From commits-return-19020-archive-asf-public=cust-asf.ponee.io@pulsar.apache.org Thu Dec 13 16:26:23 2018 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by mx-eu-01.ponee.io (Postfix) with SMTP id EE3B1180676 for ; Thu, 13 Dec 2018 16:26:22 +0100 (CET) Received: (qmail 44792 invoked by uid 500); 13 Dec 2018 15:26:22 -0000 Mailing-List: contact commits-help@pulsar.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@pulsar.apache.org Delivered-To: mailing list commits@pulsar.apache.org Received: (qmail 44783 invoked by uid 99); 13 Dec 2018 15:26:22 -0000 Received: from ec2-52-202-80-70.compute-1.amazonaws.com (HELO gitbox.apache.org) (52.202.80.70) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 13 Dec 2018 15:26:22 +0000 From: GitBox To: commits@pulsar.apache.org Subject: [GitHub] sijie closed pull request #3187: Enable specifying allowed offset when verifying athenz role token Message-ID: <154471478151.13907.4698522967273048242.gitbox@gitbox.apache.org> Date: Thu, 13 Dec 2018 15:26:21 -0000 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit sijie closed pull request #3187: Enable specifying allowed offset when verifying athenz role token URL: https://github.com/apache/pulsar/pull/3187 This is a PR merged from a forked repository. As GitHub hides the original diff on merge, it is displayed below for the sake of provenance: As this is a foreign pull request (from a fork), the diff is supplied below (as it won't show otherwise due to GitHub magic): diff --git a/pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java b/pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java index c2cf45da15..955a96d3a0 100644 --- a/pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java +++ b/pulsar-broker-auth-athenz/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenz.java @@ -31,6 +31,7 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import com.google.common.annotations.VisibleForTesting; import com.google.common.collect.Lists; import com.yahoo.athenz.auth.token.RoleToken; import com.yahoo.athenz.zpe.AuthZpeClient; @@ -41,8 +42,10 @@ private static final String DOMAIN_NAME_LIST = "athenzDomainNames"; private static final String SYS_PROP_DOMAIN_NAME_LIST = "pulsar.athenz.domain.names"; + private static final String SYS_PROP_ALLOWED_OFFSET = "pulsar.athenz.role.token_allowed_offset"; private List domainNameList = null; + private int allowedOffset = 30; @Override public void initialize(ServiceConfiguration config) throws IOException { @@ -57,6 +60,20 @@ public void initialize(ServiceConfiguration config) throws IOException { domainNameList = Lists.newArrayList(domainNames.split(",")); log.info("Supported domain names for athenz: {}", domainNameList); + + if (!StringUtils.isEmpty(System.getProperty(SYS_PROP_ALLOWED_OFFSET))) { + try { + allowedOffset = Integer.parseInt(System.getProperty(SYS_PROP_ALLOWED_OFFSET)); + } catch (NumberFormatException e) { + throw new IOException("Invalid allowed offset for athenz role token verification specified", e); + } + + if (allowedOffset < 0) { + throw new IOException("Allowed offset for athenz role token verification must not be negative"); + } + } + + log.info("Allowed offset for athenz role token verification: {} sec", allowedOffset); } @Override @@ -103,7 +120,6 @@ public String authenticate(AuthenticationDataSource authData) throws Authenticat // Synchronize for non-thread safe static calls inside athenz library synchronized (this) { PublicKey ztsPublicKey = AuthZpeClient.getZtsPublicKey(token.getKeyId()); - int allowedOffset = 0; if (ztsPublicKey == null) { throw new AuthenticationException("Unable to retrieve ZTS Public Key"); @@ -123,5 +139,10 @@ public String authenticate(AuthenticationDataSource authData) throws Authenticat public void close() throws IOException { } + @VisibleForTesting + int getAllowedOffset() { + return this.allowedOffset; + } + private static final Logger log = LoggerFactory.getLogger(AuthenticationProviderAthenz.class); } diff --git a/pulsar-broker-auth-athenz/src/test/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenzTest.java b/pulsar-broker-auth-athenz/src/test/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenzTest.java index 1946a014e7..b56021bb69 100644 --- a/pulsar-broker-auth-athenz/src/test/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenzTest.java +++ b/pulsar-broker-auth-athenz/src/test/java/org/apache/pulsar/broker/authentication/AuthenticationProviderAthenzTest.java @@ -29,6 +29,7 @@ import org.apache.pulsar.broker.authentication.AuthenticationDataSource; import org.apache.pulsar.broker.authentication.AuthenticationProviderAthenz; +import java.io.IOException; import java.util.ArrayList; import java.util.List; import java.util.Properties; @@ -70,12 +71,38 @@ public void testInitilizeFromSystemPropeties() { ServiceConfiguration emptyConf = new ServiceConfiguration(); Properties emptyProp = new Properties(); emptyConf.setProperties(emptyProp); - AuthenticationProviderAthenz sysPropProvider = new AuthenticationProviderAthenz(); + AuthenticationProviderAthenz sysPropProvider1 = new AuthenticationProviderAthenz(); try { - sysPropProvider.initialize(emptyConf); + sysPropProvider1.initialize(emptyConf); + assertEquals(sysPropProvider1.getAllowedOffset(), 30); // default allowed offset is 30 sec } catch (Exception e) { fail("Fail to Read pulsar.athenz.domain.names from System Properties"); } + + System.setProperty("pulsar.athenz.role.token_allowed_offset", "0"); + AuthenticationProviderAthenz sysPropProvider2 = new AuthenticationProviderAthenz(); + try { + sysPropProvider2.initialize(config); + assertEquals(sysPropProvider2.getAllowedOffset(), 0); + } catch (Exception e) { + fail("Failed to get allowd offset from system property"); + } + + System.setProperty("pulsar.athenz.role.token_allowed_offset", "invalid"); + AuthenticationProviderAthenz sysPropProvider3 = new AuthenticationProviderAthenz(); + try { + sysPropProvider3.initialize(config); + fail("Invalid allowed offset should not be specified"); + } catch (IOException e) { + } + + System.setProperty("pulsar.athenz.role.token_allowed_offset", "-1"); + AuthenticationProviderAthenz sysPropProvider4 = new AuthenticationProviderAthenz(); + try { + sysPropProvider4.initialize(config); + fail("Negative allowed offset should not be specified"); + } catch (IOException e) { + } } @Test @@ -133,4 +160,4 @@ public void testAuthenticateSignedTokenWithDifferentDomain() throws Exception { // OK, expected } } -} \ No newline at end of file +} ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: users@infra.apache.org With regards, Apache Git Services