[
https://issues.apache.org/jira/browse/KNOX-2778?focusedWorklogId=797205&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-797205
]
ASF GitHub Bot logged work on KNOX-2778:
----------------------------------------
Author: ASF GitHub Bot
Created on: 02/Aug/22 12:32
Start Date: 02/Aug/22 12:32
Worklog Time Spent: 10m
Work Description: zeroflag commented on code in PR #615:
URL: https://github.com/apache/knox/pull/615#discussion_r935525128
##########
gateway-server/src/main/java/org/apache/knox/gateway/session/control/ConcurrentSessionVerifier.java:
##########
@@ -0,0 +1,142 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.session.control;
+
+
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.services.Service;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.security.token.impl.JWT;
+import org.apache.knox.gateway.services.security.token.impl.JWTToken;
+
+import java.text.ParseException;
+import java.util.Date;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.locks.Lock;
+import java.util.concurrent.locks.ReentrantLock;
+
+public class ConcurrentSessionVerifier implements Service {
+ private Set<String> privilegedUsers;
+ private Set<String> nonPrivilegedUsers;
+ private int privilegedUserConcurrentSessionLimit;
+ private int nonPrivilegedUserConcurrentSessionLimit;
+ private Map<String, Set<String>> concurrentSessionCounter;
+ private final Lock sessionCountModifyLock = new ReentrantLock();
+
+ public boolean verifySessionForUser(String username, String token) {
+ if (!privilegedUsers.contains(username) &&
!nonPrivilegedUsers.contains(username)) {
+ return true;
+ }
+
+ sessionCountModifyLock.lock();
+ try {
+ int validTokenNumber = countValidTokensForUser(username);
+ if (privilegedUserCheckLimitReached(username, validTokenNumber) ||
nonPrivilegedUserCheckLimitReached(username, validTokenNumber)) {
+ return false;
+ }
+ concurrentSessionCounter.putIfAbsent(username, new HashSet<>());
+ concurrentSessionCounter.compute(username, (key, tokenSet) ->
addTokenForUser(tokenSet, token));
+ } finally {
+ sessionCountModifyLock.unlock();
+ }
+ return true;
+ }
+
+ private int countValidTokensForUser(String username) {
+ int result = 0;
+ Set<String> tokens = concurrentSessionCounter.getOrDefault(username, null);
+ if (tokens != null && !tokens.isEmpty()) {
+ for (String token : tokens) {
+ try {
+ JWT jwtToken = new JWTToken(token);
Review Comment:
We need to consider the cost of `new JWToken(token)`. I assume it parses the
token everyt ime. Depending on how expensive is this, we might need to store
the preparsed tokens or some metadata about the token.
##########
gateway-server/src/main/java/org/apache/knox/gateway/session/control/ConcurrentSessionVerifier.java:
##########
@@ -0,0 +1,142 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.session.control;
+
+
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.services.Service;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.security.token.impl.JWT;
+import org.apache.knox.gateway.services.security.token.impl.JWTToken;
+
+import java.text.ParseException;
+import java.util.Date;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.locks.Lock;
+import java.util.concurrent.locks.ReentrantLock;
+
+public class ConcurrentSessionVerifier implements Service {
+ private Set<String> privilegedUsers;
+ private Set<String> nonPrivilegedUsers;
+ private int privilegedUserConcurrentSessionLimit;
+ private int nonPrivilegedUserConcurrentSessionLimit;
+ private Map<String, Set<String>> concurrentSessionCounter;
+ private final Lock sessionCountModifyLock = new ReentrantLock();
+
+ public boolean verifySessionForUser(String username, String token) {
+ if (!privilegedUsers.contains(username) &&
!nonPrivilegedUsers.contains(username)) {
+ return true;
+ }
+
+ sessionCountModifyLock.lock();
+ try {
+ int validTokenNumber = countValidTokensForUser(username);
+ if (privilegedUserCheckLimitReached(username, validTokenNumber) ||
nonPrivilegedUserCheckLimitReached(username, validTokenNumber)) {
+ return false;
+ }
+ concurrentSessionCounter.putIfAbsent(username, new HashSet<>());
+ concurrentSessionCounter.compute(username, (key, tokenSet) ->
addTokenForUser(tokenSet, token));
+ } finally {
+ sessionCountModifyLock.unlock();
+ }
+ return true;
+ }
+
+ private int countValidTokensForUser(String username) {
+ int result = 0;
+ Set<String> tokens = concurrentSessionCounter.getOrDefault(username, null);
+ if (tokens != null && !tokens.isEmpty()) {
+ for (String token : tokens) {
+ try {
+ JWT jwtToken = new JWTToken(token);
+ Date expire = jwtToken.getExpiresDate();
+ if (expire == null || expire.after(new Date())) {
Review Comment:
I would put a `hasExpired()` method into JWTToken to handle this check
internally.
##########
gateway-server/src/main/java/org/apache/knox/gateway/session/control/ConcurrentSessionVerifier.java:
##########
@@ -0,0 +1,142 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.session.control;
+
+
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.services.Service;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.security.token.impl.JWT;
+import org.apache.knox.gateway.services.security.token.impl.JWTToken;
+
+import java.text.ParseException;
+import java.util.Date;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.locks.Lock;
+import java.util.concurrent.locks.ReentrantLock;
+
+public class ConcurrentSessionVerifier implements Service {
+ private Set<String> privilegedUsers;
+ private Set<String> nonPrivilegedUsers;
+ private int privilegedUserConcurrentSessionLimit;
+ private int nonPrivilegedUserConcurrentSessionLimit;
+ private Map<String, Set<String>> concurrentSessionCounter;
+ private final Lock sessionCountModifyLock = new ReentrantLock();
+
+ public boolean verifySessionForUser(String username, String token) {
+ if (!privilegedUsers.contains(username) &&
!nonPrivilegedUsers.contains(username)) {
+ return true;
+ }
+
+ sessionCountModifyLock.lock();
+ try {
+ int validTokenNumber = countValidTokensForUser(username);
+ if (privilegedUserCheckLimitReached(username, validTokenNumber) ||
nonPrivilegedUserCheckLimitReached(username, validTokenNumber)) {
+ return false;
+ }
+ concurrentSessionCounter.putIfAbsent(username, new HashSet<>());
+ concurrentSessionCounter.compute(username, (key, tokenSet) ->
addTokenForUser(tokenSet, token));
+ } finally {
+ sessionCountModifyLock.unlock();
+ }
+ return true;
+ }
+
+ private int countValidTokensForUser(String username) {
+ int result = 0;
+ Set<String> tokens = concurrentSessionCounter.getOrDefault(username, null);
Review Comment:
The null check can be avoided here by using an emptySet as a default. The
isEmpty check is not needed.
```java
for (String token: concurrentSessionCounter.getOrDefault(username,
Collections.emptySet())) {
..
}
```
##########
gateway-server/src/main/java/org/apache/knox/gateway/session/control/ConcurrentSessionVerifier.java:
##########
@@ -0,0 +1,142 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.session.control;
+
+
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.services.Service;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.security.token.impl.JWT;
+import org.apache.knox.gateway.services.security.token.impl.JWTToken;
+
+import java.text.ParseException;
+import java.util.Date;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.locks.Lock;
+import java.util.concurrent.locks.ReentrantLock;
+
+public class ConcurrentSessionVerifier implements Service {
+ private Set<String> privilegedUsers;
+ private Set<String> nonPrivilegedUsers;
+ private int privilegedUserConcurrentSessionLimit;
+ private int nonPrivilegedUserConcurrentSessionLimit;
+ private Map<String, Set<String>> concurrentSessionCounter;
+ private final Lock sessionCountModifyLock = new ReentrantLock();
+
+ public boolean verifySessionForUser(String username, String token) {
+ if (!privilegedUsers.contains(username) &&
!nonPrivilegedUsers.contains(username)) {
+ return true;
+ }
+
+ sessionCountModifyLock.lock();
+ try {
+ int validTokenNumber = countValidTokensForUser(username);
+ if (privilegedUserCheckLimitReached(username, validTokenNumber) ||
nonPrivilegedUserCheckLimitReached(username, validTokenNumber)) {
+ return false;
+ }
+ concurrentSessionCounter.putIfAbsent(username, new HashSet<>());
+ concurrentSessionCounter.compute(username, (key, tokenSet) ->
addTokenForUser(tokenSet, token));
+ } finally {
+ sessionCountModifyLock.unlock();
+ }
+ return true;
+ }
+
+ private int countValidTokensForUser(String username) {
+ int result = 0;
+ Set<String> tokens = concurrentSessionCounter.getOrDefault(username, null);
+ if (tokens != null && !tokens.isEmpty()) {
+ for (String token : tokens) {
+ try {
+ JWT jwtToken = new JWTToken(token);
+ Date expire = jwtToken.getExpiresDate();
+ if (expire == null || expire.after(new Date())) {
+ result++;
+ }
+ } catch (ParseException ignore) {
Review Comment:
Under what circumstances do we get the ParseException. Depending on what it
means we should either log it or throw it out.
##########
gateway-service-knoxsso/pom.xml:
##########
@@ -81,5 +81,9 @@
<artifactId>gateway-test-utils</artifactId>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>org.apache.knox</groupId>
+ <artifactId>gateway-server</artifactId>
Review Comment:
Which class is references from gateway-server from gateway-service-knoxssou?
##########
gateway-service-knoxssout/pom.xml:
##########
@@ -68,5 +68,9 @@
<artifactId>gateway-test-utils</artifactId>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>org.apache.knox</groupId>
Review Comment:
Which class is references from gateway-server from gateway-service-knoxssout?
Issue Time Tracking
-------------------
Worklog Id: (was: 797205)
Time Spent: 0.5h (was: 20m)
> Enforce concurrent session limit in KnoxSSO
> -------------------------------------------
>
> Key: KNOX-2778
> URL: https://issues.apache.org/jira/browse/KNOX-2778
> Project: Apache Knox
> Issue Type: Sub-task
> Components: Server
> Affects Versions: 2.0.0
> Reporter: Sandor Molnar
> Assignee: Balazs Marton
> Priority: Major
> Fix For: 2.0.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Once, KNOX-2777 is ready, the next step is to wire that verifier
> implementation into the KnoxSSO flow such as it throws an authorization error
> (FORBIDDEN; 403) when a user tries to log in to UIs (both Knox's own UIs or
> UIs proxied by Knox) but that user exceeds the configured concurrent session
> limit.
> Basic logout handling should be covered too:
> * manually clicking on the logout button
> * subscribing to a session timeout event (you may want to talk to [~smore]
> about this)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
