Skip to content

Commit 74b04ec

Browse files
ydodeja365ydodeja365
committed
HBASE-27693 Support for Hadoop's LDAP Authentication mechanism
1 parent 735fb43 commit 74b04ec

File tree

3 files changed

+234
-0
lines changed

3 files changed

+234
-0
lines changed

‎hbase-http/src/main/java/org/apache/hadoop/hbase/http/AuthenticationFilterInitializer.java‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
/**
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
package org.apache.hadoop.hbase.http;
19+
20+
import org.apache.hadoop.hbase.HBaseInterfaceAudience;
21+
import org.apache.hadoop.security.authentication.server.AuthenticationFilter;
22+
import org.apache.hadoop.conf.Configuration;
23+
import org.apache.hadoop.security.authentication.server.KerberosAuthenticationHandler;
24+
import org.apache.hadoop.security.SecurityUtil;
25+
import org.apache.yetus.audience.InterfaceAudience;
26+
27+
import java.io.IOException;
28+
import java.util.HashMap;
29+
import java.util.Map;
30+
31+
/**
32+
* Initializes hadoop-auth AuthenticationFilter which provides support for
33+
* Kerberos HTTP SPNEGO authentication.
34+
* <p>
35+
* It enables anonymous access, simple/pseudo and Kerberos HTTP SPNEGO
36+
* authentication for Hadoop JobTracker, NameNode, DataNodes and
37+
* TaskTrackers.
38+
* <p>
39+
* Refer to the <code>core-default.xml</code> file, after the comment
40+
* 'HTTP Authentication' for details on the configuration options.
41+
* All related configuration properties have 'hadoop.http.authentication.'
42+
* as prefix.
43+
*/
44+
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.CONFIG)
45+
public class AuthenticationFilterInitializer extends FilterInitializer {
46+
47+
static final String PREFIX = "hadoop.http.authentication.";
48+
49+
/**
50+
* Initializes hadoop-auth AuthenticationFilter.
51+
* <p>
52+
* Propagates to hadoop-auth AuthenticationFilter configuration all Hadoop
53+
* configuration properties prefixed with "hadoop.http.authentication."
54+
*
55+
* @param container The filter container
56+
* @param conf Configuration for run-time parameters
57+
*/
58+
@Override
59+
public void initFilter(FilterContainer container, Configuration conf) {
60+
Map<String, String> filterConfig = getFilterConfigMap(conf, PREFIX);
61+
62+
container.addFilter("authentication",
63+
AuthenticationFilter.class.getName(),
64+
filterConfig);
65+
}
66+
67+
public static Map<String, String> getFilterConfigMap(Configuration conf,
68+
String prefix) {
69+
Map<String, String> filterConfig = new HashMap<String, String>();
70+
71+
//setting the cookie path to root '/' so it is used for all resources.
72+
filterConfig.put(AuthenticationFilter.COOKIE_PATH, "/");
73+
Map<String, String> propsWithPrefix = conf.getPropsWithPrefix(prefix);
74+
75+
for (Map.Entry<String, String> entry : propsWithPrefix.entrySet()) {
76+
filterConfig.put(entry.getKey(), entry.getValue());
77+
}
78+
79+
//Resolve _HOST into bind address
80+
String bindAddress = conf.get(HttpServer.BIND_ADDRESS);
81+
String principal = filterConfig.get(KerberosAuthenticationHandler.PRINCIPAL);
82+
if (principal != null) {
83+
try {
84+
principal = SecurityUtil.getServerPrincipal(principal, bindAddress);
85+
}
86+
catch (IOException ex) {
87+
throw new RuntimeException("Could not resolve Kerberos principal name: " + ex.toString(), ex);
88+
}
89+
filterConfig.put(KerberosAuthenticationHandler.PRINCIPAL, principal);
90+
}
91+
return filterConfig;
92+
}
93+
94+
}

‎hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestAuthenticationFilterInitializer.java‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
/**
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with this
4+
* work for additional information regarding copyright ownership. The ASF
5+
* licenses this file to you under the Apache License, Version 2.0 (the
6+
* "License"); you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
* License for the specific language governing permissions and limitations under
15+
* the License.
16+
*/
17+
package org.apache.hadoop.hbase.http;
18+
19+
20+
import static org.junit.Assert.*;
21+
import static org.mockito.ArgumentMatchers.any;
22+
23+
import org.apache.hadoop.hbase.HBaseClassTestRule;
24+
import org.apache.hadoop.hbase.testclassification.MiscTests;
25+
import org.apache.hadoop.hbase.testclassification.SmallTests;
26+
import org.apache.hadoop.security.authentication.server.AuthenticationFilter;
27+
import org.apache.hadoop.conf.Configuration;
28+
import org.junit.ClassRule;
29+
import org.junit.Test;
30+
import org.junit.experimental.categories.Category;
31+
import org.mockito.Mockito;
32+
import org.mockito.invocation.InvocationOnMock;
33+
import org.mockito.stubbing.Answer;
34+
35+
import java.util.Map;
36+
37+
@Category({ MiscTests.class, SmallTests.class })
38+
public class TestAuthenticationFilterInitializer {
39+
@ClassRule
40+
public static final HBaseClassTestRule CLASS_RULE =
41+
HBaseClassTestRule.forClass(TestAuthenticationFilterInitializer.class);
42+
43+
@Test
44+
public void testConfiguration() throws Exception {
45+
Configuration conf = new Configuration();
46+
conf.set("hadoop.http.authentication.foo", "bar");
47+
48+
conf.set(HttpServer.BIND_ADDRESS, "barhost");
49+
50+
FilterContainer container = Mockito.mock(FilterContainer.class);
51+
Mockito.doAnswer(
52+
new Answer() {
53+
@Override
54+
public Object answer(InvocationOnMock invocationOnMock)
55+
throws Throwable {
56+
Object[] args = invocationOnMock.getArguments();
57+
58+
assertEquals("authentication", args[0]);
59+
60+
assertEquals(AuthenticationFilter.class.getName(), args[1]);
61+
62+
Map<String, String> conf = (Map<String, String>) args[2];
63+
assertEquals("/", conf.get("cookie.path"));
64+
65+
assertEquals("simple", conf.get("type"));
66+
assertEquals("36000", conf.get("token.validity"));
67+
assertNull(conf.get("cookie.domain"));
68+
assertEquals("true", conf.get("simple.anonymous.allowed"));
69+
assertEquals("HTTP/barhost@LOCALHOST",
70+
conf.get("kerberos.principal"));
71+
assertEquals(System.getProperty("user.home") +
72+
"/hadoop.keytab", conf.get("kerberos.keytab"));
73+
assertEquals("bar", conf.get("foo"));
74+
75+
return null;
76+
}
77+
}).when(container).addFilter(any(), any(), any());
78+
79+
new AuthenticationFilterInitializer().initFilter(container, conf);
80+
}
81+
82+
}

‎src/main/asciidoc/_chapters/security.adoc‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,64 @@ non-sensitive endpoints in the Web UI.
185185

186186
If it doesn't go without saying: non-authenticated users cannot access any part of the Web UI.
187187

188+
[[hbase.secure.ldap.ui]]
189+
=== Using LDAP authentication with Web UIs
190+
191+
LDAP authentication to HBase Web UIs can be enabled via configuring LDAP with the `hbase.security.authentication.ui`
192+
property in _hbase-site.xml_. The `hbase.http.filter.initializers` property also needs to have the `AuthenticationFilterInitializer` class.
193+
194+
*IMPORTANT:* A LDAP server must be configured and running. When TLS is enabled for communication with LDAP server (either via ldaps scheme or ‘start TLS’ extension), configure the public certificate of the LDAP server in the local truststore.
195+
The LDAP authentication mechanism uses HTTP Basic authentication scheme to verify user specified credentials against a configured LDAP (or Active Directory) server. The authentication filter must be configured with the following init parameters:
196+
197+
[source,xml]
198+
----
199+
<property>
200+
<name>hbase.security.authentication.ui</name>
201+
<value>ldap</value>
202+
<description>Controls what kind of authentication should be used for the HBase web UIs.</description>
203+
</property>
204+
<property>
205+
<name>hbase.http.filter.initializers</name>
206+
<value>org.apache.hadoop.hbase.http.AuthenticationFilterInitializer</value>
207+
<description>Comma separated class names corresponding to the Filters that will be initialized.
208+
Then, the Filters will be applied to all user facing jsp and servlet web pages.</description>
209+
</property>
210+
<property>
211+
<name>hadoop.http.authentication.type</name>
212+
<value>ldap</value>
213+
<description>Defines authentication used for the HTTP web-consoles in Hadoop ecosystem.</description>
214+
</property>
215+
----
216+
217+
A number of properties exist to configure LDAP authentication for the web server:
218+
219+
[source,xml]
220+
----
221+
<property>
222+
<name>hadoop.http.authentication.ldap.binddomain</name>
223+
<value>EXAMPLE.COM</value>
224+
<description>The LDAP bind domain value to be used with the LDAP server. This property is optional
225+
and useful only in case of Active Directory server (e.g. example.com).</description>
226+
</property>
227+
<property>
228+
<name>hadoop.http.authentication.ldap.providerurl</name>
229+
<value>ldap://ldap-server-host:8920</value>
230+
<description>The url of the LDAP server.</description>
231+
</property>
232+
<property>
233+
<name>hadoop.http.authentication.ldap.enablestarttls</name>
234+
<value>false</value>
235+
<description>A boolean value used to define if the LDAP server supports ‘StartTLS’ extension.</description>
236+
</property>
237+
<property>
238+
<name>hadoop.http.authentication.ldap.basedn</name>
239+
<value>ou=users,dc=example,dc=com</value>
240+
<description>The base distinguished name (DN) to be used with the LDAP server. This value is
241+
appended to the provided user id for authentication purpose. This property is not useful in case
242+
of Active Directory server.</description>
243+
</property>
244+
----
245+
188246
=== Other UI security-related configuration
189247

190248
While it is a clear anti-pattern for HBase developers, the developers acknowledge that the HBase

0 commit comments

Comments
 (0)