticationToken the token from which to extract | ||
| * @return the extracted shiro auth token to be used to perform login | ||
| */ | ||
| public static AuthenticationToken extractShiroAuthToken(org.opensearch.authn.tokens.AuthenticationToken authenticationToken) { | ||
| AuthenticationToken authToken = null; | ||
|
|
||
| if (authenticationToken instanceof BasicAuthToken) { | ||
| authToken = handleBasicAuth((BasicAuthToken) authenticationToken); | ||
| } | ||
| // TODO: check for other type of HeaderTokens | ||
| return authToken; | ||
| } | ||
|
|
||
| /** | ||
| * Returns auth token extracted from basic auth header | ||
| * @param token the basic auth token | ||
| * @return the extracted auth token | ||
| */ | ||
| private static AuthenticationToken handleBasicAuth(final BasicAuthToken token) { | ||
|
|
||
| final byte[] decodedAuthHeader = Base64.getDecoder().decode(token.getHeaderValue().substring("Basic".length()).trim()); | ||
| String decodedHeader = new String(decodedAuthHeader, StandardCharsets.UTF_8); | ||
|
|
||
| final int firstColonIndex = decodedHeader.indexOf(':'); | ||
|
|
||
| String username = null; | ||
| String password = null; | ||
|
|
||
| if (firstColonIndex > 0) { | ||
| username = decodedHeader.substring(0, firstColonIndex); | ||
|
|
||
| if (decodedHeader.length() - 1 != firstColonIndex) { | ||
| password = decodedHeader.substring(firstColonIndex + 1); | ||
| } else { | ||
| // blank password | ||
| password = ""; | ||
| } | ||
| } | ||
|
|
||
| if (username == null || password == null) { | ||
| logger.warn("Invalid 'Authorization' header, send 401 and 'WWW-Authenticate Basic'"); | ||
| return null; | ||
| } | ||
|
|
||
| logger.info("Logging in as: " + username); | ||
|
|
||
| return new UsernamePasswordToken(username, password); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
34 changes: 34 additions & 0 deletions
34
...ox/libs/authn/src/main/java/org/opensearch/authn/internal/InternalAccessTokenManager.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
| package org.opensearch.authn.internal; | ||
|
|
||
| import org.opensearch.authn.AccessTokenManager; | ||
| import org.opensearch.authn.tokens.AccessToken; | ||
|
|
||
| /** | ||
| * Implementation of access token manager that does not enforce authentication | ||
| * | ||
| * This class and related classes in this package will not return nulls or fail permissions checks | ||
| * | ||
| * @opensearch.internal | ||
| */ | ||
| public class InternalAccessTokenManager implements AccessTokenManager { | ||
|
|
||
| @Override | ||
| public void expireAllTokens() { | ||
| // Tokens cannot be expired | ||
| } | ||
|
|
||
| @Override | ||
| public AccessToken generate() { | ||
| return new AccessToken(); | ||
| } | ||
|
|
||
| @Override | ||
| public AccessToken refresh(final AccessToken token) { | ||
| return new AccessToken(); | ||
| } | ||
|
|
||
| } |
56 changes: 56 additions & 0 deletions
56
...libs/authn/src/main/java/org/opensearch/authn/internal/InternalAuthenticationManager.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| package org.opensearch.authn.internal; | ||
|
|
||
| import org.opensearch.authn.AccessTokenManager; | ||
| import org.opensearch.authn.AuthenticationManager; | ||
| import org.opensearch.authn.realm.InternalRealm; | ||
| import org.opensearch.authn.Subject; | ||
| import org.apache.shiro.SecurityUtils; | ||
| import org.apache.shiro.mgt.DefaultSecurityManager; | ||
| import org.apache.shiro.mgt.SecurityManager; | ||
|
|
||
| /** | ||
| * Implementation of authentication manager that enforces authentication against internal idp | ||
| * | ||
| * This class and related classes in this package will not return nulls or fail permissions checks | ||
| * | ||
| * This class manages the subjects loaded via the realm, and provides current subject | ||
| * when authenticating the incoming request | ||
| * Checkout | ||
| * and how the internal Identity system uses auth manager to get current subject to use for authentication | ||
| * | ||
| * @opensearch.internal | ||
| */ | ||
| public class InternalAuthenticationManager implements AuthenticationManager { | ||
|
|
||
| /** | ||
| * Security manager is loaded with default user set, | ||
| * and this instantiation uses the default security manager | ||
| */ | ||
| public InternalAuthenticationManager() { | ||
| final SecurityManager securityManager = new DefaultSecurityManager(InternalRealm.INSTANCE); | ||
| SecurityUtils.setSecurityManager(securityManager); | ||
| } | ||
|
|
||
| /** | ||
| * Instantiates this Auth manager by setting the custom security Manager that is passed as an argument | ||
| * @param securityManager the custom security manager (with realm instantiated in it) | ||
| */ | ||
| public InternalAuthenticationManager(SecurityManager securityManager) { | ||
| SecurityUtils.setSecurityManager(securityManager); | ||
| } | ||
|
|
||
| @Override | ||
| public Subject getSubject() { | ||
| return new InternalSubject(SecurityUtils.getSubject()); | ||
| } | ||
|
|
||
| @Override | ||
| public AccessTokenManager getAccessTokenManager() { | ||
| return null; | ||
| } | ||
| } |
Oops, something went wrong.