Apache
/
druid
mirror of https://github.com/apache/druid.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Revert "Fix HTTP OPTIONS request auth handling (#5615)" (#5637) 

This reverts commit df51a7bcb7.
This commit is contained in:
Jonathan Wei 2018-04-12 16:43:54 -07:00 committed by GitHub
parent e91add6843
commit 882b172318
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
10 changed files with 15 additions and 142 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/content/configuration/auth.md
View File

@ -10,7 +10,6 @@ layout: doc_page
|`druid.escalator.type`|String|Type of the Escalator that should be used for internal Druid communications. This Escalator must use an authentication scheme that is supported by an Authenticator in `druid.auth.authenticationChain`.|"noop"|no|
|`druid.auth.authorizers`|JSON List of Strings|List of Authorizer type names |["allowAll"]|no|
|`druid.auth.unsecuredPaths`| List of Strings|List of paths for which security checks will not be performed. All requests to these paths will be allowed.|[]|no|
|`druid.auth.disableHttpOptionsAuthentication`|Boolean|If true, skip authentication checks for HTTP OPTIONS requests. Note that disabling authentication checks for OPTIONS requests will allow unauthenticated users to determine what Druid endpoints are valid, and this may leak sensitive information (for example, the `/druid/indexer/v1//task/{taskid}` endpoint on the Overlord and `/druid/coordinator/v1/datasources` endpoints on the Coordinator contain resource names), so the authentication checks should not be disabled unless truly necessary. |false|no|
## Enabling Authentication/Authorization

12
integration-tests/src/test/java/io/druid/tests/security/ITBasicAuthConfigurationTest.java
View File

@ -224,18 +224,6 @@ public class ITBasicAuthConfigurationTest
LOG.info("Testing Avatica query on router with incorrect credentials.");
testAvaticaAuthFailure(routerUrl);
LOG.info("Checking OPTIONS requests on services...");
testOptionsRequests(adminClient);
}
private void testOptionsRequests(HttpClient httpClient)
{
makeRequest(httpClient, HttpMethod.OPTIONS, config.getCoordinatorUrl() + "/status", null);
makeRequest(httpClient, HttpMethod.OPTIONS, config.getIndexerUrl() + "/status", null);
makeRequest(httpClient, HttpMethod.OPTIONS, config.getBrokerUrl() + "/status", null);
makeRequest(httpClient, HttpMethod.OPTIONS, config.getHistoricalUrl() + "/status", null);
makeRequest(httpClient, HttpMethod.OPTIONS, config.getRouterUrl() + "/status", null);
}
private void checkUnsecuredCoordinatorLoadQueuePath(HttpClient client)

77
server/src/main/java/io/druid/server/security/AllowOptionsResourceFilter.java
View File

@ -1,77 +0,0 @@
/*
* Licensed to Metamarkets Group Inc. (Metamarkets) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. Metamarkets licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package io.druid.server.security;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.ws.rs.HttpMethod;
import java.io.IOException;
public class AllowOptionsResourceFilter implements Filter
{
private final boolean disableAuthentication;
public AllowOptionsResourceFilter(
boolean disableAuthentication
)
{
this.disableAuthentication = disableAuthentication;
}
@Override
public void init(FilterConfig filterConfig) throws ServletException
{
}
@Override
public void doFilter(
ServletRequest request, ServletResponse response, FilterChain chain
) throws IOException, ServletException
{
HttpServletRequest httpReq = (HttpServletRequest) request;
// Druid itself doesn't explictly handle OPTIONS requests, no resource handler will authorize such requests.
// so this filter catches all OPTIONS requests and authorizes them.
if (HttpMethod.OPTIONS.equals(httpReq.getMethod())) {
if (disableAuthentication) {
httpReq.setAttribute(
AuthConfig.DRUID_AUTHENTICATION_RESULT,
new AuthenticationResult(AuthConfig.ALLOW_ALL_NAME, AuthConfig.ALLOW_ALL_NAME, null)
);
}
httpReq.setAttribute(AuthConfig.DRUID_AUTHORIZATION_CHECKED, true);
}
chain.doFilter(request, response);
}
@Override
public void destroy()
{
}
}

45
server/src/main/java/io/druid/server/security/AuthConfig.java
View File

@ -44,23 +44,19 @@ public class AuthConfig
public AuthConfig()
{
this(null, null, null, null);
this(null, null, null);
}
@JsonCreator
public AuthConfig(
@JsonProperty("authenticatorChain") List<String> authenticationChain,
@JsonProperty("authorizers") List<String> authorizers,
@JsonProperty("unsecuredPaths") List<String> unsecuredPaths,
@JsonProperty("disableHttpOptionsAuthentication") Boolean disableHttpOptionsAuthentication
@JsonProperty("unsecuredPaths") List<String> unsecuredPaths
)
{
this.authenticatorChain = authenticationChain;
this.authorizers = authorizers;
this.unsecuredPaths = unsecuredPaths == null ? Collections.emptyList() : unsecuredPaths;
this.disableHttpOptionsAuthentication = disableHttpOptionsAuthentication == null
? false
: disableHttpOptionsAuthentication;
}
@JsonProperty
@ -72,9 +68,6 @@ public class AuthConfig
@JsonProperty
private final List<String> unsecuredPaths;
@JsonProperty
private final boolean disableHttpOptionsAuthentication;
public List<String> getAuthenticatorChain()
{
return authenticatorChain;
@ -90,9 +83,14 @@ public class AuthConfig
return unsecuredPaths;
}
public boolean isDisableHttpOptionsAuthentication()
@Override
public String toString()
{
return disableHttpOptionsAuthentication;
return "AuthConfig{" +
"authenticatorChain='" + authenticatorChain + '\'' +
", authorizers='" + authorizers + '\'' +
", unsecuredPaths='" + unsecuredPaths + '\'' +
'}';
}
@Override
@ -105,31 +103,14 @@ public class AuthConfig
return false;
}
AuthConfig that = (AuthConfig) o;
return isDisableHttpOptionsAuthentication() == that.isDisableHttpOptionsAuthentication() &&
Objects.equals(getAuthenticatorChain(), that.getAuthenticatorChain()) &&
Objects.equals(getAuthorizers(), that.getAuthorizers()) &&
Objects.equals(getUnsecuredPaths(), that.getUnsecuredPaths());
return Objects.equals(authenticatorChain, that.authenticatorChain) &&
Objects.equals(authorizers, that.authorizers) &&
Objects.equals(unsecuredPaths, that.unsecuredPaths);
}
@Override
public int hashCode()
{
return Objects.hash(
getAuthenticatorChain(),
getAuthorizers(),
getUnsecuredPaths(),
isDisableHttpOptionsAuthentication()
);
}
@Override
public String toString()
{
return "AuthConfig{" +
"authenticatorChain=" + authenticatorChain +
", authorizers=" + authorizers +
", unsecuredPaths=" + unsecuredPaths +
", disableHttpOptionsAuthentication=" + disableHttpOptionsAuthentication +
'}';
return Objects.hash(authenticatorChain, authorizers, unsecuredPaths);
}
}

10
server/src/main/java/io/druid/server/security/AuthenticationUtils.java
View File

@ -27,16 +27,6 @@ import java.util.List;
public class AuthenticationUtils
{
public static void addAllowOptionsFilter(ServletContextHandler root, boolean disableHttpOptionsAuthentication)
{
FilterHolder holder = new FilterHolder(new AllowOptionsResourceFilter(disableHttpOptionsAuthentication));
root.addFilter(
holder,
"/*",
null
);
}
public static void addAuthenticationFilterChain(
ServletContextHandler root,
List<Authenticator> authenticators

2
services/src/main/java/io/druid/cli/CliOverlord.java
View File

@ -344,8 +344,6 @@ public class CliOverlord extends ServerRunnable
AuthenticationUtils.addNoopAuthorizationFilters(root, UNSECURED_PATHS);
AuthenticationUtils.addNoopAuthorizationFilters(root, authConfig.getUnsecuredPaths());
AuthenticationUtils.addAllowOptionsFilter(root, authConfig.isDisableHttpOptionsAuthentication());
authenticators = authenticatorMapper.getAuthenticatorChain();
AuthenticationUtils.addAuthenticationFilterChain(root, authenticators);

3
services/src/main/java/io/druid/cli/CoordinatorJettyServerInitializer.java
View File

@ -125,13 +125,12 @@ class CoordinatorJettyServerInitializer implements JettyServerInitializer
AuthenticationUtils.addNoopAuthorizationFilters(root, CliOverlord.UNSECURED_PATHS);
}
AuthenticationUtils.addAllowOptionsFilter(root, authConfig.isDisableHttpOptionsAuthentication());
authenticators = authenticatorMapper.getAuthenticatorChain();
AuthenticationUtils.addAuthenticationFilterChain(root, authenticators);
JettyServerInitUtils.addExtensionFilters(root, injector);
// Check that requests were authorized before sending responses
AuthenticationUtils.addPreResponseAuthorizationCheckFilter(
root,

3
services/src/main/java/io/druid/cli/MiddleManagerJettyServerInitializer.java
View File

@ -78,11 +78,10 @@ class MiddleManagerJettyServerInitializer implements JettyServerInitializer
AuthenticationUtils.addNoopAuthorizationFilters(root, UNSECURED_PATHS);
AuthenticationUtils.addNoopAuthorizationFilters(root, authConfig.getUnsecuredPaths());
AuthenticationUtils.addAllowOptionsFilter(root, authConfig.isDisableHttpOptionsAuthentication());
authenticators = authenticatorMapper.getAuthenticatorChain();
AuthenticationUtils.addAuthenticationFilterChain(root, authenticators);
JettyServerInitUtils.addExtensionFilters(root, injector);
// Check that requests were authorized before sending responses

2
services/src/main/java/io/druid/cli/QueryJettyServerInitializer.java
View File

@ -102,8 +102,6 @@ public class QueryJettyServerInitializer implements JettyServerInitializer
AuthenticationUtils.addNoopAuthorizationFilters(root, UNSECURED_PATHS);
AuthenticationUtils.addNoopAuthorizationFilters(root, authConfig.getUnsecuredPaths());
AuthenticationUtils.addAllowOptionsFilter(root, authConfig.isDisableHttpOptionsAuthentication());
authenticators = authenticatorMapper.getAuthenticatorChain();
AuthenticationUtils.addAuthenticationFilterChain(root, authenticators);

2
services/src/main/java/io/druid/cli/RouterJettyServerInitializer.java
View File

@ -111,8 +111,6 @@ public class RouterJettyServerInitializer implements JettyServerInitializer
AuthenticationUtils.addNoopAuthorizationFilters(root, UNSECURED_PATHS);
AuthenticationUtils.addNoopAuthorizationFilters(root, authConfig.getUnsecuredPaths());
AuthenticationUtils.addAllowOptionsFilter(root, authConfig.isDisableHttpOptionsAuthentication());
final List<Authenticator> authenticators = authenticatorMapper.getAuthenticatorChain();
AuthenticationUtils.addAuthenticationFilterChain(root, authenticators);