Skip to content

[Backport] Remove Escalator jetty http client escalation method (#5322) #5348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jon-wei merged 1 commit into from
Feb 5, 2018
Merged

[Backport] Remove Escalator jetty http client escalation method (#5322) #5348

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 0 additions & 52 deletions ...sic-security/src/main/java/io/druid/security/basic/authentication/BasicHTTPEscalator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,21 +22,11 @@
import com.fasterxml.jackson.annotation.JsonCreator;
import com.fasterxml.jackson.annotation.JsonProperty;
import com.fasterxml.jackson.annotation.JsonTypeName;
import com.google.common.base.Throwables;
import com.metamx.http.client.CredentialedHttpClient;
import com.metamx.http.client.HttpClient;
import com.metamx.http.client.auth.BasicCredentials;
import io.druid.java.util.common.StringUtils;
import io.druid.security.basic.BasicAuthUtils;
import io.druid.server.security.AuthenticationResult;
import io.druid.server.security.Escalator;
import org.eclipse.jetty.client.api.Authentication;
import org.eclipse.jetty.client.api.ContentResponse;
import org.eclipse.jetty.client.api.Request;
import org.eclipse.jetty.util.Attributes;
import org.jboss.netty.handler.codec.http.HttpHeaders;

import java.net.URI;

@JsonTypeName("basic")
public class BasicHTTPEscalator implements Escalator
Expand Down Expand Up @@ -66,48 +56,6 @@ public HttpClient createEscalatedClient(HttpClient baseClient)
);
}

@Override
public org.eclipse.jetty.client.HttpClient createEscalatedJettyClient(org.eclipse.jetty.client.HttpClient baseClient)
{
baseClient.getAuthenticationStore().addAuthentication(new Authentication()
{
@Override
public boolean matches(String type, URI uri, String realm)
{
return true;
}

@Override
public Result authenticate(
final Request request, ContentResponse response, Authentication.HeaderInfo headerInfo, Attributes context
)
{
return new Result()
{
@Override
public URI getURI()
{
return request.getURI();
}

@Override
public void apply(Request request)
{
try {
final String unencodedCreds = StringUtils.format("%s:%s", internalClientUsername, internalClientPassword);
final String base64Creds = BasicAuthUtils.getEncodedCredentials(unencodedCreds);
request.getHeaders().add(HttpHeaders.Names.AUTHORIZATION, "Basic " + base64Creds);
}
catch (Throwable e) {
Throwables.propagate(e);
}
}
};
}
});
return baseClient;
}

@Override
public AuthenticationResult createEscalatedAuthenticationResult()
{
Expand Down
72 changes: 0 additions & 72 deletions ...sions-core/druid-kerberos/src/main/java/io/druid/security/kerberos/KerberosEscalator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,20 +22,10 @@
import com.fasterxml.jackson.annotation.JsonCreator;
import com.fasterxml.jackson.annotation.JsonProperty;
import com.fasterxml.jackson.annotation.JsonTypeName;
import com.google.common.base.Throwables;
import com.metamx.http.client.HttpClient;
import io.druid.java.util.common.logger.Logger;
import io.druid.server.security.AuthenticationResult;
import io.druid.server.security.Escalator;
import org.apache.hadoop.security.UserGroupInformation;
import org.eclipse.jetty.client.api.Authentication;
import org.eclipse.jetty.client.api.ContentResponse;
import org.eclipse.jetty.client.api.Request;
import org.eclipse.jetty.util.Attributes;
import org.jboss.netty.handler.codec.http.HttpHeaders;

import java.net.URI;
import java.security.PrivilegedExceptionAction;

@JsonTypeName("kerberos")
public class KerberosEscalator implements Escalator
Expand Down Expand Up @@ -64,68 +54,6 @@ public HttpClient createEscalatedClient(HttpClient baseClient)
return new KerberosHttpClient(baseClient, internalClientPrincipal, internalClientKeytab);
}

@Override
public org.eclipse.jetty.client.HttpClient createEscalatedJettyClient(org.eclipse.jetty.client.HttpClient baseClient)
{
baseClient.getAuthenticationStore().addAuthentication(new Authentication()
{
@Override
public boolean matches(String type, URI uri, String realm)
{
return true;
}

@Override
public Result authenticate(
final Request request, ContentResponse response, Authentication.HeaderInfo headerInfo, Attributes context
)
{
return new Result()
{
@Override
public URI getURI()
{
return request.getURI();
}

@Override
public void apply(Request request)
{
try {
// No need to set cookies as they are handled by Jetty Http Client itself.
URI uri = request.getURI();
if (DruidKerberosUtil.needToSendCredentials(baseClient.getCookieStore(), uri)) {
log.debug(
"No Auth Cookie found for URI[%s]. Existing Cookies[%s] Authenticating... ",
uri,
baseClient.getCookieStore().getCookies()
);
final String host = request.getHost();
DruidKerberosUtil.authenticateIfRequired(internalClientPrincipal, internalClientKeytab);
UserGroupInformation currentUser = UserGroupInformation.getCurrentUser();
String challenge = currentUser.doAs(new PrivilegedExceptionAction<String>()
{
@Override
public String run() throws Exception
{
return DruidKerberosUtil.kerberosChallenge(host);
}
});
request.getHeaders().add(HttpHeaders.Names.AUTHORIZATION, "Negotiate " + challenge);
} else {
log.debug("Found Auth Cookie found for URI[%s].", uri);
}
}
catch (Throwable e) {
Throwables.propagate(e);
}
}
};
}
});
return baseClient;
}

@Override
public AuthenticationResult createEscalatedAuthenticationResult()
{
Expand Down
17 changes: 8 additions & 9 deletions server/src/main/java/io/druid/server/AsyncQueryForwardingServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,6 @@
import io.druid.server.router.QueryHostFinder;
import io.druid.server.router.Router;
import io.druid.server.security.AuthConfig;
import io.druid.server.security.Escalator;
import org.apache.http.client.utils.URIBuilder;
import org.eclipse.jetty.client.HttpClient;
import org.eclipse.jetty.client.api.Request;
Expand Down Expand Up @@ -112,7 +111,6 @@ private static void handleException(HttpServletResponse response, ObjectMapper o
private final ServiceEmitter emitter;
private final RequestLogger requestLogger;
private final GenericQueryMetricsFactory queryMetricsFactory;
private final Escalator escalator;

private HttpClient broadcastClient;

Expand All @@ -126,8 +124,7 @@ public AsyncQueryForwardingServlet(
@Router DruidHttpClientConfig httpClientConfig,
ServiceEmitter emitter,
RequestLogger requestLogger,
GenericQueryMetricsFactory queryMetricsFactory,
Escalator escalator
GenericQueryMetricsFactory queryMetricsFactory
)
{
this.warehouse = warehouse;
Expand All @@ -139,7 +136,6 @@ public AsyncQueryForwardingServlet(
this.emitter = emitter;
this.requestLogger = requestLogger;
this.queryMetricsFactory = queryMetricsFactory;
this.escalator = escalator;
}

@Override
Expand Down Expand Up @@ -213,11 +209,14 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
);
}
};
broadcastClient

Request broadcastReq = broadcastClient
.newRequest(rewriteURI(request, server.getScheme(), server.getHost()))
.method(HttpMethod.DELETE)
.timeout(CANCELLATION_TIMEOUT_MILLIS, TimeUnit.MILLISECONDS)
.send(completeListener);
.timeout(CANCELLATION_TIMEOUT_MILLIS, TimeUnit.MILLISECONDS);

copyRequestHeaders(request, broadcastReq);
broadcastReq.send(completeListener);
}
interruptedQueryCount.incrementAndGet();
}
Expand Down Expand Up @@ -347,7 +346,7 @@ protected static URI makeURI(String scheme, String host, String requestURI, Stri
@Override
protected HttpClient newHttpClient()
{
return escalator.createEscalatedJettyClient(httpClientProvider.get());
return httpClientProvider.get();
}

@Override
Expand Down
11 changes: 10 additions & 1 deletion server/src/main/java/io/druid/server/initialization/AuthorizerMapperModule.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,11 +95,20 @@ public AuthorizerMapper get()

// Default is allow all
if (authorizers == null) {
AllowAllAuthorizer allowAllAuthorizer = new AllowAllAuthorizer();
authorizerMap.put(AuthConfig.ALLOW_ALL_NAME, allowAllAuthorizer);

return new AuthorizerMapper(null) {
@Override
public Authorizer getAuthorizer(String name)
{
return new AllowAllAuthorizer();
return allowAllAuthorizer;
}

@Override
public Map<String, Authorizer> getAuthorizerMap()
{
return authorizerMap;
}
};
}
Expand Down
12 changes: 0 additions & 12 deletions server/src/main/java/io/druid/server/security/Escalator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,18 +46,6 @@ public interface Escalator
*/
HttpClient createEscalatedClient(HttpClient baseClient);

/**
* Return a client that sends requests with the format/information necessary to authenticate successfully
* against this Authenticator's authentication scheme using the identity of the internal system user.
* <p>
* This HTTP client is used by the Druid Router node.
*
* @param baseClient Base Jetty HttpClient
*
* @return Jetty HttpClient that sends requests with the credentials of the internal system user
*/
org.eclipse.jetty.client.HttpClient createEscalatedJettyClient(org.eclipse.jetty.client.HttpClient baseClient);

/**
* @return an AuthenticationResult representing the identity of the internal system user.
*/
Expand Down
6 changes: 0 additions & 6 deletions server/src/main/java/io/druid/server/security/NoopEscalator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,12 +29,6 @@ public HttpClient createEscalatedClient(HttpClient baseClient)
return baseClient;
}

@Override
public org.eclipse.jetty.client.HttpClient createEscalatedJettyClient(org.eclipse.jetty.client.HttpClient baseClient)
{
return baseClient;
}

@Override
public AuthenticationResult createEscalatedAuthenticationResult()
{
Expand Down
4 changes: 1 addition & 3 deletions server/src/test/java/io/druid/server/AsyncQueryForwardingServletTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,6 @@
import io.druid.server.security.AllowAllAuthorizer;
import io.druid.server.security.Authorizer;
import io.druid.server.security.AuthorizerMapper;
import io.druid.server.security.NoopEscalator;
import org.eclipse.jetty.client.HttpClient;
import org.eclipse.jetty.server.Handler;
import org.eclipse.jetty.server.Server;
Expand Down Expand Up @@ -252,8 +251,7 @@ public void log(RequestLogLine requestLogLine) throws IOException
// noop
}
},
new DefaultGenericQueryMetricsFactory(jsonMapper),
new NoopEscalator()
new DefaultGenericQueryMetricsFactory(jsonMapper)
)
{
@Override
Expand Down