org.apache.ranger.authz.handler.jwt

Class RangerJwtAuthHandler

java.lang.Object

org.apache.ranger.authz.handler.jwt.RangerJwtAuthHandler

All Implemented Interfaces:

RangerAuthHandler

Direct Known Subclasses:

RangerDefaultJwtAuthHandler

public abstract class RangerJwtAuthHandler
extends Object
implements RangerAuthHandler

Field Summary

Fields

Modifier and Type	Field and Description
protected List<String>	audiences
protected static String	cookieName
static String	JWT_AUTHZ_PREFIX
static String	KEY_JWT_AUDIENCES
static String	KEY_JWT_COOKIE_NAME
static String	KEY_JWT_PUBLIC_KEY
static String	KEY_PROVIDER_URL
protected com.nimbusds.jose.jwk.source.JWKSource<com.nimbusds.jose.proc.SecurityContext>	keySource
static String	TYPE

Constructor Summary

Constructors

Constructor and Description
RangerJwtAuthHandler()

Method Summary

Modifier and Type	Method and Description
protected org.apache.hadoop.security.authentication.server.AuthenticationToken	authenticate(String jwtAuthHeader, String jwtCookie, String doAsUser)
protected String	getJWT(String jwtAuthHeader, String jwtCookie)
abstract com.nimbusds.jwt.proc.ConfigurableJWTProcessor<com.nimbusds.jose.proc.SecurityContext>	getJwtProcessor(com.nimbusds.jose.proc.JWSKeySelector<com.nimbusds.jose.proc.SecurityContext> keySelector)
void	initialize(Properties config)
static boolean	shouldProceedAuth(String authHeader, String jwtCookie)
protected boolean	validateAudiences(com.nimbusds.jwt.SignedJWT jwtToken) Validate whether any of the accepted audience claims is present in the issued token claims list for audience.
protected boolean	validateExpiration(com.nimbusds.jwt.SignedJWT jwtToken) Validate that the expiration time of the JWT token has not been violated.
protected boolean	validateSignature(com.nimbusds.jwt.SignedJWT jwtToken) Verify the signature of the JWT token in this method.
protected boolean	validateToken(com.nimbusds.jwt.SignedJWT jwtToken) This method provides a single method for validating the JWT for use in request processing.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.ranger.authz.handler.RangerAuthHandler

authenticate

Field Detail

TYPE

public static final String TYPE

See Also:

Constant Field Values

KEY_PROVIDER_URL

public static final String KEY_PROVIDER_URL

See Also:

Constant Field Values

KEY_JWT_PUBLIC_KEY

public static final String KEY_JWT_PUBLIC_KEY

See Also:

Constant Field Values

KEY_JWT_COOKIE_NAME

public static final String KEY_JWT_COOKIE_NAME

See Also:

Constant Field Values

KEY_JWT_AUDIENCES

public static final String KEY_JWT_AUDIENCES

See Also:

Constant Field Values

JWT_AUTHZ_PREFIX

public static final String JWT_AUTHZ_PREFIX

See Also:

Constant Field Values

audiences

protected List<String> audiences

keySource

protected com.nimbusds.jose.jwk.source.JWKSource<com.nimbusds.jose.proc.SecurityContext> keySource

cookieName

protected static String cookieName

Constructor Detail

RangerJwtAuthHandler

public RangerJwtAuthHandler()

Method Detail

initialize

public void initialize(Properties config)
                throws Exception

Specified by:

initialize in interface RangerAuthHandler

Throws:

Exception

authenticate

protected org.apache.hadoop.security.authentication.server.AuthenticationToken authenticate(String jwtAuthHeader,
                                                                                            String jwtCookie,
                                                                                            String doAsUser)

getJWT

protected String getJWT(String jwtAuthHeader,
                        String jwtCookie)

validateToken

protected boolean validateToken(com.nimbusds.jwt.SignedJWT jwtToken)

This method provides a single method for validating the JWT for use in request processing. It provides for the override of specific aspects of this implementation through submethods used within but also allows for the override of the entire token validation algorithm.

Parameters:

jwtToken - the token to validate

Returns:

true if valid

validateSignature

protected boolean validateSignature(com.nimbusds.jwt.SignedJWT jwtToken)

Verify the signature of the JWT token in this method. This method depends on the public key that was established during init based upon the provisioned public key. Override this method in subclasses in order to customize the signature verification behavior.

Parameters:

jwtToken - the token that contains the signature to be validated

Returns:

valid true if signature verifies successfully; false otherwise

getJwtProcessor

public abstract com.nimbusds.jwt.proc.ConfigurableJWTProcessor<com.nimbusds.jose.proc.SecurityContext> getJwtProcessor(com.nimbusds.jose.proc.JWSKeySelector<com.nimbusds.jose.proc.SecurityContext> keySelector)

validateAudiences

protected boolean validateAudiences(com.nimbusds.jwt.SignedJWT jwtToken)

Validate whether any of the accepted audience claims is present in the issued token claims list for audience. Override this method in subclasses in order to customize the audience validation behavior.

Parameters:

jwtToken - the JWT token where the allowed audiences will be found

Returns:

true if an expected audience is present, otherwise false

validateExpiration

protected boolean validateExpiration(com.nimbusds.jwt.SignedJWT jwtToken)

Validate that the expiration time of the JWT token has not been violated. If it has then throw an AuthenticationException. Override this method in subclasses in order to customize the expiration validation behavior.

Parameters:

jwtToken - the token that contains the expiration date to validate

Returns:

valid true if the token has not expired; false otherwise

shouldProceedAuth

public static boolean shouldProceedAuth(String authHeader,
                                        String jwtCookie)