com.hortonworks.registries.auth.server

Class AltKerberosAuthenticationHandler

java.lang.Object

com.hortonworks.registries.auth.server.KerberosAuthenticationHandler

com.hortonworks.registries.auth.server.AltKerberosAuthenticationHandler

All Implemented Interfaces:

AuthenticationHandler

public abstract class AltKerberosAuthenticationHandler
extends KerberosAuthenticationHandler

The AltKerberosAuthenticationHandler behaves exactly the same way as the KerberosAuthenticationHandler, except that it allows for an alternative form of authentication for browsers while still using Kerberos for Java access. This is an abstract class that should be subclassed to allow a developer to implement their own custom authentication for browser access. The alternateAuthenticate method will be called whenever a request comes from a browser.

Field Summary

Fields

Modifier and Type	Field and Description
static java.lang.String	NON_BROWSER_USER_AGENTS Constant for the configuration property that indicates which user agents are not considered browsers (comma separated)
static java.lang.String	TYPE Constant that identifies the authentication mechanism.

Fields inherited from class com.hortonworks.registries.auth.server.KerberosAuthenticationHandler

DOAS_QUERY_STRING, ENABLE_TRUSTED_PROXY, KEYTAB, LOAD_BALANCER_PRINCIPAL, NAME_RULES, PRINCIPAL, QUERY_STRING_DELIMITER

Fields inherited from interface com.hortonworks.registries.auth.server.AuthenticationHandler

JWT_SSO_ENABLED, WWW_AUTHENTICATE

Constructor Summary

Constructors

Constructor and Description
AltKerberosAuthenticationHandler()

Method Summary

Modifier and Type	Method and Description
abstract AuthenticationToken	alternateAuthenticate(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Subclasses should implement this method to provide the custom authentication to be used for browsers.
AuthenticationToken	authenticate(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) It enforces the Kerberos SPNEGO authentication sequence returning an AuthenticationToken only after the Kerberos SPNEGO sequence has completed successfully (in the case of Java access) and only after the custom authentication implemented by the subclass in alternateAuthenticate has completed successfully (in the case of browser access).
java.lang.String	getType() Returns the authentication type of the authentication handler, 'alt-kerberos'.
void	init(java.util.Properties config) Initializes the authentication handler instance.

Methods inherited from class com.hortonworks.registries.auth.server.KerberosAuthenticationHandler

destroy, getDoasUser, getKeytab, getPrincipals, setNonBrowserUserAgents, shouldAuthenticate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

TYPE

public static final java.lang.String TYPE

Constant that identifies the authentication mechanism.

See Also:

Constant Field Values

NON_BROWSER_USER_AGENTS

public static final java.lang.String NON_BROWSER_USER_AGENTS

Constant for the configuration property that indicates which user agents are not considered browsers (comma separated)

See Also:

Constant Field Values

Constructor Detail

AltKerberosAuthenticationHandler

public AltKerberosAuthenticationHandler()

Method Detail

getType

public java.lang.String getType()

Returns the authentication type of the authentication handler, 'alt-kerberos'.

Specified by:

getType in interface AuthenticationHandler

Overrides:

getType in class KerberosAuthenticationHandler

Returns:

the authentication type of the authentication handler, 'alt-kerberos'.

init

public void init(java.util.Properties config)
          throws javax.servlet.ServletException

Description copied from class: KerberosAuthenticationHandler

Initializes the authentication handler instance.

It creates a Kerberos context using the principal and keytab specified in the configuration.

This method is invoked by the AuthenticationFilter.init(javax.servlet.FilterConfig) method.

Specified by:

init in interface AuthenticationHandler

Overrides:

init in class KerberosAuthenticationHandler

Parameters:

config - configuration properties to initialize the handler.

Throws:

javax.servlet.ServletException - thrown if the handler could not be initialized.

authenticate

public AuthenticationToken authenticate(javax.servlet.http.HttpServletRequest request,
                                        javax.servlet.http.HttpServletResponse response)
                                 throws java.io.IOException,
                                        AuthenticationException

It enforces the Kerberos SPNEGO authentication sequence returning an AuthenticationToken only after the Kerberos SPNEGO sequence has completed successfully (in the case of Java access) and only after the custom authentication implemented by the subclass in alternateAuthenticate has completed successfully (in the case of browser access).

Specified by:

authenticate in interface AuthenticationHandler

Overrides:

authenticate in class KerberosAuthenticationHandler

Parameters:

request - the HTTP client request.

response - the HTTP client response.

Returns:

an authentication token if the request is authorized or null

Throws:

java.io.IOException - thrown if an IO error occurred

AuthenticationException - thrown if an authentication error occurred

alternateAuthenticate

public abstract AuthenticationToken alternateAuthenticate(javax.servlet.http.HttpServletRequest request,
                                                          javax.servlet.http.HttpServletResponse response)
                                                   throws java.io.IOException,
                                                          AuthenticationException

Subclasses should implement this method to provide the custom authentication to be used for browsers.

Parameters:

request - the HTTP client request.

response - the HTTP client response.

Returns:

an authentication token if the request is authorized, or null

Throws:

java.io.IOException - thrown if an IO error occurs

AuthenticationException - thrown if an authentication error occurs