Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ADH-4979: [Java] Propagation credential to connectors #17

Open
wants to merge 1 commit into
base: feature/ADH-5210
Choose a base branch
from
Open

ADH-4979: [Java] Propagation credential to connectors #17

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 16 additions & 6 deletions core/trino-main/src/main/java/io/trino/server/security/PasswordAuthenticator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
*/
package io.trino.server.security;

import com.google.common.collect.ImmutableMap;
import com.google.inject.Inject;
import io.trino.client.ProtocolDetectionException;
import io.trino.server.ProtocolConfig;
Expand All @@ -36,15 +37,17 @@ public class PasswordAuthenticator
private final PasswordAuthenticatorManager authenticatorManager;
private final UserMapping userMapping;
private final Optional<String> alternateHeaderName;
private final boolean populateExtraCredentials;

@Inject
public PasswordAuthenticator(PasswordAuthenticatorManager authenticatorManager, PasswordAuthenticatorConfig config, ProtocolConfig protocolConfig)
public PasswordAuthenticator(PasswordAuthenticatorManager authenticatorManager, PasswordAuthenticatorConfig config,
ProtocolConfig protocolConfig)
{
this.userMapping = createUserMapping(config.getUserMappingPattern(), config.getUserMappingFile());

this.authenticatorManager = requireNonNull(authenticatorManager, "authenticatorManager is null");
authenticatorManager.setRequired();
this.alternateHeaderName = protocolConfig.getAlternateHeaderName();
this.populateExtraCredentials = config.isPopulateExtraCredentials();
}

@Override
Expand All @@ -65,9 +68,15 @@ public Identity authenticate(ContainerRequestContext request)

// rewrite the original "unmapped" user header to the mapped user (see method Javadoc for more details)
rewriteUserHeaderToMappedUser(basicAuthCredentials, request.getHeaders(), authenticatedUser);
return Identity.forUser(authenticatedUser)
.withPrincipal(principal)
.build();
Identity.Builder identityBuilder = Identity.forUser(authenticatedUser).withPrincipal(principal);

if (populateExtraCredentials) {
ImmutableMap<String, String> credentials = ImmutableMap.of(
"arenadata.username", basicAuthCredentials.getUser(),
"arenadata.password", basicAuthCredentials.getPassword().get());
identityBuilder.withExtraCredentials(credentials);
}
return identityBuilder.build();
}
catch (UserMappingException | AccessDeniedException e) {
if (exception == null) {
Expand All @@ -90,7 +99,8 @@ public Identity authenticate(ContainerRequestContext request)
* When the user in the basic authentication header matches the x-trino-user header, we assume that the client does
* not want to force the runtime user name, and only wanted to communicate the authentication user.
*/
private void rewriteUserHeaderToMappedUser(BasicAuthCredentials basicAuthCredentials, MultivaluedMap<String, String> headers, String authenticatedUser)
private void rewriteUserHeaderToMappedUser(BasicAuthCredentials basicAuthCredentials,
MultivaluedMap<String, String> headers, String authenticatedUser)
{
String userHeader;
try {
Expand Down
14 changes: 14 additions & 0 deletions core/trino-main/src/main/java/io/trino/server/security/PasswordAuthenticatorConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ public class PasswordAuthenticatorConfig
private Optional<String> userMappingPattern = Optional.empty();
private Optional<File> userMappingFile = Optional.empty();
private List<File> passwordAuthenticatorFiles = ImmutableList.of(new File("etc/password-authenticator.properties"));
private boolean populateExtraCredentials;

public Optional<String> getUserMappingPattern()
{
Expand Down Expand Up @@ -72,4 +73,17 @@ public PasswordAuthenticatorConfig setPasswordAuthenticatorFiles(List<String> pa
.collect(toImmutableList());
return this;
}

public boolean isPopulateExtraCredentials()
{
return this.populateExtraCredentials;
}

@Config("arenadata.http-server.authentication.password.populate-extra-credentials")
@ConfigDescription("Whether to propagate username and password to extra credentials that could be read by catalogs")
public PasswordAuthenticatorConfig setPopulateExtraCredentials(boolean populateExtraCredentials)
{
this.populateExtraCredentials = populateExtraCredentials;
return this;
}
}
Loading