This is an automated email from the ASF dual-hosted git repository.
kenhuuu pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/tinkerpop.git
The following commit(s) were added to refs/heads/master by this push:
new 42058b8960 Remove Kerberos/kerby support (#3502)
42058b8960 is described below
commit 42058b8960137d60ebf3113378c56a1b444b81f5
Author: Stephen Mallette <[email protected]>
AuthorDate: Mon Jul 6 21:35:41 2026 +0000
Remove Kerberos/kerby support (#3502)
Kerberos (SASL) authentication is not supported in 4.x. Removes the
Krb5Authenticator, the kerby-based KDC test fixture, related configs,
and the kerby/wildfly-common dependencies. Also drops the now-dead
Kerberos server port (45942) and KDC port (4588) from the GLV docker
test setup, and the libkrb5 build packages.
Assisted-by: Claude Code:claude-opus-4-8
---
NOTICE | 10 -
docker/Dockerfile | 2 +-
docker/gremlin-server.sh | 2 +-
docker/gremlin-server/Dockerfile.template | 2 +-
docker/gremlin-server/docker-entrypoint.sh | 10 -
docker/gremlin-server/gremlin-console-jaas.conf | 24 ---
.../gremlin-server-integration-krb5.yaml | 73 -------
docker/gremlin-server/krb5.conf | 30 ---
docker/gremlin-test-server/Dockerfile | 2 +-
docker/gremlin-test-server/krb5.conf | 32 ---
gremlin-dotnet/docker-compose.yml | 2 -
gremlin-dotnet/test/pom.xml | 4 +-
gremlin-examples/gremlin-python/connections.py | 16 +-
gremlin-go/docker-compose.yml | 2 -
gremlin-go/pom.xml | 4 +-
gremlin-js/gremlin-javascript/docker-compose.yml | 2 -
gremlin-js/gremlin-javascript/pom.xml | 4 +-
gremlin-python/docker-compose.yml | 1 -
gremlin-python/pom.xml | 4 +-
gremlin-python/src/main/python/pyproject.toml | 1 -
.../tinkerpop/gremlin/server/auth/JaasKrbUtil.java | 226 ---------------------
.../gremlin/server/auth/Krb5Authenticator.java | 197 ------------------
.../server/GremlinServerAuditLogIntegrateTest.java | 54 +----
.../tinkerpop/gremlin/server/KdcFixtureTest.java | 43 ----
.../gremlin/server/gremlin-console-jaas.conf | 41 ----
.../gremlin/server/gremlin-server-integration.yaml | 1 -
.../src/test/scripts/test-server-stop.groovy | 8 -
gremlin-test/pom.xml | 16 --
.../tinkerpop/gremlin/server/KdcFixture.java | 217 --------------------
pom.xml | 26 ---
spark-gremlin/pom.xml | 9 -
31 files changed, 22 insertions(+), 1043 deletions(-)
diff --git a/NOTICE b/NOTICE
index bc85e61677..725f7be7f9 100644
--- a/NOTICE
+++ b/NOTICE
@@ -13,13 +13,3 @@ Copyright 2010-2014 Alfresco Software, Ltd.
gremlin-core/src/main/java/org/apache/tinkerpop/gremlin/structure/io/graphml/GraphMLWriterHelper.java
contains DelegatingXMLStreamWriter.java and IndentingXMLStreamWriter.java from
https://github.com/Activiti/Activiti/tree/activiti-5.16/modules/activiti-bpmn-converter/src/main/java/org/activiti/bpmn/converter
-
-------------------------------------------------------------------------
-Apache Kerby
-------------------------------------------------------------------------
-Apache Kerby
-Copyright 2015-2017 The Apache Software Foundation
-
-gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
-from
-https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0/kerby-kerb/kerb-simplekdc/src/main/java/org/apache/kerby/kerberos/kerb/client/JaasKrbUtil.java
diff --git a/docker/Dockerfile b/docker/Dockerfile
index d82f6e5906..66a375384b 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -34,7 +34,7 @@ RUN apt-get install -y --force-yes dotnet-sdk-8.0 mono-devel
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get install -y python3 python3.8 python3-dev python3.8-dev python3-pip
build-essential checkinstall zlib1g-dev libreadline-gplv2-dev \
- libncursesw5-dev libssl-dev libsqlite3-dev tk-dev libgdbm-dev libc6-dev
libbz2-dev libkrb5-dev krb5-user
+ libncursesw5-dev libssl-dev libsqlite3-dev tk-dev libgdbm-dev libc6-dev
libbz2-dev
# make python3 be python 3.8
RUN rm /usr/bin/python3
diff --git a/docker/gremlin-server.sh b/docker/gremlin-server.sh
index f3d8f85a3b..96a2fb7dae 100755
--- a/docker/gremlin-server.sh
+++ b/docker/gremlin-server.sh
@@ -61,7 +61,7 @@ echo "Using Gremlin Server $GREMLIN_SERVER_VERSION"
sed -e "s/GREMLIN_SERVER_VERSION\$/${GREMLIN_SERVER_VERSION}/"
docker/gremlin-server/Dockerfile.template > Dockerfile
docker build -t tinkerpop:${BUILD_TAG} .
-docker run ${TINKERPOP_TEST_DOCKER_OPTS} ${REMOVE_CONTAINER} -p 45940:45940 -p
45941:45941 -p 45942:45942 -p 4588:4588 -h gremlin-server-test -v
"${HOME}"/.groovy:/root/.groovy \
+docker run ${TINKERPOP_TEST_DOCKER_OPTS} ${REMOVE_CONTAINER} -p 45940:45940 -p
45941:45941 -h gremlin-server-test -v "${HOME}"/.groovy:/root/.groovy \
-v "${HOME}"/.m2:/root/.m2 -v
${ABS_PROJECT_HOME}/gremlin-test/target:/opt/gremlin-test -ti
tinkerpop:${BUILD_TAG} ${@}
status=$?
diff --git a/docker/gremlin-server/Dockerfile.template
b/docker/gremlin-server/Dockerfile.template
index cbb0611bdb..b5f77d5f7f 100644
--- a/docker/gremlin-server/Dockerfile.template
+++ b/docker/gremlin-server/Dockerfile.template
@@ -25,7 +25,7 @@ COPY docker/gremlin-server/docker-entrypoint.sh
docker/gremlin-server/*.yaml /op
RUN chmod 755 /opt/docker-entrypoint.sh
ENV GREMLIN_SERVER_VERSION=GREMLIN_SERVER_VERSION
-EXPOSE 45940-45942 4588
+EXPOSE 45940 45941
ENTRYPOINT ["/opt/docker-entrypoint.sh"]
CMD []
diff --git a/docker/gremlin-server/docker-entrypoint.sh
b/docker/gremlin-server/docker-entrypoint.sh
index 4662211776..84d76c6647 100644
--- a/docker/gremlin-server/docker-entrypoint.sh
+++ b/docker/gremlin-server/docker-entrypoint.sh
@@ -45,7 +45,6 @@ echo
echo Available Gremlin Server instances:
echo "http://${IP}:45940/gremlin with anonymous access"
echo "http://${IP}:45941/gremlin with basic authentication (stephen/password)"
-echo "http://${IP}:45942/gremlin with kerberos authentication
(stephen/password)"
echo
echo "See docker/gremlin-server/docker-entrypoints.sh for transcripts per GLV."
echo
"#############################################################################"
@@ -70,21 +69,13 @@ dos2unix /opt/gremlin-server/bin/gremlin-server.conf
# docker/gremlin-server.sh
# cd ${APACHE_TINKERPOP} # second terminal
-# export KRB5_CONFIG=`pwd`/docker/gremlin-server/krb5.conf
-# echo 'password' | kinit stephen
-# klist
# Gremlin-Groovy
# --------------
-# KRB5_OPTION="-Djava.security.krb5.conf=`pwd`/docker/gremlin-server/krb5.conf"
-#
JAAS_OPTION="-Djava.security.auth.login.config=`pwd`/docker/gremlin-server/gremlin-console-jaas.conf"
-# export JAVA_OPTIONS="${KRB5_OPTION} ${JAAS_OPTION}"
# cd
gremlin-console/target/apache-tinkerpop-gremlin-console-3.x.y-SNAPSHOT-standalone
-# If necessary (versions 3.4.2-3.4.6): in bin/gremlin.sh replace JVM_OPTS+=(
"${JAVA_OPTIONS}" ) by JVM_OPTS+=( ${JAVA_OPTIONS} )
# bin/gremlin.sh
# gremlin> cluster = Cluster.build("172.17.0.2").port(45940).create()
# gremlin> cluster =
Cluster.build("172.17.0.2").port(45941).credentials("stephen",
"password").create()
-# gremlin> cluster =
Cluster.build("172.17.0.2").port(45942).addContactPoint("gremlin-server-test").protocol("test-service").jaasEntry("GremlinConsole").create()
# gremlin> g = traversal().withRemote(DriverRemoteConnection.using(cluster,
"gmodern"))
# gremlin> g.V()
@@ -97,5 +88,4 @@ dos2unix /opt/gremlin-server/bin/gremlin-server.conf
# >>> from gremlin_python.driver.driver_remote_connection import
DriverRemoteConnection
# >>> g =
traversal().withRemote(DriverRemoteConnection('ws://172.17.0.2:45940/gremlin','gmodern'))
# >>> g =
traversal().withRemote(DriverRemoteConnection('ws://172.17.0.2:45941/gremlin','gmodern',
username='stephen', password='password'))
-# >>> g =
traversal().withRemote(DriverRemoteConnection('ws://172.17.0.2:45942/gremlin','gmodern',
kerberized_service='test-service@gremlin-server-test'))
# >>> g.V().toList()
diff --git a/docker/gremlin-server/gremlin-console-jaas.conf
b/docker/gremlin-server/gremlin-console-jaas.conf
deleted file mode 100644
index a1170bceaa..0000000000
--- a/docker/gremlin-server/gremlin-console-jaas.conf
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-GremlinConsole {
- com.sun.security.auth.module.Krb5LoginModule required
- doNotPrompt=true
- useTicketCache=true;
-};
diff --git a/docker/gremlin-server/gremlin-server-integration-krb5.yaml
b/docker/gremlin-server/gremlin-server-integration-krb5.yaml
deleted file mode 100644
index 6ba803b59d..0000000000
--- a/docker/gremlin-server/gremlin-server-integration-krb5.yaml
+++ /dev/null
@@ -1,73 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-host: 0.0.0.0
-port: 45942
-evaluationTimeout: 30000
-graphs: {
- graph: {
- configuration: conf/tinkergraph-empty.properties,
- traversalSources: [{name: g}, {name: ggraph}]},
- classic: {
- configuration: conf/tinkergraph-empty.properties,
- traversalSources: [{name: gclassic}]},
- modern: {
- configuration: conf/tinkergraph-empty.properties,
- traversalSources: [{name: gmodern}]},
- crew: {
- configuration: conf/tinkergraph-empty.properties,
- traversalSources: [{name: gcrew}]},
- grateful: {
- configuration: conf/tinkergraph-empty.properties,
- traversalSources: [{name: ggrateful}]},
- sink: {
- configuration: conf/tinkergraph-empty.properties,
- traversalSources: [{name: gsink}]},
- tx: {
- configuration: conf/tinkertransactiongraph-empty.properties,
- traversalSources: [{name: gtx}]}}
-lifecycleHooks:
- - { className:
org.apache.tinkerpop.gremlin.server.util.TinkerFactoryDataLoader, config:
{graph: classic, dataset: classic}}
- - { className:
org.apache.tinkerpop.gremlin.server.util.TinkerFactoryDataLoader, config:
{graph: modern, dataset: modern}}
- - { className:
org.apache.tinkerpop.gremlin.server.util.TinkerFactoryDataLoader, config:
{graph: crew, dataset: crew}}
- - { className:
org.apache.tinkerpop.gremlin.server.util.TinkerFactoryDataLoader, config:
{graph: grateful, dataset: grateful}}
- - { className:
org.apache.tinkerpop.gremlin.server.util.TinkerFactoryDataLoader, config:
{graph: sink, dataset: sink}}
-serializers:
- - { className:
org.apache.tinkerpop.gremlin.util.ser.GraphSONMessageSerializerV3, config: {
ioRegistries:
[org.apache.tinkerpop.gremlin.tinkergraph.structure.TinkerIoRegistryV3] }}
- - { className:
org.apache.tinkerpop.gremlin.util.ser.GraphSONMessageSerializerV2, config: {
ioRegistries:
[org.apache.tinkerpop.gremlin.tinkergraph.structure.TinkerIoRegistryV2] }}
- - { className:
org.apache.tinkerpop.gremlin.util.ser.GraphSONMessageSerializerV1, config: {
ioRegistries:
[org.apache.tinkerpop.gremlin.tinkergraph.structure.TinkerIoRegistryV1] }}
- - { className:
org.apache.tinkerpop.gremlin.util.ser.GraphBinaryMessageSerializerV1 }
- - { className:
org.apache.tinkerpop.gremlin.util.ser.GraphBinaryMessageSerializerV1, config: {
serializeResultToString: true }}
-metrics: {
- slf4jReporter: {enabled: true, interval: 180000}}
-gremlinPool: 8
-strictTransactionManagement: false
-idleConnectionTimeout: 0
-keepAliveInterval: 0
-maxInitialLineLength: 4096
-maxHeaderSize: 8192
-maxChunkSize: 8192
-maxRequestContentLength: 10485760
-maxAccumulationBufferComponents: 1024
-resultIterationBatchSize: 64
-writeBufferLowWaterMark: 32768
-writeBufferHighWaterMark: 65536
-authentication: {
- authenticator: org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator,
- config: {
- principal: test-service/[email protected],
- keytab: /opt/gremlin-server/target/kdc/test-service.keytab}}
diff --git a/docker/gremlin-server/krb5.conf b/docker/gremlin-server/krb5.conf
deleted file mode 100644
index 3ee9e3d482..0000000000
--- a/docker/gremlin-server/krb5.conf
+++ /dev/null
@@ -1,30 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-[libdefaults]
- kdc_realm = TEST.COM
- default_realm = TEST.COM
- udp_preference_limit = 4096
- kdc_tcp_port = 4588
- kdc_udp_port = 4588
-
-[realms]
- TEST.COM = {
- kdc = 172.17.0.2:4588
- }
diff --git a/docker/gremlin-test-server/Dockerfile
b/docker/gremlin-test-server/Dockerfile
index 3740499dcc..c7c8a767b2 100644
--- a/docker/gremlin-test-server/Dockerfile
+++ b/docker/gremlin-test-server/Dockerfile
@@ -36,7 +36,7 @@ RUN dos2unix /opt/docker-entrypoint.sh
/opt/gremlin-server/bin/gremlin-server.sh
ARG GREMLIN_SERVER
ENV GREMLIN_SERVER_VERSION=$GREMLIN_SERVER
-EXPOSE 45940-45942 4588
+EXPOSE 45940 45941
ENTRYPOINT ["/opt/docker-entrypoint.sh"]
CMD []
diff --git a/docker/gremlin-test-server/krb5.conf
b/docker/gremlin-test-server/krb5.conf
deleted file mode 100644
index 1c870522e7..0000000000
--- a/docker/gremlin-test-server/krb5.conf
+++ /dev/null
@@ -1,32 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-[libdefaults]
- kdc_realm = TEST.COM
- default_realm = TEST.COM
- udp_preference_limit = 4096
- kdc_tcp_port = 4588
- kdc_udp_port = 4588
- dns_canonicalize_hostname = false
- qualify_shortname = ""
-
-[realms]
- TEST.COM = {
- kdc = gremlin-server-test:4588
- }
diff --git a/gremlin-dotnet/docker-compose.yml
b/gremlin-dotnet/docker-compose.yml
index ccfe760f6c..244bd3f289 100644
--- a/gremlin-dotnet/docker-compose.yml
+++ b/gremlin-dotnet/docker-compose.yml
@@ -28,8 +28,6 @@ services:
ports:
- "45940:45940"
- "45941:45941"
- - "45942:45942"
- - "4588:4588"
volumes:
- ${HOME}/.groovy:/root/.groovy
- ${HOME}/.m2:/root/.m2
diff --git a/gremlin-dotnet/test/pom.xml b/gremlin-dotnet/test/pom.xml
index d7d9f8842a..82b1037f32 100644
--- a/gremlin-dotnet/test/pom.xml
+++ b/gremlin-dotnet/test/pom.xml
@@ -109,7 +109,7 @@ limitations under the License.
compose up - build images,
start the server and test containers,
and wait for
the test container to finish
compose down (second) - tear down this
run's containers and network
- port-wait loop - wait up to 30 s
for ports 45940-45942 and 4588 to be released by
+ port-wait loop - wait up to 30 s
for ports 45940 and 45941 to be released by
the Docker
daemon before returning to Maven; all GLV modules share
these host
ports and run sequentially, so the next module would
fail to bind
them if docker-proxy has not fully exited yet
@@ -117,7 +117,7 @@ limitations under the License.
-->
<arguments>
<argument>-c</argument>
- <argument>docker compose down; docker
compose up --build --exit-code-from gremlin-dotnet-integration-tests; EXIT=$?;
docker compose down; for i in $(seq 1 30); do ss -tlnp | grep -qE
':(45940|45941|45942|4588) ' || break; sleep 1; done; docker image prune
--filter [email protected] -f; exit $EXIT</argument>
+ <argument>docker compose down; docker
compose up --build --exit-code-from gremlin-dotnet-integration-tests; EXIT=$?;
docker compose down; for i in $(seq 1 30); do ss -tlnp | grep -qE
':(45940|45941) ' || break; sleep 1; done; docker image prune --filter
[email protected] -f; exit $EXIT</argument>
</arguments>
</configuration>
</execution>
diff --git a/gremlin-examples/gremlin-python/connections.py
b/gremlin-examples/gremlin-python/connections.py
index 7008ddac72..8f06fe27a3 100644
--- a/gremlin-examples/gremlin-python/connections.py
+++ b/gremlin-examples/gremlin-python/connections.py
@@ -29,7 +29,6 @@ VERTEX_LABEL = 'connection'
def main():
with_remote()
with_auth()
- with_kerberos()
with_configs()
@@ -67,25 +66,12 @@ def with_auth():
rc.close()
-# connecting with Kerberos SASL authentication
-def with_kerberos():
- server_url = 'ws://localhost:8182/gremlin'
- rc = DriverRemoteConnection(server_url, 'g',
kerberized_service='[email protected]')
- g = traversal().with_remote(rc)
-
- v = g.add_v(VERTEX_LABEL).iterate()
- count = g.V().has_label(VERTEX_LABEL).count().next()
- print("Vertex count: " + str(count))
-
- rc.close()
-
-
# connecting with customized configurations
def with_configs():
server_url = 'ws://localhost:8182/gremlin'
rc = DriverRemoteConnection(
server_url, 'g',
- username="", password="", kerberized_service='',
+ username="", password="",
message_serializer=GraphBinarySerializersV1(), graphson_reader=None,
graphson_writer=None, headers=None, session=None,
enable_user_agent_on_connect=True
diff --git a/gremlin-go/docker-compose.yml b/gremlin-go/docker-compose.yml
index 1f32498cb6..8966ed0bff 100644
--- a/gremlin-go/docker-compose.yml
+++ b/gremlin-go/docker-compose.yml
@@ -28,8 +28,6 @@ services:
ports:
- "45940:45940"
- "45941:45941"
- - "45942:45942"
- - "4588:4588"
volumes:
- ${HOME}/.groovy:/root/.groovy
- ${HOME}/.m2:/root/.m2
diff --git a/gremlin-go/pom.xml b/gremlin-go/pom.xml
index 5d5019a476..355687582d 100644
--- a/gremlin-go/pom.xml
+++ b/gremlin-go/pom.xml
@@ -120,7 +120,7 @@ limitations under the License.
compose up - build images,
start the server and test containers,
and wait for
the test container to finish
compose down (second) - tear down this
run's containers and network
- port-wait loop - wait up to 30 s
for ports 45940-45942 and 4588 to be released by
+ port-wait loop - wait up to 30 s
for ports 45940 and 45941 to be released by
the Docker
daemon before returning to Maven; all GLV modules share
these host
ports and run sequentially, so the next module would
fail to bind
them if docker-proxy has not fully exited yet
@@ -128,7 +128,7 @@ limitations under the License.
-->
<arguments>
<argument>-c</argument>
- <argument>docker compose down; docker
compose up --build --exit-code-from gremlin-go-integration-tests; EXIT=$?;
docker compose down; for i in $(seq 1 30); do ss -tlnp | grep -qE
':(45940|45941|45942|4588) ' || break; sleep 1; done; docker image prune
--filter [email protected] -f; exit $EXIT</argument>
+ <argument>docker compose down; docker
compose up --build --exit-code-from gremlin-go-integration-tests; EXIT=$?;
docker compose down; for i in $(seq 1 30); do ss -tlnp | grep -qE
':(45940|45941) ' || break; sleep 1; done; docker image prune --filter
[email protected] -f; exit $EXIT</argument>
</arguments>
</configuration>
</execution>
diff --git a/gremlin-js/gremlin-javascript/docker-compose.yml
b/gremlin-js/gremlin-javascript/docker-compose.yml
index 6b90238a30..1c00082634 100644
--- a/gremlin-js/gremlin-javascript/docker-compose.yml
+++ b/gremlin-js/gremlin-javascript/docker-compose.yml
@@ -28,8 +28,6 @@ services:
ports:
- "45940:45940"
- "45941:45941"
- - "45942:45942"
- - "4588:4588"
volumes:
- ${HOME}/.groovy:/root/.groovy
- ${HOME}/.m2:/root/.m2
diff --git a/gremlin-js/gremlin-javascript/pom.xml
b/gremlin-js/gremlin-javascript/pom.xml
index a9adfe4d40..0957b4ec32 100644
--- a/gremlin-js/gremlin-javascript/pom.xml
+++ b/gremlin-js/gremlin-javascript/pom.xml
@@ -281,7 +281,7 @@ limitations under the License.
compose up - build images,
start the server and test containers,
and wait for
the test container to finish
compose down (second) - tear down this
run's containers and network
- port-wait loop - wait up to 30 s
for ports 45940-45942 and 4588 to be released by
+ port-wait loop - wait up to 30 s
for ports 45940 and 45941 to be released by
the Docker
daemon before returning to Maven; all GLV modules share
these host
ports and run sequentially, so the next module would
fail to bind
them if docker-proxy has not fully exited yet
@@ -289,7 +289,7 @@ limitations under the License.
-->
<arguments>
<argument>-c</argument>
- <argument>export HOST_UID=$(id -u)
HOST_GID=$(id -g); docker compose down; docker compose up --build
--exit-code-from gremlin-js-integration-tests; EXIT=$?; docker compose down;
for i in $(seq 1 30); do ss -tlnp | grep -qE ':(45940|45941|45942|4588) ' ||
break; sleep 1; done; docker image prune --filter
[email protected] -f; exit $EXIT</argument>
+ <argument>export HOST_UID=$(id -u)
HOST_GID=$(id -g); docker compose down; docker compose up --build
--exit-code-from gremlin-js-integration-tests; EXIT=$?; docker compose down;
for i in $(seq 1 30); do ss -tlnp | grep -qE ':(45940|45941) ' || break; sleep
1; done; docker image prune --filter [email protected]
-f; exit $EXIT</argument>
</arguments>
<workingDirectory>.</workingDirectory>
</configuration>
diff --git a/gremlin-python/docker-compose.yml
b/gremlin-python/docker-compose.yml
index 2876bbf048..cdb4cbfdcc 100644
--- a/gremlin-python/docker-compose.yml
+++ b/gremlin-python/docker-compose.yml
@@ -29,7 +29,6 @@ services:
ports:
- "45940:45940"
- "45941:45941"
- - "4588:4588"
volumes:
- ${HOME}/.groovy:/root/.groovy
- ${HOME}/.m2:/root/.m2
diff --git a/gremlin-python/pom.xml b/gremlin-python/pom.xml
index 9ef88c19df..63680b3dd4 100644
--- a/gremlin-python/pom.xml
+++ b/gremlin-python/pom.xml
@@ -161,7 +161,7 @@ limitations under the License.
compose up - build images, start the
server and test containers,
and stop everything
when either container exits
compose down (second) - tear down this run's
containers and network
- port-wait loop - wait up to 30 s for
ports 45940-45942 and 4588 to be released by
+ port-wait loop - wait up to 30 s for
ports 45940 and 45941 to be released by
the Docker daemon
before returning to Maven; all GLV modules share
these host ports and
run sequentially, so the next module would
fail to bind them if
docker-proxy has not fully exited yet
@@ -184,7 +184,7 @@ limitations under the License.
<env key="PYTEST_ARGS"
value="${pytestArgs}"/>
<env key="RADISH_ARGS"
value="${radishArgs}"/>
<arg value="-c"/>
- <arg value="docker compose down;
docker compose up --build --abort-on-container-exit gremlin-server-test-python
gremlin-python-integration-tests; EXIT=$?; docker compose down; for i in $(seq
1 30); do ss -tlnp | grep -qE ':(45940|45941|45942|4588) ' || break; sleep 1;
done; docker image prune --filter [email protected]
-f; exit $EXIT"/>
+ <arg value="docker compose down;
docker compose up --build --abort-on-container-exit gremlin-server-test-python
gremlin-python-integration-tests; EXIT=$?; docker compose down; for i in $(seq
1 30); do ss -tlnp | grep -qE ':(45940|45941) ' || break; sleep 1; done; docker
image prune --filter [email protected] -f; exit
$EXIT"/>
</exec>
</target>
</configuration>
diff --git a/gremlin-python/src/main/python/pyproject.toml
b/gremlin-python/src/main/python/pyproject.toml
index 8510bc701b..bccddf4cd6 100644
--- a/gremlin-python/src/main/python/pyproject.toml
+++ b/gremlin-python/src/main/python/pyproject.toml
@@ -51,7 +51,6 @@ classifiers = [
Homepage = "https://tinkerpop.apache.org";
[project.optional-dependencies]
-kerberos = ["kerberos>=1.3.0,<2.0.0; sys_platform != \"win32\""]
ujson = ["ujson>=2.0.0"]
test = [
"pytest>=6.2.5,<8.0.0",
diff --git
a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
deleted file mode 100644
index 48c4546151..0000000000
---
a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/JaasKrbUtil.java
+++ /dev/null
@@ -1,226 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.tinkerpop.gremlin.server.auth;
-
-import javax.security.auth.Subject;
-import javax.security.auth.callback.Callback;
-import javax.security.auth.callback.CallbackHandler;
-import javax.security.auth.callback.PasswordCallback;
-import javax.security.auth.callback.UnsupportedCallbackException;
-import javax.security.auth.kerberos.KerberosPrincipal;
-import javax.security.auth.login.AppConfigurationEntry;
-import javax.security.auth.login.Configuration;
-import javax.security.auth.login.LoginContext;
-import javax.security.auth.login.LoginException;
-import java.io.File;
-import java.io.IOException;
-import java.security.Principal;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.Map;
-import java.util.Set;
-
-/**
- * JAAS utilities for Kerberos login.
- *
- * Except for the package name and this comment, this file is a literal copy
from
- * package org.apache.kerby.kerberos.kerb.client, see:
- *
https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/kerby-kerb/kerb-simplekdc/
- * src/main/java/org/apache/kerby/kerberos/kerb/client/JaasKrbUtil.java
- */
-public final class JaasKrbUtil {
-
- public static final boolean ENABLE_DEBUG = false;
-
- private JaasKrbUtil() { }
-
- public static Subject loginUsingPassword(
- String principal, String password) throws LoginException {
- Set<Principal> principals = new HashSet<Principal>();
- principals.add(new KerberosPrincipal(principal));
-
- Subject subject = new Subject(false, principals,
- new HashSet<Object>(), new HashSet<Object>());
-
- Configuration conf = usePassword(principal);
- String confName = "PasswordConf";
- CallbackHandler callback = new KrbCallbackHandler(principal, password);
- LoginContext loginContext = new LoginContext(confName, subject,
callback, conf);
- loginContext.login();
- return loginContext.getSubject();
- }
-
- public static Subject loginUsingTicketCache(
- String principal, File cacheFile) throws LoginException {
- Set<Principal> principals = new HashSet<Principal>();
- principals.add(new KerberosPrincipal(principal));
-
- Subject subject = new Subject(false, principals,
- new HashSet<Object>(), new HashSet<Object>());
-
- Configuration conf = useTicketCache(principal, cacheFile);
- String confName = "TicketCacheConf";
- LoginContext loginContext = new LoginContext(confName, subject, null,
conf);
- loginContext.login();
- return loginContext.getSubject();
- }
-
- public static Subject loginUsingKeytab(
- String principal, File keytabFile) throws LoginException {
- Set<Principal> principals = new HashSet<Principal>();
- principals.add(new KerberosPrincipal(principal));
-
- Subject subject = new Subject(false, principals,
- new HashSet<Object>(), new HashSet<Object>());
-
- Configuration conf = useKeytab(principal, keytabFile);
- String confName = "KeytabConf";
- LoginContext loginContext = new LoginContext(confName, subject, null,
conf);
- loginContext.login();
- return loginContext.getSubject();
- }
-
- public static Configuration usePassword(String principal) {
- return new PasswordJaasConf(principal);
- }
-
- public static Configuration useTicketCache(String principal,
- File credentialFile) {
- return new TicketCacheJaasConf(principal, credentialFile);
- }
-
- public static Configuration useKeytab(String principal, File keytabFile) {
- return new KeytabJaasConf(principal, keytabFile);
- }
-
- private static String getKrb5LoginModuleName() {
- return System.getProperty("java.vendor").contains("IBM")
- ? "com.ibm.security.auth.module.Krb5LoginModule"
- : "com.sun.security.auth.module.Krb5LoginModule";
- }
-
- static class KeytabJaasConf extends Configuration {
- private String principal;
- private File keytabFile;
-
- KeytabJaasConf(String principal, File keytab) {
- this.principal = principal;
- this.keytabFile = keytab;
- }
-
- @Override
- public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
- Map<String, String> options = new HashMap<String, String>();
- options.put("keyTab", keytabFile.getAbsolutePath());
- options.put("principal", principal);
- options.put("useKeyTab", "true");
- options.put("storeKey", "true");
- options.put("doNotPrompt", "true");
- options.put("renewTGT", "false");
- options.put("refreshKrb5Config", "true");
- options.put("isInitiator", "true");
- options.put("debug", String.valueOf(ENABLE_DEBUG));
-
- return new AppConfigurationEntry[]{
- new AppConfigurationEntry(getKrb5LoginModuleName(),
-
AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
- options)};
- }
- }
-
- static class TicketCacheJaasConf extends Configuration {
- private String principal;
- private File clientCredentialFile;
-
- TicketCacheJaasConf(String principal, File clientCredentialFile) {
- this.principal = principal;
- this.clientCredentialFile = clientCredentialFile;
- }
-
- @Override
- public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
- Map<String, String> options = new HashMap<String, String>();
- options.put("principal", principal);
- options.put("storeKey", "false");
- options.put("doNotPrompt", "false");
- options.put("useTicketCache", "true");
- options.put("renewTGT", "true");
- options.put("refreshKrb5Config", "true");
- options.put("isInitiator", "true");
- options.put("ticketCache", clientCredentialFile.getAbsolutePath());
- options.put("debug", String.valueOf(ENABLE_DEBUG));
-
- return new AppConfigurationEntry[]{
- new AppConfigurationEntry(getKrb5LoginModuleName(),
-
AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
- options)};
- }
- }
-
- static class PasswordJaasConf extends Configuration {
- private String principal;
-
- PasswordJaasConf(String principal) {
- this.principal = principal;
- }
-
- @Override
- public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
- Map<String, String> options = new HashMap<>();
- options.put("principal", principal);
- options.put("storeKey", "true");
- options.put("useTicketCache", "true");
- options.put("useKeyTab", "false");
- options.put("renewTGT", "true");
- options.put("refreshKrb5Config", "true");
- options.put("isInitiator", "true");
- options.put("debug", String.valueOf(ENABLE_DEBUG));
-
- return new AppConfigurationEntry[]{
- new AppConfigurationEntry(getKrb5LoginModuleName(),
-
AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
- options)};
- }
- }
-
- public static class KrbCallbackHandler implements CallbackHandler {
- private String principal;
- private String password;
-
- public KrbCallbackHandler(String principal, String password) {
- this.principal = principal;
- this.password = password;
- }
-
- public void handle(Callback[] callbacks)
- throws IOException, UnsupportedCallbackException {
- for (int i = 0; i < callbacks.length; i++) {
- if (callbacks[i] instanceof PasswordCallback) {
- PasswordCallback pc = (PasswordCallback) callbacks[i];
- if (pc.getPrompt().contains(principal)) {
- pc.setPassword(password.toCharArray());
- break;
- }
- }
- }
- }
- }
-
-}
diff --git
a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
deleted file mode 100644
index ed7640eb05..0000000000
---
a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/auth/Krb5Authenticator.java
+++ /dev/null
@@ -1,197 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.tinkerpop.gremlin.server.auth;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import javax.security.auth.Subject;
-import javax.security.auth.callback.Callback;
-import javax.security.auth.callback.CallbackHandler;
-import javax.security.auth.callback.UnsupportedCallbackException;
-import javax.security.sasl.AuthorizeCallback;
-import javax.security.sasl.Sasl;
-import javax.security.sasl.SaslException;
-import javax.security.sasl.SaslServer;
-import java.io.File;
-import java.net.InetAddress;
-import java.security.PrivilegedAction;
-import java.util.HashMap;
-import java.util.Map;
-
-
-/**
- * A Kerberos (GSSAPI) implementation of an {@link Authenticator}
- * This authenticator authenticates and autorizes all clients with a valid
service ticket.
- *
- * @author Marc de Lignie
- */
-public class Krb5Authenticator implements Authenticator {
- private static final Logger logger =
LoggerFactory.getLogger(Krb5Authenticator.class);
- private Subject subject;
- private String principalName;
-
- @Override
- public boolean requireAuthentication() {
- return true;
- }
-
- /**
- * Called once on server startup with the authentication.config from the
*.yaml file
- */
- @Override
- public void setup(final Map<String, Object> config) {
- final String KEYTAB_KEY = "keytab";
- final String PRINCIPAL_KEY = "principal";
-
- logger.info("Config: {}", config);
-
- if (null == config || !config.containsKey(KEYTAB_KEY) ||
!config.containsKey(PRINCIPAL_KEY)) {
- throw new IllegalArgumentException(String.format(
- "Could not configure a %s - provide a 'config' in the
'authentication' settings",
- Krb5Authenticator.class.getName()));
- }
-
- try {
- final File keytabFile = new File((String) config.get(KEYTAB_KEY));
- principalName = (String) config.get(PRINCIPAL_KEY);
- subject = JaasKrbUtil.loginUsingKeytab(principalName, keytabFile);
- } catch (Exception e) {
- logger.warn("Failed to login to kdc:" + e.getMessage());
- }
-
- logger.debug("Done logging in to kdc");
- }
-
- @Override
- public SaslNegotiator newSaslNegotiator(final InetAddress remoteAddress) {
- logger.debug("newSaslNegotiator() called");
- return Subject.doAs(subject, (PrivilegedAction<SaslNegotiator>)
Krb5SaslAuthenticator::new);
- }
-
- public AuthenticatedUser authenticate(final Map<String, String>
credentials) throws AuthenticationException {
- logger.error("Authenticate() should not be called. Use
getAuthenticatedUser() when isComplete() is true.");
- return null;
- }
-
- /*
- * Krb5SaslAuthenticator is invoked by:
- * org.apache.tinkerpop.gremlin.server.handler.SaslAuthenticationHandler
- * Negotiates with evaluateChallenge() of the generic sasl handler in
gremlin console:
- * org.apache.tinkerpop.gremlin.driver.Handler.java
- * See also:
- *
https://docs.oracle.com/javase/8/docs/technotes/guides/security/sasl/sasl-refguide.html
- *
https://docs.oracle.com/javase/8/docs/api/org/ietf/jgss/GSSContext.html
- * Kerberos authentication/authorization message flow:
- * http://www.roguelynn.com/words/explain-like-im-5-kerberos/
- */
- private class Krb5SaslAuthenticator implements
Authenticator.SaslNegotiator, CallbackHandler {
- private final String mechanism = "GSSAPI";
- private SaslServer saslServer;
-
- Krb5SaslAuthenticator() {
- try {
- // For sasl properties regarding GSSAPI, see:
- //
https://docs.oracle.com/javase/8/docs/technotes/guides/security/sasl/sasl-refguide.html#SERVER
- // Rely on GSSAPI defaults for Sasl.MAX_BUFFER and Sasl.QOP.
Note, however, that gremlin-driver has
- // Sasl.SERVER_AUTH fixed to true (mutual authentication) and
one can configure SSL for enhanced confidentiality,
- // Sasl policy properties for negotiating the authentication
mechanism are not relevant here, because
- // GSSAPI is the only available mechanism for this
authenticator
- final Map<String, Object> props = new HashMap<>();
- if (principalName == null) {
- throw new IllegalArgumentException("Principal name cannot
be empty. Use principal name of format 'service/fqdn@kdcrealm'");
- }
- final String[] principalParts = principalName.split("/|@");
- if (principalParts.length < 3) throw new
IllegalArgumentException("Use principal name of format
'service/fqdn@kdcrealm'");
- saslServer = Sasl.createSaslServer(mechanism,
principalParts[0], principalParts[1], props, Krb5SaslAuthenticator.this);
-
- } catch(SaslException e) {
- logger.error("Creating sasl server failed: ", e);
- throw new IllegalStateException(e);
- }
-
- // createSaslServer() can return null
- if (null == saslServer) {
- logger.error("Could not a find a SaslServerFactory for
mechanism of {}", mechanism);
- throw new IllegalStateException("Creating sasl server failed");
- }
-
- logger.debug("SaslServer created with: {}",
saslServer.getMechanismName());
- }
-
- /*
- * This method is based on the handle() method from:
- *
https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2/kerby-kerb/integration-test/src/main/java/org/apache/kerby/kerberos/kerb/integration/test/sasl/SaslAppServer.java
- *
- * This provides the simplest form of authorization, where each client
that provides a valid service ticket,
- * is authorized. More elaborate authorization schemes would
interrogate a policy server like Apache Ranger
- * or ACL's of a storage backend.
- */
- @Override
- public void handle(final Callback[] callbacks) throws
UnsupportedCallbackException {
- logger.debug("Krb5 AuthorizeCallback number: " + callbacks.length);
- AuthorizeCallback ac = null;
- for (Callback callback : callbacks) {
- if (callback instanceof AuthorizeCallback) {
- ac = (AuthorizeCallback) callback;
- } else {
- throw new UnsupportedCallbackException(callback,
"Unrecognized SASL GSSAPI Callback");
- }
- }
- if (ac != null) {
- final String authid = ac.getAuthenticationID();
- final String authzid = ac.getAuthorizationID();
- if (authid.equals(authzid)) { // Check whether the service
ticket belongs to the authenticated user
- ac.setAuthorized(true);
- } else {
- ac.setAuthorized(false);
- }
- if (ac.isAuthorized()) { // Get user name from his
principal name
- final String[] authidParts = authid.split("@");
- ac.setAuthorizedID(authidParts[0]);
- }
- }
- }
-
- @Override
- public byte[] evaluateResponse(final byte[] clientResponse) throws
AuthenticationException {
- logger.debug("evaluateResponse() length: " +
clientResponse.length);
- byte[] response;
- try {
- response = saslServer.evaluateResponse(clientResponse);
- } catch (Exception e) {
- logger.warn("Sasl krb5 evaluateResponse failed: " + e);
- throw new AuthenticationException(e);
- }
- return response;
- }
-
- @Override
- public boolean isComplete() {
- return saslServer.isComplete();
- }
-
- @Override
- public AuthenticatedUser getAuthenticatedUser() throws
AuthenticationException {
- logger.debug("getAuthenticatedUser called: " +
saslServer.getAuthorizationID());
- return new AuthenticatedUser(saslServer.getAuthorizationID());
- }
-
- }
-}
\ No newline at end of file
diff --git
a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
index 0c8e065563..d17ef1ac50 100644
---
a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
+++
b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/GremlinServerAuditLogIntegrateTest.java
@@ -33,7 +33,6 @@ import
org.apache.tinkerpop.gremlin.process.traversal.AnonymousTraversalSource;
import
org.apache.tinkerpop.gremlin.process.traversal.dsl.graph.GraphTraversalSource;
import org.apache.tinkerpop.gremlin.server.auth.AllowAllAuthenticator;
import org.apache.tinkerpop.gremlin.server.auth.AuthenticatedUser;
-import org.apache.tinkerpop.gremlin.server.auth.Krb5Authenticator;
import org.apache.tinkerpop.gremlin.server.auth.SimpleAuthenticator;
import org.apache.tinkerpop.gremlin.server.channel.HttpChannelizer;
import
org.apache.tinkerpop.gremlin.server.handler.HttpBasicAuthenticationHandler;
@@ -45,7 +44,6 @@ import org.junit.AfterClass;
import org.junit.Before;
import org.junit.BeforeClass;
import org.junit.Test;
-import org.slf4j.LoggerFactory;
import java.util.Base64;
import java.util.HashMap;
@@ -59,12 +57,11 @@ import static org.junit.Assert.assertTrue;
/**
* Test audit logs. Like other descendants of
AbstractGremlinServerIntegrationTest this test suite assumes that
- * tests are run sequentially and thus the server and kdcServer variables can
be reused.
+ * tests are run sequentially and thus the server variable can be reused.
*
* @author Marc de Lignie
*/
public class GremlinServerAuditLogIntegrateTest extends
AbstractGremlinServerIntegrationTest {
- private static final org.slf4j.Logger logger =
LoggerFactory.getLogger(GremlinServerAuditLogIntegrateTest.class);
private static LogCaptor logCaptor;
@@ -75,8 +72,6 @@ public class GremlinServerAuditLogIntegrateTest extends
AbstractGremlinServerInt
private static final boolean AUDIT_LOG_DISABLED = false;
private static final String TESTCONSOLE2 = "GremlinConsole2";
- private KdcFixture kdcServer;
-
@BeforeClass
public static void setupLogCaptor() {
logCaptor = LogCaptor.forName(AUDIT_LOGGER_NAME);
@@ -92,66 +87,35 @@ public class GremlinServerAuditLogIntegrateTest extends
AbstractGremlinServerInt
logCaptor.clearLogs();
}
- @Override
- public void setUp() throws Exception {
- try {
- final String moduleBaseDir = System.getProperty("basedir", ".");
- final String authConfigName = moduleBaseDir +
"/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf";
- System.setProperty("java.security.auth.login.config",
authConfigName);
- kdcServer = new KdcFixture(moduleBaseDir);
- kdcServer.setUp();
- } catch(Exception ex) {
- logger.warn(String.format("Could not start Kerberos Server for
%s", name.getMethodName()), ex);
- }
- super.setUp();
- }
-
- @Override
- public void tearDown() throws Exception {
- kdcServer.close();
- System.clearProperty("java.security.auth.login.config");
- super.tearDown();
- }
-
/**
* Configure specific Gremlin Server settings for specific tests.
*/
@Override
public Settings overrideSettings(final Settings settings) {
- settings.host = kdcServer.gremlinHostname;
+ settings.host = "localhost";
final Settings.SslSettings sslConfig = new Settings.SslSettings();
sslConfig.enabled = false;
settings.ssl = sslConfig;
final Settings.AuthenticationSettings authSettings = new
Settings.AuthenticationSettings();
settings.authentication = authSettings;
settings.enableAuditLog = AUDIT_LOG_ENABLED;
- authSettings.authenticator = Krb5Authenticator.class.getName();
+ authSettings.authenticator = SimpleAuthenticator.class.getName();
final Map<String,Object> authConfig = new HashMap<>();
authSettings.config = authConfig;
+ authConfig.put(SimpleAuthenticator.CONFIG_CREDENTIALS_DB,
"conf/tinkergraph-credentials.properties");
final String nameOfTest = name.getMethodName();
switch (nameOfTest) {
case "shouldAuditLogWithAllowAllAuthenticator":
authSettings.authenticator =
AllowAllAuthenticator.class.getName();
- break;
- case "shouldAuditLogWithTraversalOp":
- case "shouldAuditLogWithSimpleAuthenticator":
- authSettings.authenticator =
SimpleAuthenticator.class.getName();
- authConfig.put(SimpleAuthenticator.CONFIG_CREDENTIALS_DB,
"conf/tinkergraph-credentials.properties");
+ authConfig.remove(SimpleAuthenticator.CONFIG_CREDENTIALS_DB);
break;
case "shouldNotAuditLogWhenDisabled":
settings.enableAuditLog = AUDIT_LOG_DISABLED;
- case "shouldAuditLogWithKrb5Authenticator":
- case "shouldAuditLogTwoClientsWithKrb5Authenticator":
- authConfig.put("keytab",
kdcServer.serviceKeytabFile.getAbsolutePath());
- authConfig.put("principal", kdcServer.serverPrincipal);
break;
case "shouldAuditLogWithHttpTransport":
- settings.host = "localhost";
settings.channelizer = HttpChannelizer.class.getName();
- authSettings.authenticator =
SimpleAuthenticator.class.getName();
authSettings.authenticationHandler =
HttpBasicAuthenticationHandler.class.getName();
- authConfig.put(SimpleAuthenticator.CONFIG_CREDENTIALS_DB,
"conf/tinkergraph-credentials.properties");
break;
}
return settings;
@@ -160,7 +124,7 @@ public class GremlinServerAuditLogIntegrateTest extends
AbstractGremlinServerInt
@Test
public void shouldAuditLogWithAllowAllAuthenticator() throws Exception {
- final Cluster cluster =
TestClientFactory.build(kdcServer.gremlinHostname).create();
+ final Cluster cluster = TestClientFactory.build().create();
final Client client = cluster.connect();
try {
@@ -190,7 +154,7 @@ public class GremlinServerAuditLogIntegrateTest extends
AbstractGremlinServerInt
final String username = "stephen";
final String password = "password";
- final Cluster cluster =
TestClientFactory.build(kdcServer.gremlinHostname).auth(basic(username,
password)).create();
+ final Cluster cluster = TestClientFactory.build().auth(basic(username,
password)).create();
final Client client = cluster.connect();
try {
@@ -222,7 +186,7 @@ public class GremlinServerAuditLogIntegrateTest extends
AbstractGremlinServerInt
final String username = "stephen";
final String password = "password";
- final Cluster cluster =
TestClientFactory.build(kdcServer.gremlinHostname).auth(basic(username,
password)).create();
+ final Cluster cluster = TestClientFactory.build().auth(basic(username,
password)).create();
final Client client = cluster.connect();
try {
assertEquals(2,
client.submit("g.inject(2)").all().get().get(0).getInt());
@@ -278,7 +242,7 @@ public class GremlinServerAuditLogIntegrateTest extends
AbstractGremlinServerInt
final String username = "stephen";
final String password = "password";
- final Cluster cluster =
TestClientFactory.build(kdcServer.gremlinHostname).auth(basic(username,
password)).create();
+ final Cluster cluster = TestClientFactory.build().auth(basic(username,
password)).create();
final GraphTraversalSource g = AnonymousTraversalSource.traversal().
withRemote(DriverRemoteConnection.using(cluster, "gmodern"));
diff --git
a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixtureTest.java
b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixtureTest.java
deleted file mode 100644
index d4a70c7e13..0000000000
---
a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/KdcFixtureTest.java
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.tinkerpop.gremlin.server;
-
-import org.junit.Test;
-
-/**
- * Validates the {@code KdcFixture} behavior a bit - tests for a tests.
- */
-public class KdcFixtureTest {
-
- @Test
- public void shouldCloseCleanly() throws Exception {
- final KdcFixture kdc;
- final String moduleBaseDir = System.getProperty("basedir");
- final String authConfigName = moduleBaseDir +
"/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf";
- System.setProperty("java.security.auth.login.config", authConfigName);
- kdc = new KdcFixture(moduleBaseDir);
- kdc.setUp();
-
- // deleting the principals will force an exception when they are
deleted a second time on close
- kdc.deletePrincipals();
-
- // expect a clean shutdown despite failures that will come from trying
to delete principals that aren't there
- kdc.close();
- }
-}
diff --git
a/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf
b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf
deleted file mode 100644
index a9ce21e865..0000000000
---
a/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-console-jaas.conf
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-GremlinConsole {
- com.sun.security.auth.module.Krb5LoginModule required
- doNotPrompt=true
- useTicketCache=true
- ticketCache="target/kdc/test-tkt.cc";
-};
-
-
-UserNotLoggedIn {
- com.sun.security.auth.module.Krb5LoginModule required
- doNotPrompt=true
- principal="[email protected]"
- useTicketCache=true;
-};
-
-
-GremlinConsole2 {
- com.sun.security.auth.module.Krb5LoginModule required
- doNotPrompt=true
- useTicketCache=true
- ticketCache="target/kdc/test-tkt2.cc";
-};
diff --git
a/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-server-integration.yaml
b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-server-integration.yaml
index ff84e4a5e0..53dcc407a6 100644
---
a/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-server-integration.yaml
+++
b/gremlin-server/src/test/resources/org/apache/tinkerpop/gremlin/server/gremlin-server-integration.yaml
@@ -21,7 +21,6 @@
# Changes to this file need to be appropriately replicated to
#
# - docker/gremlin-server/gremlin-server-integration.yaml
-# - docker/gremlin-server/gremlin-server-integration-krb5.yaml
# - docker/gremlin-server/gremlin-server-integration-secure.yaml
#
# Without such changes, the test docker server can't be started for independent
diff --git a/gremlin-server/src/test/scripts/test-server-stop.groovy
b/gremlin-server/src/test/scripts/test-server-stop.groovy
index 51d1a158ab..f73842ea98 100644
--- a/gremlin-server/src/test/scripts/test-server-stop.groovy
+++ b/gremlin-server/src/test/scripts/test-server-stop.groovy
@@ -29,12 +29,4 @@ def serverSecure =
project.getContextValue("gremlin.server.secure")
log.info("Shutting down $serverSecure")
serverSecure.stop().join()
-def kdcServer = project.getContextValue("gremlin.server.kdcserver")
-log.info("Shutting down $kdcServer")
-kdcServer.close()
-
-def serverKrb5 = project.getContextValue("gremlin.server.krb5")
-log.info("Shutting down $serverKrb5")
-serverKrb5.stop().join()
-
log.info("All Gremlin Server instances are shutdown for ${executionName}")
\ No newline at end of file
diff --git a/gremlin-test/pom.xml b/gremlin-test/pom.xml
index 62ad88c75f..1c5c7985a6 100644
--- a/gremlin-test/pom.xml
+++ b/gremlin-test/pom.xml
@@ -83,22 +83,6 @@ limitations under the License.
<artifactId>logback-classic</artifactId>
<optional>true</optional>
</dependency>
- <dependency>
- <groupId>org.apache.kerby</groupId>
- <artifactId>kerb-simplekdc</artifactId>
- <version>${kerby.version}</version>
- <exclusions>
- <exclusion>
- <groupId>org.wildfly.common</groupId>
- <artifactId>wildfly-common</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.wildfly.common</groupId>
- <artifactId>wildfly-common</artifactId>
- <version>1.5.4.Final</version>
- </dependency>
</dependencies>
<build>
<directory>${basedir}/target</directory>
diff --git
a/gremlin-test/src/main/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
b/gremlin-test/src/main/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
deleted file mode 100644
index 683c1d41bb..0000000000
---
a/gremlin-test/src/main/java/org/apache/tinkerpop/gremlin/server/KdcFixture.java
+++ /dev/null
@@ -1,217 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.tinkerpop.gremlin.server;
-
-import org.apache.kerby.kerberos.kerb.KrbException;
-import org.apache.kerby.kerberos.kerb.client.KrbClient;
-import org.apache.kerby.kerberos.kerb.client.KrbConfig;
-import org.apache.kerby.kerberos.kerb.client.KrbConfigKey;
-import org.apache.kerby.kerberos.kerb.server.SimpleKdcServer;
-import org.apache.kerby.kerberos.kerb.type.ticket.TgtTicket;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.File;
-import java.net.Inet4Address;
-
-/**
- * This class is derived from the following classes from
https://github.com/apache/directory-kerby/blob/kerby-all-1.0.0-RC2:
- * - org.apache.kerby.kerberos.kerb.server.TestKdcServer
- * - org.apache.kerby.kerberos.kerb.server.KdcTestBase
- * - org.apache.kerby.kerberos.kerb.server.LoginTestBase
- *
- * See also: gremlin-server/src/main/static/NOTICE
- *
- * @author Marc de Lignie
- */
-public class KdcFixture {
-
- private static final Logger logger =
LoggerFactory.getLogger(KdcFixture.class);
-
- final String clientPassword = "123456";
- final String clientPassword2 = "1234562";
- final String userPassword = "password";
- final String clientPrincipalName = "drankye";
- final String clientPrincipalName2 = "drankye2";
- final String userPrincipalName = "stephen";
- final String serverPrincipalName = "test-service";
- final String ticketCacheFileName = "test-tkt.cc";
- final String ticketCacheFileName2 = "test-tkt2.cc";
- final String serviceKeytabFileName = "test-service.keytab";
-
- final String clientPrincipal;
- final String clientPrincipal2;
- final String serverPrincipal;
- final String userPrincipal;
- final File testDir;
- final File ticketCacheFile;
- final File ticketCacheFile2;
- final File serviceKeytabFile;
-
- final String gremlinHostname;
- final String kdcHostname;
- private SimpleKdcServer kdcServer;
-
- public KdcFixture(final String moduleBaseDir) {
- this(moduleBaseDir, "localhost");
- }
-
- public KdcFixture(final String moduleBaseDir, final String kdcHostName) {
- this.kdcHostname = kdcHostName;
- gremlinHostname = findHostname();
- serverPrincipal = serverPrincipalName + "/" + gremlinHostname + "@" +
KdcFixture.TestKdcServer.KDC_REALM;
- clientPrincipal = clientPrincipalName + "@" +
KdcFixture.TestKdcServer.KDC_REALM;
- clientPrincipal2 = clientPrincipalName2 + "@" +
KdcFixture.TestKdcServer.KDC_REALM;
- userPrincipal = userPrincipalName + "@" +
KdcFixture.TestKdcServer.KDC_REALM;
-
- final File targetDir = new File(moduleBaseDir, "target");
- testDir = new File(targetDir, "kdc");
- testDir.mkdirs();
- ticketCacheFile = new File(testDir, ticketCacheFileName);
- ticketCacheFile2 = new File(testDir, ticketCacheFileName2);
- serviceKeytabFile = new File(testDir, serviceKeytabFileName);
- }
-
- private String findHostname() {
- // Hostname setting must be consistent with the way gremlin-console
sets gremlin-server's hostname
- // and derives gremlin-server's principal name. Also, the hostname
needs to be lowercase for use
- // in principal names.
- String hostname = "";
- try {
- hostname =
Inet4Address.getLocalHost().getCanonicalHostName().toLowerCase();
- } catch (Exception e) {
- logger.error("Hostname not found: " + e.getMessage());
- }
- return hostname;
- }
-
- private class TestKdcServer extends SimpleKdcServer {
- public static final String KDC_REALM = "TEST.COM";
- public final String HOSTNAME = kdcHostname;
- public static final int KDC_PORT = 4588;
-
- TestKdcServer() throws KrbException {
- setKdcRealm(KDC_REALM);
- setKdcHost(HOSTNAME);
- setAllowTcp(true);
- setAllowUdp(true);
- setKdcTcpPort(KDC_PORT);
- setKdcUdpPort(KDC_PORT);
-
- final KrbClient krbClnt = getKrbClient();
- final KrbConfig krbConfig = krbClnt.getKrbConfig();
- krbConfig.setString(KrbConfigKey.PERMITTED_ENCTYPES,
- "aes128-cts-hmac-sha1-96 des-cbc-crc des-cbc-md5
des3-cbc-sha1");
- krbConfig.setString(KrbConfigKey.DEFAULT_REALM, KDC_REALM);
- krbClnt.setTimeout(10 * 1000);
- }
- }
-
- public void setUp() throws Exception {
- setUpKdcServer();
- setUpPrincipals();
- }
-
- private void setUpKdcServer() throws Exception {
- kdcServer = new TestKdcServer();
- kdcServer.setWorkDir(testDir);
- kdcServer.init();
-
- // we start/stop the Kdc Server with some rapidity in tests. in low
resource environments (travis or docker),
- // it's possible that the socket for the server is left in TIME_WAIT
when it comes time to restart. with a
- // bit of retry and pausing perhaps it will make tests less flaky in
those environments
- for (int ix = 0; ix < 10; ix++) {
- try {
- kdcServer.start();
- break;
- } catch (Exception ex) {
- // on the last try ending in failure just toss the exception
- if (ix == 9) throw ex;
- final int pause = (ix + 1) * 1500;
- logger.warn(String.format("Failed to start Kerberos Server -
pausing for %s milliseconds and trying again - try #%s", pause, ix + 1), ex);
- Thread.sleep(pause);
- }
- }
- }
-
- private void setUpPrincipals() throws KrbException {
- kdcServer.createPrincipals(serverPrincipal);
- kdcServer.exportPrincipal(serverPrincipal, serviceKeytabFile);
-
- kdcServer.createPrincipal(clientPrincipal, clientPassword);
- final TgtTicket tgt =
kdcServer.getKrbClient().requestTgt(clientPrincipal, clientPassword);
- kdcServer.getKrbClient().storeTicket(tgt, ticketCacheFile);
-
- kdcServer.createPrincipal(clientPrincipal2, clientPassword2);
- final TgtTicket tgt2 =
kdcServer.getKrbClient().requestTgt(clientPrincipal2, clientPassword2);
- kdcServer.getKrbClient().storeTicket(tgt2, ticketCacheFile2);
-
- kdcServer.createPrincipal(userPrincipal, userPassword);
- }
-
- public void close() {
- deletePrincipals();
-
- try {
- kdcServer.stop();
- } catch (KrbException krbex) {
- logger.warn("Tried to stop KdcServer but encountered an
exception", krbex);
- }
-
- ticketCacheFile.delete();
- ticketCacheFile2.delete();
- serviceKeytabFile.delete();
- testDir.delete();
- }
-
- void deletePrincipals() {
- try {
- kdcServer.getKadmin().deleteBuiltinPrincipals();
- } catch (KrbException krbex) {
- logger.warn("Tried to delete builtin Principals on teardown but
failed", krbex);
- }
-
- deletePrincipal(serverPrincipal);
- deletePrincipal(clientPrincipal);
- deletePrincipal(clientPrincipal2);
- }
-
- private void deletePrincipal(final String principalToDelete) {
- try {
- kdcServer.deletePrincipal(principalToDelete);
- } catch (KrbException krbex) {
- logger.warn(String.format("Tried to delete %s Principals on
teardown but failed", principalToDelete), krbex);
- }
- }
-
- public void createPrincipal(final String principal) throws KrbException {
- kdcServer.createPrincipal(principal);
- }
-
- public static void main(final String[] args) throws Exception{
- final String projectBaseDir = args[0];
- // The KDC in docker/gremlin-server.sh needs to be exposed to both the
container and the host
- final KdcFixture kdcFixture = new KdcFixture(projectBaseDir,
"0.0.0.0");
- kdcFixture.setUp();
- logger.info("KDC started with configuration {}/target/kdc/krb5.conf",
projectBaseDir);
- while (true) {
- Thread.sleep(1000);
- }
- }
-}
diff --git a/pom.xml b/pom.xml
index e81de8c5af..9f4b908127 100644
--- a/pom.xml
+++ b/pom.xml
@@ -177,7 +177,6 @@ limitations under the License.
<javapoet.version>1.13.0</javapoet.version>
<jbcrypt.version>0.4</jbcrypt.version>
<junit.version>4.13.1</junit.version>
- <kerby.version>2.0.3</kerby.version>
<logback.version>1.3.15</logback.version>
<metrics.version>3.0.2</metrics.version>
<mockito.version>5.19.0</mockito.version>
@@ -1674,31 +1673,6 @@ limitations under the License.
<artifactId>junit</artifactId>
<version>${junit.version}</version>
</additionalDependency>
- <additionalDependency>
- <groupId>org.apache.kerby</groupId>
-
<artifactId>kerb-simplekdc</artifactId>
- <version>${kerby.version}</version>
- </additionalDependency>
- <additionalDependency>
- <groupId>org.apache.kerby</groupId>
-
<artifactId>kerb-server</artifactId>
- <version>${kerby.version}</version>
- </additionalDependency>
- <additionalDependency>
- <groupId>org.apache.kerby</groupId>
-
<artifactId>kerb-client</artifactId>
- <version>${kerby.version}</version>
- </additionalDependency>
- <additionalDependency>
- <groupId>org.apache.kerby</groupId>
-
<artifactId>kerb-common</artifactId>
- <version>${kerby.version}</version>
- </additionalDependency>
- <additionalDependency>
- <groupId>org.apache.kerby</groupId>
- <artifactId>kerb-core</artifactId>
- <version>${kerby.version}</version>
- </additionalDependency>
<additionalDependency>
<groupId>org.javatuples</groupId>
<artifactId>javatuples</artifactId>
diff --git a/spark-gremlin/pom.xml b/spark-gremlin/pom.xml
index d80e0f3e16..ce0eff687e 100644
--- a/spark-gremlin/pom.xml
+++ b/spark-gremlin/pom.xml
@@ -41,11 +41,6 @@ limitations under the License.
<groupId>io.dropwizard.metrics</groupId>
<artifactId>metrics-core</artifactId>
</exclusion>
- <!-- prefer gremlin-test/spark kerby -->
- <exclusion>
- <groupId>org.apache.kerby</groupId>
- <artifactId>kerb-simplekdc</artifactId>
- </exclusion>
<!-- prefer spark snappy -->
<exclusion>
<groupId>org.xerial.snappy</groupId>
@@ -56,10 +51,6 @@ limitations under the License.
<groupId>com.google.code.gson</groupId>
<artifactId>gson</artifactId>
</exclusion>
- <exclusion>
- <groupId>org.apache.kerby</groupId>
- <artifactId>kerb-core</artifactId>
- </exclusion>
<exclusion>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-annotations</artifactId>
