Apache
/
activemq-artemis
mirror of https://github.com/apache/activemq-artemis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update Kerberos tests to work on JDK11+. This closes #3579

This commit is contained in:
Robbie Gemmell 2021-05-14 10:24:20 +01:00
parent 0355dda813 9e70b26368
commit 72d1d44c3c
7 changed files with 162 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
pom.xml
View File

@ -82,7 +82,7 @@
<karaf.version>4.3.0</karaf.version>
<pax.exam.version>4.9.1</pax.exam.version>
<commons.config.version>2.7</commons.config.version>
<commons.lang.version>3.0</commons.lang.version>
<commons.lang.version>3.12.0</commons.lang.version>
<activemq5-version>5.16.0</activemq5-version>
<apache.derby.version>10.11.1.1</apache.derby.version>
<commons.beanutils.version>1.9.4</commons.beanutils.version>
@ -199,7 +199,7 @@
<skipStyleCheck>true</skipStyleCheck>
<skipOWASP>true</skipOWASP>
<directory-version>2.0.0-M15</directory-version>
<directory-version>2.0.0.AM26</directory-version>
<directory-jdbm2-version>2.0.0-M1</directory-jdbm2-version>
<netty-transport-native-epoll-classifier>linux-x86_64</netty-transport-native-epoll-classifier>
@ -280,7 +280,7 @@
</dependency>
<!-- ### For MQTT Tests && Examples -->
<dependency>
<dependency>
<groupId>org.eclipse.paho</groupId>
<artifactId>org.eclipse.paho.client.mqttv3</artifactId>
<version>${paho.client.mqttv3.version}</version>

17
tests/integration-tests/pom.xml
View File

@ -335,6 +335,11 @@
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<scope>test</scope>
</dependency>
<!-- karaf test -->
@ -390,7 +395,13 @@
<dependency>
<groupId>org.apache.hadoop</groupId>
<artifactId>hadoop-minikdc</artifactId>
<version>2.8.1</version>
<version>3.3.0</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.apache.directory.server</groupId>
<artifactId>apacheds-interceptor-kerberos</artifactId>
<version>${directory-version}</version>
<scope>test</scope>
</dependency>
<dependency>
@ -554,10 +565,6 @@
<artifactId>maven-surefire-plugin</artifactId>
<configuration>
<excludes combine.children="append">
<!-- These fail, likely due to due to isues with the old Kerberos test harness bits -->
<exclude>**/JMSSaslGssapiTest.java</exclude>
<exclude>**/SaslKrb5LDAPSecurityTest.java</exclude>
<!-- This is no longer possible on JDK11 because the old KRB5 cipher suites it requires were
removed from JDK11 while adding TLS 1.3 support http://openjdk.java.net/jeps/332 -->
<exclude>**/CoreClientOverOneWaySSLKerb5Test.java</exclude>

110
tests/integration-tests/src/test/java/org/apache/activemq/artemis/tests/integration/amqp/JMSSaslGssapiTest.java
View File

@ -16,24 +16,37 @@
*/
package org.apache.activemq.artemis.tests.integration.amqp;
import javax.jms.Connection;
import javax.jms.JMSSecurityException;
import javax.jms.MessageConsumer;
import javax.jms.MessageProducer;
import javax.jms.Session;
import javax.jms.TextMessage;
import java.io.BufferedReader;
import java.io.File;
import java.io.FileReader;
import java.io.OutputStream;
import java.net.URI;
import java.net.URL;
import java.nio.ByteBuffer;
import java.nio.channels.Channels;
import java.nio.channels.WritableByteChannel;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.util.Collections;
import java.util.HashSet;
import java.util.LinkedHashMap;
import java.util.Map;
import java.util.Optional;
import java.util.Properties;
import java.util.Set;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.atomic.AtomicBoolean;
import javax.jms.Connection;
import javax.jms.JMSSecurityException;
import javax.jms.MessageConsumer;
import javax.jms.MessageProducer;
import javax.jms.Queue;
import javax.jms.Session;
import javax.jms.TextMessage;
import org.apache.activemq.artemis.core.remoting.impl.netty.NettyConnector;
import org.apache.activemq.artemis.core.remoting.impl.netty.TransportConstants;
import org.apache.activemq.artemis.core.security.Role;
@ -47,21 +60,25 @@ import org.apache.activemq.artemis.protocol.amqp.proton.handler.ProtonHandler;
import org.apache.activemq.artemis.protocol.amqp.sasl.ClientSASL;
import org.apache.activemq.artemis.protocol.amqp.sasl.ClientSASLFactory;
import org.apache.activemq.artemis.spi.core.security.ActiveMQJAASSecurityManager;
import org.apache.activemq.artemis.tests.util.JavaVersionUtil;
import org.apache.activemq.artemis.tests.util.Wait;
import org.apache.activemq.artemis.utils.RandomUtil;
import org.apache.hadoop.minikdc.MiniKdc;
import org.apache.kerby.kerberos.kerb.keytab.Keytab;
import org.apache.kerby.kerberos.kerb.keytab.KeytabEntry;
import org.apache.kerby.kerberos.kerb.type.base.PrincipalName;
import org.apache.qpid.jms.JmsConnectionFactory;
import org.apache.qpid.jms.sasl.GssapiMechanism;
import org.apache.qpid.proton.amqp.Symbol;
import org.junit.After;
import org.junit.Assume;
import org.junit.Before;
import org.junit.AfterClass;
import org.junit.BeforeClass;
import org.junit.Test;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class JMSSaslGssapiTest extends JMSClientTestSupport {
private static final Logger LOG = LoggerFactory.getLogger(JMSSaslGssapiTest.class);
static {
String path = System.getProperty("java.security.auth.login.config");
if (path == null) {
@ -72,25 +89,48 @@ public class JMSSaslGssapiTest extends JMSClientTestSupport {
}
}
}
MiniKdc kdc = null;
private final boolean debug = false;
private static final String KRB5_TCP_PORT_TEMPLATE = "MINI_KDC_PORT";
private static final String KRB5_CONFIG_TEMPLATE = "minikdc-krb5-template.conf";
private static final String KRB5_DEFAULT_KEYTAB = "target/test.krb5.keytab";
private static MiniKdc kdc;
private static final boolean debug = false;
@BeforeClass
public static void checkAssumptions() throws Exception {
Assume.assumeTrue("Test only runs on JDK 8", JavaVersionUtil.isJava8());
}
public static void setUpKerberos() throws Exception {
Properties kdcConf = MiniKdc.createConf();
kdcConf.setProperty("debug", Boolean.toString(debug));
@Before
public void setUpKerberos() throws Exception {
kdc = new MiniKdc(MiniKdc.createConf(), temporaryFolder.newFolder("kdc"));
// Creates a single server for the tests as there were failures when spawning and killing one per unit test.
kdc = new MiniKdc(kdcConf, new File("target/"));
kdc.start();
// hard coded match, default_keytab_name in minikdc-krb5.conf template
File userKeyTab = new File("target/test.krb5.keytab");
File userKeyTab = new File(KRB5_DEFAULT_KEYTAB);
kdc.createPrincipal(userKeyTab, "client", "amqp/localhost");
// We need to hard code the default keyTab into the Krb5 configuration file which is not possible
// with this version of MiniKDC so we use a template file and replace the port with the value from
// the MiniKDC instance we just started.
rewriteKrbConfFile(kdc);
if (debug) {
for (java.util.logging.Logger logger : new java.util.logging.Logger[] {java.util.logging.Logger.getLogger("javax.security.sasl"), java.util.logging.Logger.getLogger("org.apache.qpid.proton")}) {
LOG.debug("java.security.krb5.conf='{}'", System.getProperty("java.security.krb5.conf"));
try (BufferedReader br = new BufferedReader(new FileReader(System.getProperty("java.security.krb5.conf")))) {
br.lines().forEach(line -> LOG.debug(line));
}
Keytab kt = Keytab.loadKeytab(userKeyTab);
for (PrincipalName name : kt.getPrincipals()) {
for (KeytabEntry entry : kt.getKeytabEntries(name)) {
LOG.info("KeyTab Entry: PrincipalName:" + entry.getPrincipal() + " ; KeyInfo:" + entry.getKey().getKeyType());
}
}
for (java.util.logging.Logger logger : new java.util.logging.Logger[] {java.util.logging.Logger.getLogger("logincontext"),
java.util.logging.Logger.getLogger("javax.security.sasl"),
java.util.logging.Logger.getLogger("org.apache.qpid.proton")}) {
logger.setLevel(java.util.logging.Level.FINEST);
logger.addHandler(new java.util.logging.ConsoleHandler());
for (java.util.logging.Handler handler : logger.getHandlers()) {
@ -100,8 +140,8 @@ public class JMSSaslGssapiTest extends JMSClientTestSupport {
}
}
@After
public void stopKerberos() throws Exception {
@AfterClass
public static void stopKerberos() throws Exception {
if (kdc != null) {
kdc.stop();
}
@ -125,6 +165,10 @@ public class JMSSaslGssapiTest extends JMSClientTestSupport {
roles.add(role);
server.getSecurityRepository().addMatch(getQueueName().toString(), roles);
if (debug) {
// The default produces so much log spam that debugging the exchanges becomes impossible.
server.getConfiguration().setMessageExpiryScanPeriod(30_000);
}
}
@Override
@ -134,7 +178,6 @@ public class JMSSaslGssapiTest extends JMSClientTestSupport {
@Override
protected URI getBrokerQpidJMSConnectionURI() {
try {
int port = AMQP_PORT;
@ -164,7 +207,7 @@ public class JMSSaslGssapiTest extends JMSClientTestSupport {
try {
Session session = connection.createSession(false, Session.AUTO_ACKNOWLEDGE);
javax.jms.Queue queue = session.createQueue(getQueueName());
Queue queue = session.createQueue(getQueueName());
MessageConsumer consumer = session.createConsumer(queue);
MessageProducer producer = session.createProducer(queue);
@ -174,7 +217,6 @@ public class JMSSaslGssapiTest extends JMSClientTestSupport {
TextMessage m = (TextMessage) consumer.receive(1000);
assertNotNull(m);
assertEquals(text, m.getText());
} finally {
connection.close();
}
@ -182,7 +224,6 @@ public class JMSSaslGssapiTest extends JMSClientTestSupport {
@Test(timeout = 600000)
public void testSaslPlainConnectionDenied() throws Exception {
JmsConnectionFactory factory = new JmsConnectionFactory(new URI("amqp://localhost:" + AMQP_PORT + "?amqp.saslMechanisms=PLAIN"));
try {
factory.createConnection("plain", "secret");
@ -192,7 +233,7 @@ public class JMSSaslGssapiTest extends JMSClientTestSupport {
}
}
@Test
@Test(timeout = 900000)
public void testOutboundWithSlowMech() throws Exception {
final Map<String, Object> config = new LinkedHashMap<>(); config.put(TransportConstants.HOST_PROP_NAME, "localhost");
config.put(TransportConstants.PORT_PROP_NAME, String.valueOf(AMQP_PORT));
@ -270,4 +311,19 @@ public class JMSSaslGssapiTest extends JMSClientTestSupport {
lifeCycleListener.stop();
}
}
private static void rewriteKrbConfFile(MiniKdc server) throws Exception {
final Path template = Paths.get(JMSSaslGssapiTest.class.getClassLoader().getResource(KRB5_CONFIG_TEMPLATE).toURI());
final String krb5confTemplate = new String(Files.readAllBytes(template), StandardCharsets.UTF_8);
final String replacementPort = Integer.toString(server.getPort());
// Replace the port template with the current actual port of the MiniKDC Server instance.
final String krb5confUpdated = krb5confTemplate.replaceAll(KRB5_TCP_PORT_TEMPLATE, replacementPort);
try (OutputStream outputStream = Files.newOutputStream(server.getKrb5conf().toPath());
WritableByteChannel channel = Channels.newChannel(outputStream)) {
channel.write(ByteBuffer.wrap(krb5confUpdated.getBytes(StandardCharsets.UTF_8)));
}
}
}

66
tests/integration-tests/src/test/java/org/apache/activemq/artemis/tests/integration/amqp/SaslKrb5LDAPSecurityTest.java
View File

@ -30,6 +30,7 @@ import javax.security.auth.Subject;
import javax.security.auth.login.LoginContext;
import java.io.BufferedReader;
import java.io.File;
import java.io.FileReader;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.StringReader;
@ -58,10 +59,8 @@ import org.apache.activemq.artemis.core.server.ActiveMQServer;
import org.apache.activemq.artemis.core.server.ActiveMQServers;
import org.apache.activemq.artemis.spi.core.security.ActiveMQJAASSecurityManager;
import org.apache.activemq.artemis.tests.util.ActiveMQTestBase;
import org.apache.activemq.artemis.tests.util.JavaVersionUtil;
import org.apache.activemq.artemis.utils.RandomUtil;
import org.apache.commons.io.FileUtils;
import org.apache.commons.io.IOUtils;
import org.apache.directory.api.ldap.model.constants.SupportedSaslMechanisms;
import org.apache.directory.api.ldap.model.entry.DefaultEntry;
import org.apache.directory.api.ldap.model.entry.Entry;
@ -95,9 +94,7 @@ import org.apache.directory.shared.kerberos.components.EncryptionKey;
import org.apache.qpid.jms.JmsConnectionFactory;
import org.junit.After;
import org.junit.Assert;
import org.junit.Assume;
import org.junit.Before;
import org.junit.BeforeClass;
import org.junit.Rule;
import org.junit.Test;
import org.junit.rules.TemporaryFolder;
@ -122,9 +119,8 @@ import static org.apache.activemq.artemis.tests.util.ActiveMQTestBase.NETTY_ACCE
@CreateKdcServer(transports = {@CreateTransport(protocol = "TCP", port = 0)})
@ApplyLdifFiles("SaslKrb5LDAPSecurityTest.ldif")
public class SaslKrb5LDAPSecurityTest extends AbstractLdapTestUnit {
private static final org.jboss.logging.Logger log = org.jboss.logging.Logger.getLogger(SaslKrb5LDAPSecurityTest.class);
protected static final Logger LOG = LoggerFactory.getLogger(SaslKrb5LDAPSecurityTest.class);
public static final String QUEUE_NAME = "some_queue";
static {
@ -155,14 +151,8 @@ public class SaslKrb5LDAPSecurityTest extends AbstractLdapTestUnit {
public TemporaryFolder temporaryFolder;
private String testDir;
@BeforeClass
public static void checkAssumptions() throws Exception {
Assume.assumeTrue("Test only runs on JDK 8", JavaVersionUtil.isJava8());
}
@Before
public void setUp() throws Exception {
if (debug) {
initLogging();
}
@ -196,27 +186,24 @@ public class SaslKrb5LDAPSecurityTest extends AbstractLdapTestUnit {
private void rewriteKerb5Conf() throws Exception {
StringBuilder sb = new StringBuilder();
InputStream is2 = this.getClass().getClassLoader().getResourceAsStream("minikdc-krb5.conf");
BufferedReader r = null;
try {
r = new BufferedReader(new InputStreamReader(is2, StandardCharsets.UTF_8));
String line = r.readLine();
try (InputStream inputStream = this.getClass().getClassLoader().getResourceAsStream("minikdc-krb5.conf");
BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream, StandardCharsets.UTF_8))) {
String line = reader.readLine();
while (line != null) {
sb.append(line).append("{3}");
line = r.readLine();
line = reader.readLine();
}
} finally {
IOUtils.closeQuietly(r);
IOUtils.closeQuietly(is2);
}
InetSocketAddress addr =
(InetSocketAddress)kdcServer.getTransports()[0].getAcceptor().getLocalAddress();
int port = addr.getPort();
File krb5conf = new File(testDir, "krb5.conf").getAbsoluteFile();
FileUtils.writeStringToFile(krb5conf, MessageFormat.format(sb.toString(), getRealm(), "localhost", Integer.toString(port), System.getProperty("line.separator")));
String krb5confBody = MessageFormat.format(sb.toString(), getRealm(), "localhost", Integer.toString(port), System.getProperty("line.separator"));
FileUtils.writeStringToFile(krb5conf, krb5confBody, StandardCharsets.UTF_8);
System.setProperty("java.security.krb5.conf", krb5conf.getAbsolutePath());
System.setProperty("sun.security.krb5.debug", "true");
@ -232,10 +219,16 @@ public class SaslKrb5LDAPSecurityTest extends AbstractLdapTestUnit {
refreshMethod.invoke(classRef, new Object[0]);
LOG.debug("krb5.conf to: {}", krb5conf.getAbsolutePath());
if (debug) {
LOG.debug("java.security.krb5.conf='{}'", System.getProperty("java.security.krb5.conf"));
try (BufferedReader br = new BufferedReader(new FileReader(System.getProperty("java.security.krb5.conf")))) {
br.lines().forEach(line -> LOG.debug(line));
}
}
}
private void dumpLdapContents() throws Exception {
EntryFilteringCursor cursor = getService().getAdminSession().search(new Dn("ou=system"), SearchScope.SUBTREE, new PresenceNode("ObjectClass"), AliasDerefMode.DEREF_ALWAYS);
EntryFilteringCursor cursor = (EntryFilteringCursor) getService().getAdminSession().search(new Dn("ou=system"), SearchScope.SUBTREE, new PresenceNode("ObjectClass"), AliasDerefMode.DEREF_ALWAYS);
String st = "";
while (cursor.next()) {
@ -243,9 +236,9 @@ public class SaslKrb5LDAPSecurityTest extends AbstractLdapTestUnit {
String ss = LdifUtils.convertToLdif(entry);
st += ss + "\n";
}
log.debug(st);
LOG.debug(st);
cursor = getService().getAdminSession().search(new Dn("dc=example,dc=com"), SearchScope.SUBTREE, new PresenceNode("ObjectClass"), AliasDerefMode.DEREF_ALWAYS);
cursor = (EntryFilteringCursor) getService().getAdminSession().search(new Dn("dc=example,dc=com"), SearchScope.SUBTREE, new PresenceNode("ObjectClass"), AliasDerefMode.DEREF_ALWAYS);
st = "";
while (cursor.next()) {
@ -253,15 +246,18 @@ public class SaslKrb5LDAPSecurityTest extends AbstractLdapTestUnit {
String ss = LdifUtils.convertToLdif(entry);
st += ss + "\n";
}
log.debug(st);
LOG.debug(st);
}
private void initLogging() {
java.util.logging.Logger logger = java.util.logging.Logger.getLogger("javax.security.sasl");
logger.setLevel(java.util.logging.Level.FINEST);
logger.addHandler(new java.util.logging.ConsoleHandler());
for (java.util.logging.Handler handler: logger.getHandlers()) {
handler.setLevel(java.util.logging.Level.FINEST);
for (java.util.logging.Logger logger : new java.util.logging.Logger[] {java.util.logging.Logger.getLogger("logincontext"),
java.util.logging.Logger.getLogger("javax.security.sasl"),
java.util.logging.Logger.getLogger("org.apache.qpid.proton")}) {
logger.setLevel(java.util.logging.Level.FINEST);
logger.addHandler(new java.util.logging.ConsoleHandler());
for (java.util.logging.Handler handler : logger.getHandlers()) {
handler.setLevel(java.util.logging.Level.FINEST);
}
}
}
@ -276,8 +272,10 @@ public class SaslKrb5LDAPSecurityTest extends AbstractLdapTestUnit {
+ "krb5PrincipalName: " + principal + "@" + getRealm() + "\n"
+ "krb5KeyVersionNumber: 0";
for (LdifEntry ldifEntry : new LdifReader(new StringReader(content))) {
service.getAdminSession().add(new DefaultEntry(service.getSchemaManager(), ldifEntry.getEntry()));
try (LdifReader ldifReader = new LdifReader(new StringReader(content))) {
for (LdifEntry ldifEntry : ldifReader) {
service.getAdminSession().add(new DefaultEntry(service.getSchemaManager(), ldifEntry.getEntry()));
}
}
}
@ -292,7 +290,7 @@ public class SaslKrb5LDAPSecurityTest extends AbstractLdapTestUnit {
for (Map.Entry<EncryptionType, EncryptionKey> entry : KerberosKeyFactory.getKerberosKeys(principal, generatedPassword).entrySet()) {
EncryptionKey ekey = entry.getValue();
byte keyVersion = (byte) ekey.getKeyVersion();
entries.add(new KeytabEntry(principal, 1L, timestamp, keyVersion, ekey));
entries.add(new KeytabEntry(principal, 1, timestamp, keyVersion, ekey));
}
}
keytab.setEntries(entries);

2
tests/integration-tests/src/test/java/org/apache/activemq/artemis/tests/integration/persistence/metrics/JournalPendingMessageTest.java
View File

@ -42,7 +42,7 @@ import org.apache.activemq.artemis.jms.client.ActiveMQConnectionFactory;
import org.apache.activemq.artemis.jms.client.ActiveMQTextMessage;
import org.apache.activemq.artemis.utils.Wait;
import org.apache.activemq.artemis.utils.Wait.Condition;
import org.apache.commons.lang.StringUtils;
import org.apache.commons.lang3.StringUtils;
import org.junit.Before;
import org.junit.Test;
import org.slf4j.Logger;

2
tests/integration-tests/src/test/java/org/apache/activemq/artemis/tests/integration/stomp/StompWebSocketMaxFrameTest.java
View File

@ -24,7 +24,7 @@ import org.apache.activemq.artemis.tests.util.Wait;
import org.apache.activemq.artemis.tests.integration.stomp.util.ClientStompFrame;
import org.apache.activemq.artemis.tests.integration.stomp.util.StompClientConnection;
import org.apache.activemq.artemis.tests.integration.stomp.util.StompClientConnectionFactory;
import org.apache.commons.lang.RandomStringUtils;
import org.apache.commons.lang3.RandomStringUtils;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.junit.runners.Parameterized;

30
tests/integration-tests/src/test/resources/minikdc-krb5-template.conf Normal file
View File

@ -0,0 +1,30 @@
#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
[libdefaults]
kdc_realm = EXAMPLE.COM
default_realm = EXAMPLE.COM
udp_preference_limit = 1
kdc_tcp_port = MINI_KDC_PORT
default_keytab_name = FILE:target/test.krb5.keytab
[realms]
EXAMPLE.COM = {
kdc = localhost:MINI_KDC_PORT
}