Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

KAFKA-3199 LoginManager should allow using an existing Subject #3274

Open
wants to merge 3 commits into
base: trunk
Choose a base branch
from
+29 −0
Open

KAFKA-3199 LoginManager should allow using an existing Subject #3274

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
95d6b98
KAFKA-3199 LoginManager should allow using an existing Subject
Jun 8, 2017
d6fed2a
Update KerberosLogin.java
utenakr Jun 8, 2017
73bccb0
remove catching IOException
utenakr Jun 8, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions clients/src/main/java/org/apache/kafka/common/security/kerberos/KerberosLogin.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,11 +33,16 @@
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import java.security.AccessController;
import java.util.Comparator;

import java.util.Date;
import java.util.List;
import java.util.Random;
import java.util.Set;
import java.util.Map;
import java.util.SortedSet;
import java.util.TreeSet;

/**
* This class is responsible for refreshing Kerberos credentials for
Expand Down Expand Up @@ -93,6 +98,30 @@ public void configure(Map<String, ?> configs, JaasContext jaasContext) {
*/
@Override
public LoginContext login() throws LoginException {
Subject existingSubject = Subject.getSubject(AccessController.getContext());
if (existingSubject != null) {
// Found a subject in the threads access control context. Check if it has a valid Kerberos ticket
SortedSet<KerberosTicket> tickets = new TreeSet<>(new Comparator<KerberosTicket>() {
@Override
public int compare(KerberosTicket ticket1, KerberosTicket ticket2) {
return Long.compare(ticket1.getEndTime().getTime(), ticket2.getEndTime().getTime());
}
});
for (KerberosTicket ticket : existingSubject.getPrivateCredentials(KerberosTicket.class)) {
// Filter out Kerberos TGTs
KerberosPrincipal principal = ticket.getServer();
String principalName = "krbtgt/" + principal.getRealm() + "@" + principal.getRealm();
if (principalName.equals(principal.getName())) {
tickets.add(ticket);
}
}
if (!tickets.isEmpty() && tickets.last().isCurrent()) {
log.debug("Found Subject with a valid Kerberos ticket");
subject = existingSubject;
// Note that it is the responsibility of the application to renew ticket and update the subject
return loginContext;
}
}

this.lastLogin = currentElapsedTime();
loginContext = super.login();
Expand Down