Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add header authentication support for the web-ui #16558

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
+71 −1
Open

add header authentication support for the web-ui #16558

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions core/trino-main/src/main/java/io/trino/server/security/HeaderAuthenticatorManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
*/
package io.trino.server.security;

import com.google.common.annotations.VisibleForTesting;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableMap;
import com.google.inject.Inject;
Expand Down Expand Up @@ -115,4 +116,12 @@ public boolean isLoaded()
{
return authenticators.get() != null;
}

@VisibleForTesting
public void setAuthenticators(HeaderAuthenticator... authenticators)
{
if (!this.authenticators.compareAndSet(null, ImmutableList.copyOf(authenticators))) {
throw new IllegalStateException("authenticators already loaded");
}
}
}
8 changes: 8 additions & 0 deletions core/trino-main/src/main/java/io/trino/server/ui/WebUiAuthenticationModule.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,9 @@
import io.trino.server.security.Authenticator;
import io.trino.server.security.CertificateAuthenticator;
import io.trino.server.security.CertificateConfig;
import io.trino.server.security.HeaderAuthenticator;
import io.trino.server.security.HeaderAuthenticatorConfig;
import io.trino.server.security.HeaderAuthenticatorManager;
import io.trino.server.security.KerberosAuthenticator;
import io.trino.server.security.KerberosConfig;
import io.trino.server.security.SecurityConfig;
Expand Down Expand Up @@ -58,6 +61,11 @@ protected void setup(Binder binder)
}));
installWebUiAuthenticator("kerberos", KerberosAuthenticator.class, KerberosConfig.class);
install(webUiAuthenticator("jwt", JwtAuthenticator.class, new JwtAuthenticatorSupportModule()));
install(webUiAuthenticator("header", HeaderAuthenticator.class, headerBinder -> {
newOptionalBinder(headerBinder, HeaderAuthenticatorManager.class);
configBinder(headerBinder).bindConfig(HeaderAuthenticatorConfig.class);
headerBinder.bind(HeaderAuthenticatorManager.class).in(SINGLETON);
}));
}

private void installWebUiAuthenticator(String type, Module module)
Expand Down
52 changes: 52 additions & 0 deletions core/trino-main/src/test/java/io/trino/server/ui/TestWebUi.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@
import io.trino.server.HttpRequestSessionContextFactory;
import io.trino.server.ProtocolConfig;
import io.trino.server.protocol.PreparedStatementEncoder;
import io.trino.server.security.HeaderAuthenticatorManager;
import io.trino.server.security.PasswordAuthenticatorManager;
import io.trino.server.security.ResourceSecurity;
import io.trino.server.security.oauth2.ChallengeFailedException;
Expand All @@ -43,6 +44,7 @@
import io.trino.server.testing.TestingTrinoServer;
import io.trino.spi.security.AccessDeniedException;
import io.trino.spi.security.BasicPrincipal;
import io.trino.spi.security.HeaderAuthenticator;
import io.trino.spi.security.Identity;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
Expand Down Expand Up @@ -163,6 +165,8 @@ public class TestWebUi
private static final PrivateKey JWK_PRIVATE_KEY;
private static final String REFRESH_TOKEN = "REFRESH_TOKEN";
private static final Duration REFRESH_TOKEN_TIMEOUT = Duration.ofMinutes(1);
private static final String AUTHN_HEADER = "header-authn";
private static final String ALTERNATE_AUTHN_HEADER = "header-authn-alternate";

static {
try {
Expand Down Expand Up @@ -871,6 +875,54 @@ public void testOAuth2AuthenticatorWithoutEndSessionEndpoint()
}
}

@Test
public void testHeaderAuthenticator()
throws Exception
{
final Path headerConfigDummy = Files.createTempFile("passwordConfigDummy", "");
headerConfigDummy.toFile().deleteOnExit();
try (TestingTrinoServer server = TestingTrinoServer.builder()
.setProperties(ImmutableMap.<String, String>builder()
.putAll(SECURE_PROPERTIES)
.put("web-ui.authentication.type", "header")
.put("header-authenticator.config-files", headerConfigDummy.toString())
.buildOrThrow())
.build()) {
server.getInstance(Key.get(HeaderAuthenticatorManager.class))
.setAuthenticators(
headerAuthenticator(AUTHN_HEADER),
headerAuthenticator(ALTERNATE_AUTHN_HEADER));
HttpServerInfo httpServerInfo = server.getInstance(Key.get(HttpServerInfo.class));
String nodeId = server.getInstance(Key.get(NodeInfo.class)).getNodeId();

testLogIn(httpServerInfo.getHttpUri(), FORM_LOGIN_USER, TEST_PASSWORD, false);
testNeverAuthorized(httpServerInfo.getHttpsUri(), client);

OkHttpClient clientWithAuthNHeader = client.newBuilder()
.addInterceptor(chain -> chain.proceed(chain.request()
.newBuilder()
.addHeader(AUTHN_HEADER, TEST_USER)
.build()))
.build();
testAlwaysAuthorized(httpServerInfo.getHttpsUri(), clientWithAuthNHeader, nodeId);

OkHttpClient clientWithAltAuthNHeader = client.newBuilder()
.addInterceptor(chain -> chain.proceed(chain.request()
.newBuilder()
.addHeader(ALTERNATE_AUTHN_HEADER, TEST_USER)
.build()))
.build();
testAlwaysAuthorized(httpServerInfo.getHttpsUri(), clientWithAltAuthNHeader, nodeId);
}
}

private static HeaderAuthenticator headerAuthenticator(String authnHeader)
{
return (headers) -> Optional.ofNullable(headers.getHeader(authnHeader))
.map(values -> new BasicPrincipal(values.get(0)))
.orElseThrow(() -> new AccessDeniedException("You shall not pass!"));
}

private void assertAuth2Authentication(TestingTrinoServer server, String accessToken, Optional<String> idToken, boolean refreshTokensEnabled, boolean supportsEndSessionEndpoint)
throws Exception
{
Expand Down
2 changes: 1 addition & 1 deletion docs/src/main/sphinx/admin/properties-web-interface.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ The following properties can be used to configure the {doc}`web-interface`.
## `web-ui.authentication.type`

- **Type:** {ref}`prop-type-string`
- **Allowed values:** `FORM`, `FIXED`, `CERTIFICATE`, `KERBEROS`, `JWT`, `OAUTH2`
- **Allowed values:** `FORM`, `FIXED`, `CERTIFICATE`, `KERBEROS`, `JWT`, `OAUTH2`, `HEADER`
- **Default value:** `FORM`

The authentication mechanism to allow user access to the Web UI. See
Expand Down
1 change: 1 addition & 0 deletions docs/src/main/sphinx/admin/web-interface.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ The following Web UI authentication types are also supported:
- `KERBEROS`, see details in {doc}`/security/kerberos`
- `JWT`, see details in {doc}`/security/jwt`
- `OAUTH2`, see details in {doc}`/security/oauth2`
- `HEADER`, see details in {doc}`/develop/header-authenticator`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be nice to get user facing docs for header authentication going as well at some stage.


For these authentication types, the username is defined by {doc}`/security/user-mapping`.

Expand Down
Loading