smolnar82 opened a new pull request #361:
URL: https://github.com/apache/knox/pull/361
## What changes were proposed in this pull request?
The main purpose of this PR is to add a new token state service
implementation the uses Zookeeper as token storage.
Also, the following enhancements were made:
- introduced a service cache in
`org.apache.knox.gateway.services.factory.AbstractServiceFactory` to avoid
creating/initiating the same service by type/implementation more than once
- `ZookeeperRemoteAliasService` can be built w/o local alias service
## How was this patch tested?
Updated/ran JUnit tests and executed the following manual test steps:
1. Enabled token state service in sandbox:
```
<param>
<name>knox.token.exp.server-managed</name>
<value>true</value>
</param>
```
2. Configured Knox to use the new ZK Token State Service in
`gateway-site.xml`:
```
<property>
<name>gateway.service.tokenstate.impl</name>
<value>org.apache.knox.gateway.services.token.impl.ZookeeperTokenStateService</value>
</property>
<property>
<name>gateway.service.tokenstate.useLocalAliasService</name>
<value>[true|false]</value>
</property>
<property>
<name>gateway.remote.config.registry.zookeeper-client</name>
<value>type=ZooKeeper;address=$ZK_HOST:2181</value>
<description>ZooKeeper configuration registry client
details.</description>
</property>
<property>
<name>gateway.remote.config.monitor.client</name>
<value>zookeeper-client</value>
<description>Remote configuration monitor client name.</description>
</property>
```
3. Started Knox
4. Acquired a Knox delegation token:
```
$ curl -ivku guest:guest-password
https://localhost:8443/gateway/sandbox/knoxtoken/api/v1/token
...
* Connection #0 to host localhost left intact
{"access_token":"eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJndWVzdCIsImF1...,"target_url":"https://localhost:8443/gateway/tokenbased",...,"token_type":"Bearer","expires_in":1594764588683}
gateway.log:
2020-07-14 14:09:48,681 INFO service.knoxtoken
(TokenResource.java:init(169)) - Server management of token state is enabled
for the "sandbox" topology.
2020-07-14 14:09:48,682 WARN service.knoxtoken
(TokenResource.java:init(199)) - There are no token renewers white-listed in
the "sandbox" topology.
2020-07-14 14:09:48,690 INFO service.knoxtoken
(TokenResource.java:getAuthenticationToken(400)) - Knox Token service (sandbox)
issued token eyJhbG...WYtr9Q (483b5976-f5ca-4761-b2d3-65041aa40d09)
```
5. Confirmed that the token became persisted in Zookeeper:
```
$ zookeeper-client -server $ZK_HOST:2181
Connecting to $ZK_HOST:2181
Welcome to ZooKeeper!
JLine support is enabled
WATCHER::
WatchedEvent state:SyncConnected type:None path:null
[zk: $ZK_HOST:2181(CONNECTED) 0] ls /knox/security/topology/__gateway
[483b5976-f5ca-4761-b2d3-65041aa40d09,
483b5976-f5ca-4761-b2d3-65041aa40d09--max]
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
