Skip to content

Commit 9bcd37e

Browse files
chaitalicodchaitali.borole
chaitalicod
and
chaitali.borole
authored
ATLAS-5284: Support JWT authentication for Atlas (#655)
Co-authored-by: chaitali.borole <chaitali.borole@cloudera.com>
1 parent ed336f2 commit 9bcd37e

18 files changed

Lines changed: 1258 additions & 14 deletions

File tree

‎authn/pom.xml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Licensed to the Apache Software Foundation (ASF) under one
4+
~ or more contributor license agreements. See the NOTICE file
5+
~ distributed with this work for additional information
6+
~ regarding copyright ownership. The ASF licenses this file
7+
~ to you under the Apache License, Version 2.0 (the
8+
~ "License"); you may not use this file except in compliance
9+
~ with the License. You may obtain a copy of the License at
10+
~
11+
~ http://www.apache.org/licenses/LICENSE-2.0
12+
~
13+
~ Unless required by applicable law or agreed to in writing, software
14+
~ distributed under the License is distributed on an "AS IS" BASIS,
15+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
~ See the License for the specific language governing permissions and
17+
~ limitations under the License.
18+
-->
19+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
20+
<modelVersion>4.0.0</modelVersion>
21+
22+
<parent>
23+
<groupId>org.apache.atlas</groupId>
24+
<artifactId>apache-atlas</artifactId>
25+
<version>3.0.0-SNAPSHOT</version>
26+
</parent>
27+
28+
<artifactId>atlas-authn</artifactId>
29+
<packaging>jar</packaging>
30+
31+
<name>Apache Atlas Authentication</name>
32+
<description>JWT and authentication handler support for Apache Atlas</description>
33+
34+
<properties>
35+
<checkstyle.failOnViolation>true</checkstyle.failOnViolation>
36+
<checkstyle.skip>false</checkstyle.skip>
37+
</properties>
38+
39+
<dependencies>
40+
41+
<dependency>
42+
<groupId>com.nimbusds</groupId>
43+
<artifactId>nimbus-jose-jwt</artifactId>
44+
</dependency>
45+
46+
<dependency>
47+
<groupId>javax.servlet</groupId>
48+
<artifactId>javax.servlet-api</artifactId>
49+
<version>${javax.servlet.version}</version>
50+
</dependency>
51+
52+
<dependency>
53+
<groupId>org.apache.commons</groupId>
54+
<artifactId>commons-configuration2</artifactId>
55+
<version>${commons-conf2.version}</version>
56+
</dependency>
57+
58+
<dependency>
59+
<groupId>org.apache.commons</groupId>
60+
<artifactId>commons-lang3</artifactId>
61+
<version>${commons-lang3.version}</version>
62+
</dependency>
63+
64+
<dependency>
65+
<groupId>org.slf4j</groupId>
66+
<artifactId>slf4j-api</artifactId>
67+
</dependency>
68+
69+
</dependencies>
70+
</project>

‎authn/src/main/java/org/apache/atlas/authn/handler/AtlasAuth.java‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing,
13+
* software distributed under the License is distributed on an
14+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
* KIND, either express or implied. See the License for the
16+
* specific language governing permissions and limitations
17+
* under the License.
18+
*/
19+
package org.apache.atlas.authn.handler;
20+
21+
public class AtlasAuth {
22+
public enum AuthType {
23+
JWT_JWKS("JWT-JWKS");
24+
25+
private final String authType;
26+
27+
AuthType(String authType) {
28+
this.authType = authType;
29+
}
30+
}
31+
32+
private String userName;
33+
private AuthType type;
34+
private boolean isAuthenticated;
35+
36+
public AtlasAuth(final String username, AuthType type) {
37+
this.userName = username;
38+
this.isAuthenticated = true;
39+
this.type = type;
40+
}
41+
42+
public String getUserName() {
43+
return userName;
44+
}
45+
46+
public void setUserName(String userName) {
47+
this.userName = userName;
48+
}
49+
50+
public AuthType getType() {
51+
return type;
52+
}
53+
54+
public void setType(AuthType type) {
55+
this.type = type;
56+
}
57+
58+
public boolean isAuthenticated() {
59+
return isAuthenticated;
60+
}
61+
62+
public void setAuthenticated(boolean authenticated) {
63+
isAuthenticated = authenticated;
64+
}
65+
}

‎authn/src/main/java/org/apache/atlas/authn/handler/AtlasAuthHandler.java‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing,
13+
* software distributed under the License is distributed on an
14+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
* KIND, either express or implied. See the License for the
16+
* specific language governing permissions and limitations
17+
* under the License.
18+
*/
19+
package org.apache.atlas.authn.handler;
20+
21+
import org.apache.commons.configuration2.Configuration;
22+
23+
import javax.servlet.http.HttpServletRequest;
24+
25+
public interface AtlasAuthHandler {
26+
void initialize(Configuration config) throws Exception;
27+
28+
AtlasAuth authenticate(HttpServletRequest request);
29+
}

‎authn/src/main/java/org/apache/atlas/authn/handler/jwt/AtlasDefaultJwtAuthHandler.java‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing,
13+
* software distributed under the License is distributed on an
14+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
* KIND, either express or implied. See the License for the
16+
* specific language governing permissions and limitations
17+
* under the License.
18+
*/
19+
package org.apache.atlas.authn.handler.jwt;
20+
21+
import com.nimbusds.jose.proc.JWSKeySelector;
22+
import com.nimbusds.jose.proc.SecurityContext;
23+
import com.nimbusds.jwt.proc.ConfigurableJWTProcessor;
24+
import com.nimbusds.jwt.proc.DefaultJWTClaimsVerifier;
25+
import com.nimbusds.jwt.proc.DefaultJWTProcessor;
26+
import com.nimbusds.jwt.proc.JWTClaimsSetVerifier;
27+
import org.apache.atlas.authn.handler.AtlasAuth;
28+
import org.apache.commons.lang3.StringUtils;
29+
30+
import javax.servlet.ServletRequest;
31+
import javax.servlet.http.Cookie;
32+
import javax.servlet.http.HttpServletRequest;
33+
34+
public class AtlasDefaultJwtAuthHandler extends AtlasJwtAuthHandler {
35+
protected static final String AUTHORIZATION_HEADER = "Authorization";
36+
37+
@Override
38+
public ConfigurableJWTProcessor<SecurityContext> getJwtProcessor(JWSKeySelector<SecurityContext> keySelector) {
39+
ConfigurableJWTProcessor<SecurityContext> jwtProcessor = new DefaultJWTProcessor<>();
40+
JWTClaimsSetVerifier<SecurityContext> claimsVerifier = new DefaultJWTClaimsVerifier<>();
41+
42+
jwtProcessor.setJWSKeySelector(keySelector);
43+
jwtProcessor.setJWTClaimsSetVerifier(claimsVerifier);
44+
45+
return jwtProcessor;
46+
}
47+
48+
@Override
49+
public AtlasAuth authenticate(HttpServletRequest request) {
50+
AtlasAuth atlasAuth = null;
51+
String jwtAuthHeaderStr = getJwtAuthHeader(request);
52+
String jwtCookieStr = StringUtils.isBlank(jwtAuthHeaderStr) ? getJwtCookie(request) : null;
53+
54+
String username = authenticate(jwtAuthHeaderStr, jwtCookieStr);
55+
if (username != null) {
56+
atlasAuth = new AtlasAuth(username, AtlasAuth.AuthType.JWT_JWKS);
57+
}
58+
return atlasAuth;
59+
}
60+
61+
public static boolean canAuthenticateRequest(final ServletRequest request) {
62+
HttpServletRequest httpServletRequest = (HttpServletRequest) request;
63+
String jwtAuthHeaderStr = getJwtAuthHeader(httpServletRequest);
64+
String jwtCookieStr = StringUtils.isBlank(jwtAuthHeaderStr) ? getJwtCookie(httpServletRequest) : null;
65+
return shouldProceedAuth(jwtAuthHeaderStr, jwtCookieStr);
66+
}
67+
68+
public static String getJwtAuthHeader(final HttpServletRequest httpServletRequest) {
69+
return httpServletRequest.getHeader(AUTHORIZATION_HEADER);
70+
}
71+
72+
public static String getJwtCookie(final HttpServletRequest httpServletRequest) {
73+
String jwtCookieStr = null;
74+
Cookie[] cookies = httpServletRequest.getCookies();
75+
76+
if (cookies != null) {
77+
for (Cookie cookie : cookies) {
78+
if (cookieName.equals(cookie.getName())) {
79+
jwtCookieStr = cookie.getName() + "=" + cookie.getValue();
80+
break;
81+
}
82+
}
83+
}
84+
return jwtCookieStr;
85+
}
86+
}

0 commit comments

Comments
 (0)