forked from prestodb/presto
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add support for pluggable Custom Presto Authenticators
Co-authored-by: Namya Sehgal <sehgalnamya@gmail.com>
- Loading branch information
1 parent
5d63246
commit 6b2683c
Showing
13 changed files
with
301 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
52 changes: 52 additions & 0 deletions
52
presto-docs/src/main/sphinx/develop/presto-authenticator.rst
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| =========================== | ||
| Custom Presto Authenticator | ||
| =========================== | ||
|
|
||
| Presto supports authentication through a custom Presto authenticator | ||
| that validates the request and creates a principal. | ||
|
|
||
| Implementation | ||
| -------------- | ||
|
|
||
| ``PrestoAuthenticatorFactory`` creates a | ||
| ``PrestoAuthenticator`` instance. It also defines the name of this | ||
| authenticator which is used by the administrator in a Presto configuration. | ||
|
|
||
| ``PrestoAuthenticator`` contains a single method, ``createAuthenticatedPrincipal()``, | ||
| that validates the request and returns a ``Principal``, which is then | ||
| authorized by the :doc:`system-access-control`. | ||
|
|
||
| The implementation of ``PrestoAuthenticatorFactory`` must be wrapped | ||
| as a plugin and installed on the Presto cluster. | ||
|
|
||
| Configuration | ||
| ------------- | ||
|
|
||
| After a plugin that implements ``PrestoAuthenticatorFactory`` has been | ||
| installed on the coordinator, it is configured using an | ||
| ``etc/presto-authenticator.properties`` file. All of the | ||
| properties other than ``presto-authenticator.name`` are specific to the | ||
| ``PrestoAuthenticatorFactory`` implementation. | ||
|
|
||
| The ``presto-authenticator.name`` property is used by Presto to find a | ||
| registered ``PrestoAuthenticatorFactory`` based on the name returned by | ||
| ``PrestoAuthenticatorFactory.getName()``. The remaining properties are | ||
| passed as a map to ``PrestoAuthenticatorFactory.create()``. | ||
|
|
||
| Example configuration file: | ||
|
|
||
| .. code-block:: none | ||
| presto-authenticator.name=custom-authenticator | ||
| custom-property1=custom-value1 | ||
| custom-property2=custom-value2 | ||
| Additionally, the coordinator must be configured to use custom authentication | ||
| and have HTTPS enabled. | ||
|
|
||
| Add the property shown below to the coordinator's ``config.properties`` file: | ||
|
|
||
| .. code-block:: none | ||
| http-server.authentication.type=CUSTOM | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
67 changes: 67 additions & 0 deletions
67
presto-main/src/main/java/com/facebook/presto/server/security/CustomPrestoAuthenticator.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| /* | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package com.facebook.presto.server.security; | ||
|
|
||
| import com.facebook.airlift.http.server.AuthenticationException; | ||
| import com.facebook.airlift.http.server.Authenticator; | ||
| import com.facebook.presto.spi.security.AccessDeniedException; | ||
|
|
||
| import javax.inject.Inject; | ||
| import javax.servlet.http.HttpServletRequest; | ||
|
|
||
| import java.security.Principal; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
|
|
||
| import static com.google.common.collect.ImmutableMap.toImmutableMap; | ||
| import static java.util.Collections.list; | ||
| import static java.util.Objects.requireNonNull; | ||
|
|
||
| public class CustomPrestoAuthenticator | ||
| implements Authenticator | ||
| { | ||
| private PrestoAuthenticatorManager authenticatorManager; | ||
|
|
||
| @Inject | ||
| public CustomPrestoAuthenticator(PrestoAuthenticatorManager authenticatorManager) | ||
| { | ||
| this.authenticatorManager = requireNonNull(authenticatorManager, "authenticatorManager is null"); | ||
| } | ||
|
|
||
| @Override | ||
| public Principal authenticate(HttpServletRequest request) | ||
| throws AuthenticationException | ||
| { | ||
| try { | ||
| // Extracting headers into a Map | ||
| Map<String, List<String>> headers = getHeadersMap(request); | ||
|
|
||
| // Passing the header map to the authenticator (instead of HttpServletRequest) | ||
| return authenticatorManager.getAuthenticator().createAuthenticatedPrincipal(headers); | ||
| } | ||
| catch (AccessDeniedException e) { | ||
| throw new AuthenticationException(e.getMessage()); | ||
| } | ||
| } | ||
|
|
||
| // Utility method to extract headers from HttpServletRequest | ||
| private Map<String, List<String>> getHeadersMap(HttpServletRequest request) | ||
| { | ||
| return list(request.getHeaderNames()) | ||
| .stream() | ||
| .collect(toImmutableMap( | ||
| headerName -> headerName, | ||
| headerName -> list(request.getHeaders(headerName)))); | ||
| } | ||
| } |
98 changes: 98 additions & 0 deletions
98
...to-main/src/main/java/com/facebook/presto/server/security/PrestoAuthenticatorManager.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| /* | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package com.facebook.presto.server.security; | ||
|
|
||
| import com.facebook.airlift.log.Logger; | ||
| import com.facebook.presto.spi.security.PrestoAuthenticator; | ||
| import com.facebook.presto.spi.security.PrestoAuthenticatorFactory; | ||
| import com.google.common.annotations.VisibleForTesting; | ||
| import com.google.common.collect.ImmutableMap; | ||
|
|
||
| import javax.inject.Inject; | ||
|
|
||
| import java.io.File; | ||
| import java.util.HashMap; | ||
| import java.util.Map; | ||
| import java.util.concurrent.ConcurrentHashMap; | ||
| import java.util.concurrent.atomic.AtomicReference; | ||
|
|
||
| import static com.facebook.presto.util.PropertiesUtil.loadProperties; | ||
| import static com.google.common.base.Preconditions.checkArgument; | ||
| import static com.google.common.base.Preconditions.checkState; | ||
| import static com.google.common.base.Strings.isNullOrEmpty; | ||
| import static java.util.Objects.requireNonNull; | ||
|
|
||
| public class PrestoAuthenticatorManager | ||
| { | ||
| private static final Logger log = Logger.get(PrestoAuthenticatorManager.class); | ||
|
|
||
| private static final File CONFIG_FILE = new File("etc/presto-authenticator.properties"); | ||
| private static final String NAME_PROPERTY = "presto-authenticator.name"; | ||
|
|
||
| private final Map<String, PrestoAuthenticatorFactory> factories = new ConcurrentHashMap<>(); | ||
| private final AtomicReference<PrestoAuthenticator> authenticator = new AtomicReference<>(); | ||
| private final boolean customAuthenticatorRequested; | ||
|
|
||
| @Inject | ||
| public PrestoAuthenticatorManager(SecurityConfig securityConfig) | ||
| { | ||
| this.customAuthenticatorRequested = securityConfig.getAuthenticationTypes().contains(SecurityConfig.AuthenticationType.CUSTOM); | ||
| } | ||
|
|
||
| public void addPrestoAuthenticatorFactory(PrestoAuthenticatorFactory factory) | ||
| { | ||
| checkArgument(factories.putIfAbsent(factory.getName(), factory) == null, | ||
| "Presto authenticator '%s' is already registered", factory.getName()); | ||
| } | ||
|
|
||
| @VisibleForTesting | ||
| public void loadAuthenticator(String authenticatorName) | ||
| { | ||
| PrestoAuthenticatorFactory factory = factories.get(authenticatorName); | ||
|
|
||
| PrestoAuthenticator authenticator = factory.create(ImmutableMap.of()); | ||
| this.authenticator.set(requireNonNull(authenticator, "authenticator is null")); | ||
| } | ||
|
|
||
| public void loadPrestoAuthenticator() | ||
| throws Exception | ||
| { | ||
| if (!customAuthenticatorRequested) { | ||
| return; | ||
| } | ||
|
|
||
| File configFileLocation = CONFIG_FILE.getAbsoluteFile(); | ||
| Map<String, String> properties = new HashMap<>(loadProperties(configFileLocation)); | ||
|
|
||
| String name = properties.remove(NAME_PROPERTY); | ||
| checkArgument(!isNullOrEmpty(name), | ||
| "Presto authenticator configuration %s does not contain %s", configFileLocation, NAME_PROPERTY); | ||
|
|
||
| log.info("-- Loading Presto authenticator --"); | ||
|
|
||
| PrestoAuthenticatorFactory factory = factories.get(name); | ||
| checkState(factory != null, "Presto authenticator %s is not registered", name); | ||
|
|
||
| PrestoAuthenticator authenticator = factory.create(ImmutableMap.copyOf(properties)); | ||
| this.authenticator.set(requireNonNull(authenticator, "authenticator is null")); | ||
|
|
||
| log.info("-- Loaded Presto authenticator %s --", name); | ||
| } | ||
|
|
||
| public PrestoAuthenticator getAuthenticator() | ||
| { | ||
| checkState(authenticator.get() != null, "authenticator was not loaded"); | ||
| return authenticator.get(); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.