Package com.illumon.iris.auth

Class AuthenticationServerBase

java.lang.Object

com.illumon.iris.auth.AuthenticationServerBase

All Implemented Interfaces:

LocalAuthenticationServer

Direct Known Subclasses:

GrpcAuthenticationServer

public class AuthenticationServerBase
extends Object
implements LocalAuthenticationServer

Business logic (independent of transport) for an authentication server implementation. Transport details are provided in classes derived from this one.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
protected final class	AuthenticationServerBase.ClientState
protected static class	AuthenticationServerBase.TokenEntry
protected class	AuthenticationServerBase.TokenEntryList	Linked list to help when scanning for expired tokens.

Field Summary

Fields

Modifier and Type	Field	Description
protected final AuditEventLogger	auditLog
protected final @NotNull AuthHookModule	authHookModule
protected final List<AuthModule>	authModules
protected static final io.deephaven.hash.KeyedObjectKey<Object,AuthenticationServerBase.ClientState>	CLIENT_STATE_CLIENT_ENTRY_KEY
protected final io.deephaven.hash.KeyedObjectHash.ValueFactory<Object,AuthenticationServerBase.ClientState>	clientStateFactory
protected final io.deephaven.hash.KeyedObjectHashMap<Object,AuthenticationServerBase.ClientState>	clientStatesByEntry
protected final com.fishlib.io.logger.Logger	log
protected final boolean	LOG_TOKEN_EVENTS
protected final DataImportServerLogFactory	logCreator
protected final InetAddress	originHost
static final int	RESOLVER_ETCD_LEASE_KEEPALIVE_TIMEOUT_MS	How long will we wait for our etcd election lease to be granted or renewed, in milliseconds before determining that we had a failure.
static final int	RESOLVER_ETCD_LEASE_RENEW_RETRY_DELAY_SECONDS	What is the maximum frequency which we will try to renew an auth resolver lease.
protected final SecureRandom	secureRandom
protected AuthenticationServerBase.TokenEntryList	tokenEntryList
protected final Map<Long,AuthenticationServerBase.TokenEntry>	tokensById
protected final ReloadableUserAuthConfig	userConfig

Constructor Summary

Constructors

Constructor	Description
AuthenticationServerBase(DataImportServerLogFactory logFactory)

Method Summary

Modifier and Type	Method	Description
boolean	addLocalClient(LocalAuthenticationClientManager localClient, String userToAuthenticate, String effectiveUser)	Inserts the localClient into this authentication server's state map.
protected boolean	authenticateByDelegateToken(Object client, AuthToken delegateToken, String sessionDesc)
protected boolean	authenticatedByCookie(Object client, SimpleUserContext userContext, String sessionDesc)
static boolean	checkHashedPassword(com.fishlib.io.logger.Logger log, String userToAuthenticate, String password, String hashed)
protected NotAuthenticatedException	clientNotAuthenticated()
static String	createHashedPassword(char[] password)
protected AuthToken	createToken(Object client, AuthenticationServerBase.ClientState clientState, String service, String sessionDesc)
protected AuthToken	createToken(Object client, String service, AuthenticationServerBase.ClientState clientState, UserContext context, String sessionDesc)
protected AuthToken	createTokenForUser(Object client, String service, String operateAs, String sessionDesc)
AuthToken	createTokenForUserLocal(LocalAuthenticationClientManager client, String service, String operateAs)	Creates a token for the provided service and user.
AuthToken	createTokenLocal(LocalAuthenticationClientManager client, String service)
protected SimpleUserContext	externalAuthentication(Object client, String key, String sessionDesc)
protected static String	fingerPrint(PublicKey key)	Compute the SHA-1 digest of the key encoded as a hex string
byte[]	getNonce(Object client)
InetAddress	getOriginHost()
boolean	isTokenValid(String verifyingService, AuthToken tokenToVerify)
com.fishlib.io.logger.Logger	log()
static boolean	nullOrSameCredentials(AuthenticationServerBase.ClientState clientState, UserContext userContext)
static boolean	nullOrSameCredentials(AuthenticationServerBase.ClientState clientState, String user, String effectiveUser)
protected boolean	passwordAuthentication(Object client, String userToAuthenticate, String password, String effectiveUser, String sessionDesc)
protected boolean	permittedToOperateAs(String userToAuthenticate, String effectiveUser)
protected void	registerContext(Object client, UserContext context)
protected void	registerContext(Object client, String userToAuthenticate, String effectiveUser)
String	reloadConfiguration()
String	reloadConfigurationInternal()
protected void	removeClientState(Object client)
protected AuthenticationServerBase.TokenEntry	removeToken(long tokenId)
protected void	shutdown()
protected void	start()
protected AuthException	tooManyNonces()
protected boolean	userExists(String effectiveUser)
protected boolean	userExistsCached(String user)
protected boolean	verifyChallenge(Object client, PublicKey publicKey, byte[] response, String userToAuthenticate, String effectiveUser, String sessionDesc)
boolean	verifyChallengeLocal(LocalAuthenticationClientManager localClient, PublicKey publicKey, byte[] response, String userToAuthenticate, String effectiveUser)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

RESOLVER_ETCD_LEASE_RENEW_RETRY_DELAY_SECONDS

public static final int RESOLVER_ETCD_LEASE_RENEW_RETRY_DELAY_SECONDS

What is the maximum frequency which we will try to renew an auth resolver lease. If a lease renewal times out, we will try again more quickly than the standard RESOLVER_LEASE_RENEW_SECONDS.

RESOLVER_ETCD_LEASE_KEEPALIVE_TIMEOUT_MS

public static final int RESOLVER_ETCD_LEASE_KEEPALIVE_TIMEOUT_MS

How long will we wait for our etcd election lease to be granted or renewed, in milliseconds before determining that we had a failure.

secureRandom

protected final SecureRandom secureRandom

tokensById

protected final Map<Long,AuthenticationServerBase.TokenEntry> tokensById

clientStatesByEntry

protected final io.deephaven.hash.KeyedObjectHashMap<Object,AuthenticationServerBase.ClientState> clientStatesByEntry

CLIENT_STATE_CLIENT_ENTRY_KEY

protected static final io.deephaven.hash.KeyedObjectKey<Object,AuthenticationServerBase.ClientState> CLIENT_STATE_CLIENT_ENTRY_KEY

clientStateFactory

protected final io.deephaven.hash.KeyedObjectHash.ValueFactory<Object,AuthenticationServerBase.ClientState> clientStateFactory

logCreator

protected final DataImportServerLogFactory logCreator

log

protected final com.fishlib.io.logger.Logger log

auditLog

protected final AuditEventLogger auditLog

LOG_TOKEN_EVENTS

protected final boolean LOG_TOKEN_EVENTS

userConfig

protected final ReloadableUserAuthConfig userConfig

authHookModule

@NotNull
protected final @NotNull AuthHookModule authHookModule

authModules

protected final List<AuthModule> authModules

originHost

protected final InetAddress originHost

tokenEntryList

protected AuthenticationServerBase.TokenEntryList tokenEntryList

Constructor Details

AuthenticationServerBase

public AuthenticationServerBase(DataImportServerLogFactory logFactory)
                         throws IOException,
ConfigurationVerificationException

Throws:

IOException

ConfigurationVerificationException

Method Details

getOriginHost

public InetAddress getOriginHost()

Specified by:

getOriginHost in interface LocalAuthenticationServer

start

protected void start()

shutdown

protected void shutdown()

checkHashedPassword

public static boolean checkHashedPassword(com.fishlib.io.logger.Logger log,
 String userToAuthenticate,
 String password,
 String hashed)

createHashedPassword

public static String createHashedPassword(char[] password)

nullOrSameCredentials

public static boolean nullOrSameCredentials(AuthenticationServerBase.ClientState clientState,
 UserContext userContext)

nullOrSameCredentials

public static boolean nullOrSameCredentials(AuthenticationServerBase.ClientState clientState,
 String user,
 String effectiveUser)

removeClientState

protected void removeClientState(Object client)

passwordAuthentication

protected boolean passwordAuthentication(Object client,
 String userToAuthenticate,
 String password,
 String effectiveUser,
 String sessionDesc)

authenticatedByCookie

protected boolean authenticatedByCookie(Object client,
 SimpleUserContext userContext,
 String sessionDesc)

tooManyNonces

protected AuthException tooManyNonces()

getNonce

public byte[] getNonce(Object client)

Specified by:

getNonce in interface LocalAuthenticationServer

verifyChallengeLocal

public boolean verifyChallengeLocal(LocalAuthenticationClientManager localClient,
 PublicKey publicKey,
 byte[] response,
 String userToAuthenticate,
 String effectiveUser)

Specified by:

verifyChallengeLocal in interface LocalAuthenticationServer

addLocalClient

public boolean addLocalClient(LocalAuthenticationClientManager localClient,
 String userToAuthenticate,
 String effectiveUser)

Description copied from interface: LocalAuthenticationServer

Inserts the localClient into this authentication server's state map.

The client is authenticated as the provided user.

Specified by:

addLocalClient in interface LocalAuthenticationServer

Parameters:

localClient - the local client state

userToAuthenticate - the authenticated user for the client state.

effectiveUser - the effective user for the client state.

Returns:

true (authentication cannot fail)

registerContext

protected void registerContext(Object client,
 UserContext context)

registerContext

protected void registerContext(Object client,
 String userToAuthenticate,
 String effectiveUser)

verifyChallenge

protected boolean verifyChallenge(Object client,
 PublicKey publicKey,
 byte[] response,
 String userToAuthenticate,
 String effectiveUser,
 String sessionDesc)

authenticateByDelegateToken

protected boolean authenticateByDelegateToken(Object client,
 AuthToken delegateToken,
 String sessionDesc)

externalAuthentication

protected SimpleUserContext externalAuthentication(Object client,
 String key,
 String sessionDesc)

log

public com.fishlib.io.logger.Logger log()

fingerPrint

protected static String fingerPrint(PublicKey key)

Compute the SHA-1 digest of the key encoded as a hex string

Returns:

The SHA-1 digest as a hex string or "<error>" if it was unsuccessful

permittedToOperateAs

protected boolean permittedToOperateAs(String userToAuthenticate,
 String effectiveUser)

userExists

protected boolean userExists(String effectiveUser)

isTokenValid

public boolean isTokenValid(String verifyingService,
 AuthToken tokenToVerify)

Specified by:

isTokenValid in interface LocalAuthenticationServer

createTokenLocal

public AuthToken createTokenLocal(LocalAuthenticationClientManager client,
 String service)

Specified by:

createTokenLocal in interface LocalAuthenticationServer

createTokenForUserLocal

public AuthToken createTokenForUserLocal(LocalAuthenticationClientManager client,
 String service,
 String operateAs)

Description copied from interface: LocalAuthenticationServer

Creates a token for the provided service and user.

Specified by:

createTokenForUserLocal in interface LocalAuthenticationServer

Parameters:

client - the client to create a token for

service - the service to create a token for

operateAs - the effective user to create a token for

Returns:

the newly created token

clientNotAuthenticated

protected NotAuthenticatedException clientNotAuthenticated()

createToken

protected AuthToken createToken(Object client,
 AuthenticationServerBase.ClientState clientState,
 String service,
 String sessionDesc)

createToken

protected AuthToken createToken(Object client,
 String service,
 AuthenticationServerBase.ClientState clientState,
 UserContext context,
 String sessionDesc)

createTokenForUser

protected AuthToken createTokenForUser(Object client,
 String service,
 String operateAs,
 String sessionDesc)

removeToken

protected AuthenticationServerBase.TokenEntry removeToken(long tokenId)

userExistsCached

protected boolean userExistsCached(String user)

reloadConfigurationInternal

public String reloadConfigurationInternal()
                                   throws IOException,
ConfigurationVerificationException

Throws:

IOException

ConfigurationVerificationException

reloadConfiguration

public String reloadConfiguration()
                           throws IOException,
ConfigurationVerificationException

Throws:

IOException

ConfigurationVerificationException