org.apache.solr.servlet

Class SolrHadoopAuthenticationFilter

java.lang.Object

org.apache.hadoop.security.authentication.server.AuthenticationFilter

org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticationFilter

org.apache.solr.servlet.SolrHadoopAuthenticationFilter

All Implemented Interfaces:

javax.servlet.Filter

public class SolrHadoopAuthenticationFilter
extends org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticationFilter

Authentication filter that extends Hadoop-auth AuthenticationFilter to override the configuration loading.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
protected static class	SolrHadoopAuthenticationFilter.SolrZkToCuratorCredentialsACLs Convert Solr Zk Credentials/ACLs to Curator versions

Field Summary

Fields

Modifier and Type	Field and Description
static String	DO_AS_PARAM Http param for requesting ProxyUser support.
static String	SOLR_PREFIX
static String	SOLR_PROXYUSER_PREFIX
static String	TOKEN_KIND Delegation token kind
static String	USER_NAME Request attribute constant for the user name.

Fields inherited from class org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticationFilter

DELEGATION_TOKEN_SECRET_MANAGER_ATTR, PROXYUSER_PREFIX

Fields inherited from class org.apache.hadoop.security.authentication.server.AuthenticationFilter

AUTH_TOKEN_VALIDITY, AUTH_TYPE, CONFIG_PREFIX, COOKIE_DOMAIN, COOKIE_PATH, COOKIE_PERSISTENT, SIGNATURE_SECRET, SIGNATURE_SECRET_FILE, SIGNER_SECRET_PROVIDER, SIGNER_SECRET_PROVIDER_ATTRIBUTE

Constructor Summary

Constructors

Constructor and Description
SolrHadoopAuthenticationFilter()

Method Summary

Methods

Modifier and Type	Method and Description
void	destroy() Destroy the filter.
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain filterChain) Enforces authentication using Hadoop-auth AuthenticationFilter.
protected Properties	getConfiguration(String configPrefix, javax.servlet.FilterConfig filterConfig) Returns the System properties to be used by the authentication filter.
protected org.apache.curator.framework.CuratorFramework	getCuratorClient(int connectionTimeoutMs, int sessionTimeoutMs)
protected org.apache.hadoop.conf.Configuration	getProxyuserConfiguration(javax.servlet.FilterConfig filterConfig) Return the ProxyUser Configuration.
protected org.apache.hadoop.security.authentication.server.AuthenticationToken	getToken(javax.servlet.http.HttpServletRequest request) This method is overridden to incorporate MultiSchemeAuthenticationHandler in Solr.
void	init(javax.servlet.FilterConfig filterConfig) Initialize the filter.
protected void	setDefaultDelegationTokenProp(Properties properties, String name, String value)

Methods inherited from class org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticationFilter

doFilter, initializeAuthHandler, setAuthHandlerClass, setHandlerAuthMethod

Methods inherited from class org.apache.hadoop.security.authentication.server.AuthenticationFilter

constructSecretProvider, createAuthCookie, getAuthenticationHandler, getConfiguration, getCookieDomain, getCookiePath, getRequestURL, getValidity, initializeSecretProvider, isCookiePersistent, isCustomSignerSecretProvider, isRandomSecret

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

SOLR_PREFIX

public static final String SOLR_PREFIX

See Also:

Constant Field Values

SOLR_PROXYUSER_PREFIX

public static final String SOLR_PROXYUSER_PREFIX

See Also:

Constant Field Values

USER_NAME

public static final String USER_NAME

Request attribute constant for the user name.

See Also:

Constant Field Values

DO_AS_PARAM

public static final String DO_AS_PARAM

Http param for requesting ProxyUser support.

See Also:

Constant Field Values

TOKEN_KIND

public static final String TOKEN_KIND

Delegation token kind

See Also:

Constant Field Values

Constructor Detail

SolrHadoopAuthenticationFilter

public SolrHadoopAuthenticationFilter()

Method Detail

init

public void init(javax.servlet.FilterConfig filterConfig)
          throws javax.servlet.ServletException

Initialize the filter.

Specified by:

init in interface javax.servlet.Filter

Overrides:

init in class org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticationFilter

Parameters:

filterConfig - filter configuration.

Throws:

javax.servlet.ServletException - thrown if the filter could not be initialized.

destroy

public void destroy()

Destroy the filter.

Specified by:

destroy in interface javax.servlet.Filter

Overrides:

destroy in class org.apache.hadoop.security.authentication.server.AuthenticationFilter

getProxyuserConfiguration

protected org.apache.hadoop.conf.Configuration getProxyuserConfiguration(javax.servlet.FilterConfig filterConfig)
                                                                  throws javax.servlet.ServletException

Return the ProxyUser Configuration. System properties beginning with {#SOLR_PROXYUSER_PREFIX} will be added to the configuration.

Overrides:

getProxyuserConfiguration in class org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticationFilter

Throws:

javax.servlet.ServletException

setDefaultDelegationTokenProp

protected void setDefaultDelegationTokenProp(Properties properties,
                                 String name,
                                 String value)

getCuratorClient

protected org.apache.curator.framework.CuratorFramework getCuratorClient(int connectionTimeoutMs,
                                                             int sessionTimeoutMs)
                                                                  throws javax.servlet.ServletException

Throws:

javax.servlet.ServletException

getConfiguration

protected Properties getConfiguration(String configPrefix,
                          javax.servlet.FilterConfig filterConfig)

Returns the System properties to be used by the authentication filter.

All properties from the System properties with names that starts with SOLR_PREFIX will be returned. The keys of the returned properties are trimmed from the SOLR_PREFIX prefix, for example the property name 'solr.authentication.type' will be just 'type'.

Overrides:

getConfiguration in class org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticationFilter

Parameters:

configPrefix - configuration prefix, this parameter is ignored by this implementation.

filterConfig - filter configuration, this parameter is ignored by this implementation.

Returns:

all System properties prefixed with SOLR_PREFIX, without the prefix.

doFilter

public void doFilter(javax.servlet.ServletRequest request,
            javax.servlet.ServletResponse response,
            javax.servlet.FilterChain filterChain)
              throws IOException,
                     javax.servlet.ServletException

Enforces authentication using Hadoop-auth AuthenticationFilter.

Specified by:

doFilter in interface javax.servlet.Filter

Overrides:

doFilter in class org.apache.hadoop.security.authentication.server.AuthenticationFilter

Parameters:

request - http request.

response - http response.

filterChain - filter chain.

Throws:

IOException - thrown if an IO error occurs.

javax.servlet.ServletException - thrown if a servlet error occurs.

getToken

protected org.apache.hadoop.security.authentication.server.AuthenticationToken getToken(javax.servlet.http.HttpServletRequest request)
                                                                                 throws IOException,
                                                                                        org.apache.hadoop.security.authentication.client.AuthenticationException

This method is overridden to incorporate MultiSchemeAuthenticationHandler in Solr. With MultiSchemeAuthenticationHandler the value of the 'type' attribute in the AuthenticationToken does not match the MultiSchemeAuthenticationHandler.TYPE (as expected by the super-class implementation). Instead this value would match the actual type of authentication mechanism being used (e.g. LdapAuthenticationHandler.TYPE or KerberosAuthenticationHandler.TYPE. This implementation extracts the value(s) of actual authentication mechanisms configured (e.g. ldap or kerberos) and use them to match the token type. It requires a private variable declared in the superclass - signer. This variable is extracted using Java reflection mechanism during the startup.

Overrides:

getToken in class org.apache.hadoop.security.authentication.server.AuthenticationFilter

Throws:

IOException

org.apache.hadoop.security.authentication.client.AuthenticationException