001/**
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software
013 * distributed under the License is distributed on an "AS IS" BASIS,
014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
015 * See the License for the specific language governing permissions and
016 * limitations under the License.
017 */
018package org.apache.hadoop.hdfs.web;
019
020import java.io.IOException;
021import java.util.ArrayList;
022import java.util.Enumeration;
023import java.util.HashMap;
024import java.util.Iterator;
025import java.util.List;
026import java.util.Map;
027import java.util.Properties;
028
029import javax.servlet.FilterChain;
030import javax.servlet.FilterConfig;
031import javax.servlet.ServletException;
032import javax.servlet.ServletRequest;
033import javax.servlet.ServletResponse;
034import javax.servlet.http.HttpServletRequest;
035import javax.servlet.http.HttpServletRequestWrapper;
036
037import org.apache.hadoop.hdfs.web.resources.DelegationParam;
038import org.apache.hadoop.security.UserGroupInformation;
039import org.apache.hadoop.security.authentication.server.AuthenticationFilter;
040import org.apache.hadoop.security.authentication.server.KerberosAuthenticationHandler;
041import org.apache.hadoop.security.authentication.server.PseudoAuthenticationHandler;
042import org.apache.hadoop.util.StringUtils;
043
044/**
045 * Subclass of {@link AuthenticationFilter} that
046 * obtains Hadoop-Auth configuration for webhdfs.
047 */
048public class AuthFilter extends AuthenticationFilter {
049  public static final String CONF_PREFIX = "dfs.web.authentication.";
050
051  /**
052   * Returns the filter configuration properties,
053   * including the ones prefixed with {@link #CONF_PREFIX}.
054   * The prefix is removed from the returned property names.
055   *
056   * @param prefix parameter not used.
057   * @param config parameter contains the initialization values.
058   * @return Hadoop-Auth configuration properties.
059   * @throws ServletException 
060   */
061  @Override
062  protected Properties getConfiguration(String prefix, FilterConfig config)
063      throws ServletException {
064    final Properties p = super.getConfiguration(CONF_PREFIX, config);
065    // if not set, configure based on security enabled
066    if (p.getProperty(AUTH_TYPE) == null) {
067      p.setProperty(AUTH_TYPE, UserGroupInformation.isSecurityEnabled()?
068          KerberosAuthenticationHandler.TYPE: PseudoAuthenticationHandler.TYPE);
069    }
070    // if not set, enable anonymous for pseudo authentication
071    if (p.getProperty(PseudoAuthenticationHandler.ANONYMOUS_ALLOWED) == null) {
072      p.setProperty(PseudoAuthenticationHandler.ANONYMOUS_ALLOWED, "true");
073    }
074    //set cookie path
075    p.setProperty(COOKIE_PATH, "/");
076    return p;
077  }
078
079  @Override
080  public void doFilter(ServletRequest request, ServletResponse response,
081      FilterChain filterChain) throws IOException, ServletException {
082    final HttpServletRequest httpRequest = toLowerCase((HttpServletRequest)request);
083    final String tokenString = httpRequest.getParameter(DelegationParam.NAME);
084    if (tokenString != null) {
085      //Token is present in the url, therefore token will be used for
086      //authentication, bypass kerberos authentication.
087      filterChain.doFilter(httpRequest, response);
088      return;
089    }
090    super.doFilter(httpRequest, response, filterChain);
091  }
092
093  private static HttpServletRequest toLowerCase(final HttpServletRequest request) {
094    @SuppressWarnings("unchecked")
095    final Map<String, String[]> original = (Map<String, String[]>)request.getParameterMap();
096    if (!ParamFilter.containsUpperCase(original.keySet())) {
097      return request;
098    }
099
100    final Map<String, List<String>> m = new HashMap<String, List<String>>();
101    for(Map.Entry<String, String[]> entry : original.entrySet()) {
102      final String key = StringUtils.toLowerCase(entry.getKey());
103      List<String> strings = m.get(key);
104      if (strings == null) {
105        strings = new ArrayList<String>();
106        m.put(key, strings);
107      }
108      for(String v : entry.getValue()) {
109        strings.add(v);
110      }
111    }
112
113    return new HttpServletRequestWrapper(request) {
114      private Map<String, String[]> parameters = null;
115
116      @Override
117      public Map<String, String[]> getParameterMap() {
118        if (parameters == null) {
119          parameters = new HashMap<String, String[]>();
120          for(Map.Entry<String, List<String>> entry : m.entrySet()) {
121            final List<String> a = entry.getValue();
122            parameters.put(entry.getKey(), a.toArray(new String[a.size()]));
123          }
124        }
125       return parameters;
126      }
127
128      @Override
129      public String getParameter(String name) {
130        final List<String> a = m.get(name);
131        return a == null? null: a.get(0);
132      }
133      
134      @Override
135      public String[] getParameterValues(String name) {
136        return getParameterMap().get(name);
137      }
138
139      @Override
140      public Enumeration<String> getParameterNames() {
141        final Iterator<String> i = m.keySet().iterator();
142        return new Enumeration<String>() {
143          @Override
144          public boolean hasMoreElements() {
145            return i.hasNext();
146          }
147          @Override
148          public String nextElement() {
149            return i.next();
150          }
151        };
152      }
153    };
154  }
155}