com.hortonworks.registries.auth.server

Class JWTAuthenticationHandler

java.lang.Object

com.hortonworks.registries.auth.server.JWTAuthenticationHandler

All Implemented Interfaces:

AuthenticationHandler

public class JWTAuthenticationHandler
extends java.lang.Object
implements AuthenticationHandler

The JWTAuthenticationHandler implements AuthenticationHandler to add WebSSO behavior for UIs. The expected SSO token is a JsonWebToken (JWT). The supported algorithm is RS256 which uses PKI between the token issuer and consumer. The flow requires a redirect to a configured authentication server URL and a subsequent request with the expected JWT token. This token is cryptographically verified and validated. The user identity is then extracted from the token and used to create an AuthenticationToken - as expected by the AuthenticationFilter.

The supported configuration properties are:

• authentication.provider.url: the full URL to the authentication server. This is the URL that the handler will redirect the browser to in order to authenticate the user. It does not have a default value.
• public.key.pem: This is the PEM formatted public key of the issuer of the JWT token. It is required for verifying that the issuer is a trusted party. DO NOT include the PEM header and footer portions of the PEM encoded certificate. It does not have a default value.
• expected.jwt.audiences: This is a list of strings that identify acceptable audiences for the JWT token. The audience is a way for the issuer to indicate what entity/s that the token is intended for. Default value is null which indicates that all audiences will be accepted.
• jwt.cookie.name: the name of the cookie that contains the JWT token. Default value is "hadoop-jwt".

Field Summary

Fields

Modifier and Type	Field and Description
static java.lang.String	AUTHENTICATION_PROVIDER_URL
static java.lang.String	EXPECTED_JWT_AUDIENCES
static java.lang.String	JWT_COOKIE_NAME
static java.lang.String	PUBLIC_KEY_PEM
static java.lang.String	TYPE

Fields inherited from interface com.hortonworks.registries.auth.server.AuthenticationHandler

JWT_SSO_ENABLED, NON_BROWSER_USER_AGENTS, NON_BROWSER_USER_AGENTS_DEFAULT, WWW_AUTHENTICATE

Constructor Summary

Constructors

Constructor and Description
JWTAuthenticationHandler()

Method Summary

Modifier and Type	Method and Description
AuthenticationToken	authenticate(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Performs an authentication step for the given HTTP client request.
void	destroy() Destroys the authentication handler instance.
protected java.lang.String	getJWTFromCookie(javax.servlet.http.HttpServletRequest req) Encapsulate the acquisition of the JWT token from HTTP cookies within the request.
java.lang.String	getType() Returns the authentication type of the authentication handler.
void	init(java.util.Properties config) Initializes the authentication handler instance.
void	setPublicKey(java.security.interfaces.RSAPublicKey pk) Primarily for testing, this provides a way to set the publicKey for signature verification without needing to get a PEM encoded value.
boolean	shouldAuthenticate(javax.servlet.http.HttpServletRequest request) Should the request be authenticated by the handler or not.
protected boolean	validateAudiences(com.nimbusds.jwt.SignedJWT jwtToken) Validate whether any of the accepted audience claims is present in the issued token claims list for audience.
protected boolean	validateExpiration(com.nimbusds.jwt.SignedJWT jwtToken) Validate that the expiration time of the JWT token has not been violated.
protected boolean	validateSignature(com.nimbusds.jwt.SignedJWT jwtToken) Verify the signature of the JWT token in this method.
protected boolean	validateToken(com.nimbusds.jwt.SignedJWT jwtToken) This method provides a single method for validating the JWT for use in request processing.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

TYPE

public static final java.lang.String TYPE

See Also:

Constant Field Values

AUTHENTICATION_PROVIDER_URL

public static final java.lang.String AUTHENTICATION_PROVIDER_URL

See Also:

Constant Field Values

PUBLIC_KEY_PEM

public static final java.lang.String PUBLIC_KEY_PEM

See Also:

Constant Field Values

EXPECTED_JWT_AUDIENCES

public static final java.lang.String EXPECTED_JWT_AUDIENCES

See Also:

Constant Field Values

JWT_COOKIE_NAME

public static final java.lang.String JWT_COOKIE_NAME

See Also:

Constant Field Values

Constructor Detail

JWTAuthenticationHandler

public JWTAuthenticationHandler()

Method Detail

setPublicKey

public void setPublicKey(java.security.interfaces.RSAPublicKey pk)

Primarily for testing, this provides a way to set the publicKey for signature verification without needing to get a PEM encoded value.

Parameters:

pk - publicKey for the token signtature verification

getType

public java.lang.String getType()

Description copied from interface: AuthenticationHandler

Returns the authentication type of the authentication handler. This should be a name that uniquely identifies the authentication type. For example 'simple' or 'kerberos'.

Specified by:

getType in interface AuthenticationHandler

Returns:

the authentication type of the authentication handler.

init

public void init(java.util.Properties config)
          throws javax.servlet.ServletException

Initializes the authentication handler instance.

This method is invoked by the AuthenticationFilter.init(javax.servlet.FilterConfig) method.

Specified by:

init in interface AuthenticationHandler

Parameters:

config - configuration properties to initialize the handler.

Throws:

javax.servlet.ServletException - thrown if the handler could not be initialized.

destroy

public void destroy()

Description copied from interface: AuthenticationHandler

Destroys the authentication handler instance.

This method is invoked by the AuthenticationFilter.destroy() method.

Specified by:

destroy in interface AuthenticationHandler

authenticate

public AuthenticationToken authenticate(javax.servlet.http.HttpServletRequest request,
                                        javax.servlet.http.HttpServletResponse response)
                                 throws java.io.IOException,
                                        AuthenticationException

Description copied from interface: AuthenticationHandler

Performs an authentication step for the given HTTP client request.

This method is invoked by the AuthenticationFilter only if the HTTP client request is not yet authenticated.

Depending upon the authentication mechanism being implemented, a particular HTTP client may end up making a sequence of invocations before authentication is successfully established (this is the case of Kerberos SPNEGO).

This method must return an AuthenticationToken only if the the HTTP client request has been successfully and fully authenticated.

If the HTTP client request has not been completely authenticated, this method must take over the corresponding HTTP response and it must return null.

Specified by:

authenticate in interface AuthenticationHandler

Parameters:

request - the HTTP client request.

response - the HTTP client response.

Returns:

an AuthenticationToken if the HTTP client request has been authenticated, null otherwise (in this case it must take care of the response).

Throws:

java.io.IOException - thrown if an IO error occurred.

AuthenticationException - thrown if an Authentication error occurred.

shouldAuthenticate

public boolean shouldAuthenticate(javax.servlet.http.HttpServletRequest request)

Description copied from interface: AuthenticationHandler

Should the request be authenticated by the handler or not.

This is useful for deciding if a request should be handled by this handler or just forwarded to the next filter in chain. For example, if it's a java client in a long running application then the SSO handler can decide to not authenticate it and pass it on to the next filter

If the method returns TRUE the request will have to go through this authentication handler

If the method returns FALSE the request is expected to be passed on to the next filter in the chain

Specified by:

shouldAuthenticate in interface AuthenticationHandler

Parameters:

request - the HTTP client request.

Returns:

TRUE if this request should be authenticated by the handler, FALSE otherwise.

getJWTFromCookie

protected java.lang.String getJWTFromCookie(javax.servlet.http.HttpServletRequest req)

Encapsulate the acquisition of the JWT token from HTTP cookies within the request.

Parameters:

req - servlet request to get the JWT token from

Returns:

serialized JWT token

validateToken

protected boolean validateToken(com.nimbusds.jwt.SignedJWT jwtToken)

This method provides a single method for validating the JWT for use in request processing. It provides for the override of specific aspects of this implementation through submethods used within but also allows for the override of the entire token validation algorithm.

Parameters:

jwtToken - the token to validate

Returns:

true if valid

validateSignature

protected boolean validateSignature(com.nimbusds.jwt.SignedJWT jwtToken)

Verify the signature of the JWT token in this method. This method depends on the public key that was established during init based upon the provisioned public key. Override this method in subclasses in order to customize the signature verification behavior.

Parameters:

jwtToken - the token that contains the signature to be validated

Returns:

valid true if signature verifies successfully; false otherwise

validateAudiences

protected boolean validateAudiences(com.nimbusds.jwt.SignedJWT jwtToken)

Validate whether any of the accepted audience claims is present in the issued token claims list for audience. Override this method in subclasses in order to customize the audience validation behavior.

Parameters:

jwtToken - the JWT token where the allowed audiences will be found

Returns:

true if an expected audience is present, otherwise false

validateExpiration

protected boolean validateExpiration(com.nimbusds.jwt.SignedJWT jwtToken)

Validate that the expiration time of the JWT token has not been violated. If it has then throw an AuthenticationException. Override this method in subclasses in order to customize the expiration validation behavior.

Parameters:

jwtToken - the token that contains the expiration date to validate

Returns:

valid true if the token has not expired; false otherwise