-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Added Authentication Controller Service
- Loading branch information
David Kjerrumgaard
committed
Mar 8, 2019
1 parent
a84b4bd
commit 25f736f
Showing
7 changed files
with
383 additions
and
21 deletions.
There are no files selected for viewing
32 changes: 32 additions & 0 deletions
32
...vice-api/src/main/java/org/apache/nifi/pulsar/auth/PulsarClientAuthenticationService.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one or more | ||
| * contributor license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright ownership. | ||
| * The ASF licenses this file to You under the Apache License, Version 2.0 | ||
| * (the "License"); you may not use this file except in compliance with | ||
| * the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package org.apache.nifi.pulsar.auth; | ||
|
|
||
| import org.apache.nifi.annotation.documentation.CapabilityDescription; | ||
| import org.apache.nifi.annotation.documentation.Tags; | ||
| import org.apache.nifi.controller.ControllerService; | ||
| import org.apache.pulsar.client.api.Authentication; | ||
|
|
||
| @Tags({"Pulsar", "client", "security", "authentication"}) | ||
| @CapabilityDescription("Provides Pulsar clients with the ability to authenticate against a " | ||
| + "secured Apache Pulsar broker endpoint.") | ||
| public interface PulsarClientAuthenticationService extends ControllerService { | ||
|
|
||
| public String getTlsTrustCertsFilePath(); | ||
|
|
||
| public Authentication getAuthentication(); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
74 changes: 74 additions & 0 deletions
74
.../src/main/java/org/apache/nifi/pulsar/auth/AbstractPulsarClientAuntenticationService.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one or more | ||
| * contributor license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright ownership. | ||
| * The ASF licenses this file to You under the Apache License, Version 2.0 | ||
| * (the "License"); you may not use this file except in compliance with | ||
| * the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package org.apache.nifi.pulsar.auth; | ||
|
|
||
| import java.io.File; | ||
|
|
||
| import org.apache.nifi.annotation.lifecycle.OnEnabled; | ||
| import org.apache.nifi.components.PropertyDescriptor; | ||
| import org.apache.nifi.components.ValidationContext; | ||
| import org.apache.nifi.components.ValidationResult; | ||
| import org.apache.nifi.components.Validator; | ||
| import org.apache.nifi.controller.AbstractControllerService; | ||
| import org.apache.nifi.controller.ConfigurationContext; | ||
| import org.apache.nifi.reporting.InitializationException; | ||
| import org.apache.pulsar.client.api.Authentication; | ||
|
|
||
| public abstract class AbstractPulsarClientAuntenticationService extends AbstractControllerService | ||
| implements PulsarClientAuthenticationService { | ||
|
|
||
| public static final PropertyDescriptor TRUST_CERTIFICATE = new PropertyDescriptor.Builder() | ||
| .name("Trusted Certificate Filename") | ||
| .description("The fully-qualified filename of the Trusted certificate.") | ||
| .defaultValue(null) | ||
| .addValidator(createFileExistsAndReadableValidator()) | ||
| .sensitive(false) | ||
| .build(); | ||
|
|
||
| protected ConfigurationContext configContext; | ||
|
|
||
| @OnEnabled | ||
| public void onConfigured(final ConfigurationContext context) throws InitializationException { | ||
| configContext = context; | ||
| } | ||
|
|
||
| @Override | ||
| public String getTlsTrustCertsFilePath() { | ||
| return configContext.getProperty(TRUST_CERTIFICATE).getValue(); | ||
| } | ||
|
|
||
| public abstract Authentication getAuthentication(); | ||
|
|
||
| protected static Validator createFileExistsAndReadableValidator() { | ||
| return new Validator() { | ||
| // Not using the FILE_EXISTS_VALIDATOR because the default is to | ||
| // allow expression language | ||
| @Override | ||
| public ValidationResult validate(String subject, String input, ValidationContext context) { | ||
| final File file = new File(input); | ||
| final boolean valid = file.exists() && file.canRead(); | ||
| final String explanation = valid ? null : "File " + file + " does not exist or cannot be read"; | ||
| return new ValidationResult.Builder() | ||
| .subject(subject) | ||
| .input(input) | ||
| .valid(valid) | ||
| .explanation(explanation) | ||
| .build(); | ||
| } | ||
| }; | ||
| } | ||
| } |
114 changes: 114 additions & 0 deletions
114
...ce/src/main/java/org/apache/nifi/pulsar/auth/PulsarClientAthenzAuthenticationService.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one or more | ||
| * contributor license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright ownership. | ||
| * The ASF licenses this file to You under the Apache License, Version 2.0 | ||
| * (the "License"); you may not use this file except in compliance with | ||
| * the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package org.apache.nifi.pulsar.auth; | ||
|
|
||
| import java.util.ArrayList; | ||
| import java.util.Collections; | ||
| import java.util.HashMap; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
|
|
||
| import org.apache.nifi.components.PropertyDescriptor; | ||
| import org.apache.nifi.processor.util.StandardValidators; | ||
| import org.apache.pulsar.client.api.Authentication; | ||
| import org.apache.pulsar.client.api.AuthenticationFactory; | ||
|
|
||
| // import org.apache.pulsar.client.impl.auth.AuthenticationAthenz; | ||
|
|
||
| /** | ||
| * https://pulsar.apache.org/docs/en/security-athenz/ | ||
| * | ||
| */ | ||
| public class PulsarClientAthenzAuthenticationService extends AbstractPulsarClientAuntenticationService { | ||
|
|
||
| public static final PropertyDescriptor TENANT_DOMAIN = new PropertyDescriptor.Builder() | ||
| .name("The tenant domain name") | ||
| .description("The domain name for this tenant") | ||
| .defaultValue(null) | ||
| .addValidator(StandardValidators.NON_BLANK_VALIDATOR) | ||
| .sensitive(false) | ||
| .build(); | ||
|
|
||
| public static final PropertyDescriptor TENANT_SERVICE = new PropertyDescriptor.Builder() | ||
| .name("The tenant service name") | ||
| .description("The service name for this tenant") | ||
| .defaultValue(null) | ||
| .addValidator(StandardValidators.NON_BLANK_VALIDATOR) | ||
| .sensitive(false) | ||
| .build(); | ||
|
|
||
| public static final PropertyDescriptor PROVIDER_DOMAIN = new PropertyDescriptor.Builder() | ||
| .name("The provider domain") | ||
| .description("The provider domain name") | ||
| .defaultValue(null) | ||
| .addValidator(StandardValidators.NON_BLANK_VALIDATOR) | ||
| .sensitive(false) | ||
| .build(); | ||
|
|
||
| public static final PropertyDescriptor TENANT_PRIVATE_KEY_FILE = new PropertyDescriptor.Builder() | ||
| .name("Tenants Private Key Filename") | ||
| .description("The fully-qualified filename of the tenant's private key.") | ||
| .defaultValue(null) | ||
| .addValidator(createFileExistsAndReadableValidator()) | ||
| .sensitive(false) | ||
| .build(); | ||
|
|
||
| public static final PropertyDescriptor TENANT_PRIVATE_KEY_ID = new PropertyDescriptor.Builder() | ||
| .name("Tenants Private Key Id") | ||
| .description("The id of tenant's private key.") | ||
| .defaultValue("0") | ||
| .required(false) | ||
| .sensitive(false) | ||
| .build(); | ||
|
|
||
| private static final List<PropertyDescriptor> properties; | ||
|
|
||
| static { | ||
| List<PropertyDescriptor> props = new ArrayList<>(); | ||
| props.add(TRUST_CERTIFICATE); | ||
| props.add(TENANT_DOMAIN); | ||
| props.add(TENANT_SERVICE); | ||
| props.add(PROVIDER_DOMAIN); | ||
| props.add(TENANT_PRIVATE_KEY_FILE); | ||
| props.add(TENANT_PRIVATE_KEY_ID); | ||
| properties = Collections.unmodifiableList(props); | ||
| } | ||
|
|
||
| @Override | ||
| protected List<PropertyDescriptor> getSupportedPropertyDescriptors() { | ||
| return properties; | ||
| } | ||
|
|
||
| @Override | ||
| public Authentication getAuthentication() { | ||
| Map<String, String> authParams = new HashMap<>(); | ||
| // TODO Define constants for these keys | ||
| authParams.put("tenantDomain", configContext.getProperty(TENANT_DOMAIN).getValue()); | ||
| authParams.put("tenantService", configContext.getProperty(TENANT_SERVICE).getValue()); | ||
| authParams.put("providerDomain", configContext.getProperty(PROVIDER_DOMAIN).getValue()); | ||
| authParams.put("privateKey", configContext.getProperty(TENANT_PRIVATE_KEY_FILE).getValue()); | ||
|
|
||
| if (configContext.getProperty(TENANT_PRIVATE_KEY_ID).isSet()) { | ||
| authParams.put("keyId", configContext.getProperty(TENANT_PRIVATE_KEY_ID).getValue()); | ||
| } | ||
|
|
||
| // return AuthenticationFactory.create(AuthenticationAthenz.class.getName(), authParams); | ||
|
|
||
| return null; | ||
| } | ||
|
|
||
| } |
62 changes: 62 additions & 0 deletions
62
...rvice/src/main/java/org/apache/nifi/pulsar/auth/PulsarClientJwtAuthenticationService.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one or more | ||
| * contributor license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright ownership. | ||
| * The ASF licenses this file to You under the Apache License, Version 2.0 | ||
| * (the "License"); you may not use this file except in compliance with | ||
| * the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package org.apache.nifi.pulsar.auth; | ||
|
|
||
| import java.util.ArrayList; | ||
| import java.util.Collections; | ||
| import java.util.List; | ||
|
|
||
| import org.apache.nifi.components.PropertyDescriptor; | ||
| import org.apache.nifi.processor.util.StandardValidators; | ||
| import org.apache.pulsar.client.api.Authentication; | ||
| import org.apache.pulsar.client.api.AuthenticationFactory; | ||
|
|
||
| /** | ||
| * http://pulsar.apache.org/docs/en/security-token-client/ | ||
| * | ||
| */ | ||
| public class PulsarClientJwtAuthenticationService extends AbstractPulsarClientAuntenticationService { | ||
|
|
||
| public static final PropertyDescriptor JWT_TOKEN = new PropertyDescriptor.Builder() | ||
| .name("The JSON Web Token") | ||
| .description("The raw signed JWT string") | ||
| .defaultValue(null) | ||
| .addValidator(StandardValidators.NON_BLANK_VALIDATOR) | ||
| .required(true) | ||
| .sensitive(true) | ||
| .build(); | ||
|
|
||
| private static final List<PropertyDescriptor> properties; | ||
|
|
||
| static { | ||
| List<PropertyDescriptor> props = new ArrayList<>(); | ||
| props.add(TRUST_CERTIFICATE); | ||
| props.add(JWT_TOKEN); | ||
| properties = Collections.unmodifiableList(props); | ||
| } | ||
|
|
||
| @Override | ||
| protected List<PropertyDescriptor> getSupportedPropertyDescriptors() { | ||
| return properties; | ||
| } | ||
|
|
||
| @Override | ||
| public Authentication getAuthentication() { | ||
| return AuthenticationFactory.token(configContext.getProperty(JWT_TOKEN).getValue()); | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.