[
https://issues.apache.org/jira/browse/KNOX-2556?focusedWorklogId=572213&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-572213
]
ASF GitHub Bot logged work on KNOX-2556:
----------------------------------------
Author: ASF GitHub Bot
Created on: 25/Mar/21 19:00
Start Date: 25/Mar/21 19:00
Worklog Time Spent: 10m
Work Description: lmccay commented on a change in pull request #424:
URL: https://github.com/apache/knox/pull/424#discussion_r601762684
##########
File path:
gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/JWTFederationFilter.java
##########
@@ -93,55 +99,74 @@ public void destroy() {
@Override
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain)
throws IOException, ServletException {
- final String wireToken = getWireToken(request);
+ final Pair<TokenType, String> wireToken = getWireToken(request);
if (wireToken != null) {
- try {
- JWT token = new JWTToken(wireToken);
- if (validateToken((HttpServletRequest)request,
(HttpServletResponse)response, chain, token)) {
- Subject subject = createSubjectFromToken(token);
- continueWithEstablishedSecurityContext(subject,
(HttpServletRequest)request, (HttpServletResponse)response, chain);
+ TokenType tokenType = wireToken.getLeft();
+ String tokenValue = wireToken.getRight();
+
+ if (TokenType.JWT.equals(tokenType)) {
+ try {
+ JWT token = new JWTToken(tokenValue);
+ if (validateToken((HttpServletRequest) request,
(HttpServletResponse) response, chain, token)) {
+ Subject subject = createSubjectFromToken(token);
+ continueWithEstablishedSecurityContext(subject,
(HttpServletRequest) request, (HttpServletResponse) response, chain);
+ }
+ } catch (ParseException ex) {
+ ((HttpServletResponse)
response).sendError(HttpServletResponse.SC_UNAUTHORIZED);
+ }
+ } else if (TokenType.Passcode.equals(tokenType)) {
+ // Validate the token based on the server-managed metadata
+ if (validateToken((HttpServletRequest) request, (HttpServletResponse)
response, chain, tokenValue)) {
+ Subject subject = createSubjectFromTokenIdentifier(tokenValue);
+ continueWithEstablishedSecurityContext(subject, (HttpServletRequest)
request, (HttpServletResponse) response, chain);
}
- } catch (ParseException ex) {
- ((HttpServletResponse)
response).sendError(HttpServletResponse.SC_UNAUTHORIZED);
}
- }
- else {
+ } else {
// no token provided in header
((HttpServletResponse)
response).sendError(HttpServletResponse.SC_UNAUTHORIZED);
}
}
- public String getWireToken(final ServletRequest request) {
+ public Pair<TokenType, String> getWireToken(final ServletRequest request) {
+ Pair<TokenType, String> parsed = null;
String token = null;
final String header =
((HttpServletRequest)request).getHeader("Authorization");
if (header != null) {
if (header.startsWith(BEARER)) {
// what follows the bearer designator should be the JWT token
being used
- // to request or as an access token
+ // to request or as an access token
token = header.substring(BEARER.length());
- }
- else if
(header.toLowerCase(Locale.ROOT).startsWith(BASIC.toLowerCase(Locale.ROOT))) {
- // what follows the Basic designator should be the JWT token
being used
- // to request or as an access token
- token = this.parseFromHTTPBasicCredentials(token, header);
+ parsed = Pair.of(TokenType.JWT, token);
+ } else if
(header.toLowerCase(Locale.ROOT).startsWith(BASIC.toLowerCase(Locale.ROOT))) {
+ // what follows the Basic designator should be the JWT token or
the unique token ID being used
+ // to request or as an access token
+ parsed = parseFromHTTPBasicCredentials(header);
}
}
- if (token == null) {
+
+ if (parsed == null) {
token = request.getParameter(this.paramName);
+ if (token != null) {
+ parsed = Pair.of(TokenType.JWT, token);
+ }
}
- return token;
+
+ return parsed;
}
- private String parseFromHTTPBasicCredentials(String token, final String
header) {
+ private Pair<TokenType, String> parseFromHTTPBasicCredentials(final String
header) {
+ Pair<TokenType, String> parsed = null;
final String base64Credentials = header.substring(BASIC.length()).trim();
final byte[] credDecoded = Base64.getDecoder().decode(base64Credentials);
final String credentials = new String(credDecoded,
StandardCharsets.UTF_8);
final String[] values = credentials.split(":", 2);
- if (values[0].equalsIgnoreCase(TOKEN)) {
- token = values[1];
+ String username = values[0];
+ if (TOKEN.equals(username) || PASSCODE.equals(username)) {
Review comment:
since this is user input, I originally had this as case insensitive. Do
you feel strongly that it should be case sensitive? And in that case do we
still want it to be first char upper?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
Issue Time Tracking
-------------------
Worklog Id: (was: 572213)
Time Spent: 1h 50m (was: 1h 40m)
> Enhance JWTProvider to accept knox.id as Passcode Token
> -------------------------------------------------------
>
> Key: KNOX-2556
> URL: https://issues.apache.org/jira/browse/KNOX-2556
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 1.6.0
> Reporter: Larry McCay
> Assignee: Philip Zampino
> Priority: Major
> Time Spent: 1h 50m
> Remaining Estimate: 0h
>
> This enhancement enables the use of the previously internal knox.id as a
> Passcode Token for accessing proxied resources as an Authorization Bearer
> token or HTTP Basic password. This id has been used to bind incoming
> KnoxTokens (JWT) that embed such an id to the metadata in the Token State
> Server in order to provide server side state management.
> The motivation for this is the fact that certain 3rd party BI tooling such as
> tableau not only have the inability to set a bearer token but also have size
> limitations on the password field used to collect the username and password
> credentials.
> We will need to enhance the current JWTProvider to not require an actual JWT
> but the Passcode Token will represent the same backend metadata.
> This does mean that Passcode Tokens can only be used with the Token State
> Server functionality enabled for both the KnoxToken service and the
> JWTProvider federation provider.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
