mirror of https://github.com/apache/jclouds.git
Issue 86: authentication filter for Microsoft Azure Storage
git-svn-id: http://jclouds.googlecode.com/svn/trunk@1863 3d8758e0-26b5-11de-8745-db77d3ebf521
This commit is contained in:
adrian.f.cole
parent
a0192989d4
commit
e3b3ca5e6f
|
|
@ -0,0 +1,200 @@
|
|||
package org.jclouds.azure.storage.filters;
|
||||
|
||||
import java.util.Collection;
|
||||
import java.util.Collections;
|
||||
import java.util.Set;
|
||||
import java.util.SortedSet;
|
||||
import java.util.concurrent.atomic.AtomicLong;
|
||||
import java.util.concurrent.atomic.AtomicReference;
|
||||
|
||||
import javax.ws.rs.core.HttpHeaders;
|
||||
|
||||
import org.jclouds.azure.storage.reference.AzureStorageConstants;
|
||||
import org.jclouds.http.HttpException;
|
||||
import org.jclouds.http.HttpRequest;
|
||||
import org.jclouds.http.HttpRequestFilter;
|
||||
import org.jclouds.http.HttpUtils;
|
||||
import org.jclouds.util.DateService;
|
||||
|
||||
import com.google.common.annotations.VisibleForTesting;
|
||||
import com.google.common.base.Function;
|
||||
import com.google.common.base.Predicate;
|
||||
import com.google.common.collect.Iterables;
|
||||
import com.google.common.collect.Sets;
|
||||
import com.google.inject.Inject;
|
||||
import com.google.inject.Singleton;
|
||||
import com.google.inject.name.Named;
|
||||
|
||||
/**
|
||||
* Signs the Azure Storage request. This will update timestamps at most once per second.
|
||||
*
|
||||
* @see <a href= "http://msdn.microsoft.com/en-us/library/dd179428.aspx" />
|
||||
* @author Adrian Cole
|
||||
*
|
||||
*/
|
||||
@Singleton
|
||||
public class SharedKeyAuthentication implements HttpRequestFilter {
|
||||
private final String[] firstHeadersToSign = new String[] { "Content-MD5",
|
||||
HttpHeaders.CONTENT_TYPE, HttpHeaders.DATE };
|
||||
|
||||
private final String account;
|
||||
private byte[] key;
|
||||
private final DateService dateService;
|
||||
|
||||
public final long BILLION = 1000000000;
|
||||
private final AtomicReference<String> timeStamp;
|
||||
private final AtomicLong trigger = new AtomicLong(System.nanoTime() + 1 * BILLION);
|
||||
|
||||
/**
|
||||
* Start the time update service. Azure clocks need to be within 900 seconds of the request time.
|
||||
* This method updates the clock every second. This is not performed per-request, as creation of
|
||||
* the date object is a slow, synchronized command.
|
||||
*/
|
||||
synchronized void updateIfTimeOut() {
|
||||
|
||||
if (trigger.get() - System.nanoTime() <= 0) {
|
||||
timeStamp.set(createNewStamp());
|
||||
trigger.set(System.nanoTime() + 1 * BILLION);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
// this is a hotspot when submitted concurrently, so be lazy.
|
||||
// amazon is ok with up to 15 minutes off their time, so let's
|
||||
// be as lazy as possible.
|
||||
String createNewStamp() {
|
||||
return dateService.rfc822DateFormat();
|
||||
}
|
||||
|
||||
public String timestampAsHeaderString() {
|
||||
updateIfTimeOut();
|
||||
return timeStamp.get();
|
||||
}
|
||||
|
||||
@Inject
|
||||
public SharedKeyAuthentication(
|
||||
@Named(AzureStorageConstants.PROPERTY_AZURESTORAGE_ACCOUNT) String account,
|
||||
@Named(AzureStorageConstants.PROPERTY_AZURESTORAGE_KEY) String encodedKey,
|
||||
DateService dateService) {
|
||||
this.account = account;
|
||||
this.key = HttpUtils.fromBase64String(encodedKey);
|
||||
this.dateService = dateService;
|
||||
timeStamp = new AtomicReference<String>(createNewStamp());
|
||||
}
|
||||
|
||||
public HttpRequest filter(HttpRequest request) throws HttpException {
|
||||
replaceDateHeader(request);
|
||||
String toSign = createStringToSign(request);
|
||||
calculateAndReplaceAuthHeader(request, toSign);
|
||||
return request;
|
||||
}
|
||||
|
||||
public String createStringToSign(HttpRequest request) {
|
||||
StringBuilder buffer = new StringBuilder();
|
||||
// re-sign the request
|
||||
appendMethod(request, buffer);
|
||||
appendHttpHeaders(request, buffer);
|
||||
appendCanonicalizedHeaders(request, buffer);
|
||||
appendCanonicalizedResource(request, buffer);
|
||||
return buffer.toString();
|
||||
}
|
||||
|
||||
private void calculateAndReplaceAuthHeader(HttpRequest request, String toSign)
|
||||
throws HttpException {
|
||||
String signature = signString(toSign);
|
||||
request.getHeaders().replaceValues(HttpHeaders.AUTHORIZATION,
|
||||
Collections.singletonList("SharedKey " + account + ":" + signature));
|
||||
}
|
||||
|
||||
public String signString(String toSign) {
|
||||
String signature;
|
||||
try {
|
||||
signature = HttpUtils.hmacSha256Base64(toSign, key);
|
||||
} catch (Exception e) {
|
||||
throw new HttpException("error signing request", e);
|
||||
}
|
||||
return signature;
|
||||
}
|
||||
|
||||
private void appendMethod(HttpRequest request, StringBuilder toSign) {
|
||||
toSign.append(request.getMethod()).append("\n");
|
||||
}
|
||||
|
||||
private void replaceDateHeader(HttpRequest request) {
|
||||
request.getHeaders().replaceValues(HttpHeaders.DATE,
|
||||
Collections.singletonList(timestampAsHeaderString()));
|
||||
}
|
||||
|
||||
private void appendCanonicalizedHeaders(HttpRequest request, StringBuilder toSign) {
|
||||
|
||||
// Retrieve all headers for the resource that begin with x-ms-, including the x-ms-date
|
||||
// header.
|
||||
Set<String> matchingHeaders = Sets.filter(request.getHeaders().keySet(),
|
||||
new Predicate<String>() {
|
||||
public boolean apply(String input) {
|
||||
return input.startsWith("x-ms-");
|
||||
}
|
||||
});
|
||||
|
||||
// Convert each HTTP header name to lowercase.
|
||||
// Sort the container of headers lexicographically by header name, in ascending order.
|
||||
SortedSet<String> lowercaseHeaders = Sets.newTreeSet(Iterables.transform(matchingHeaders,
|
||||
new Function<String, String>() {
|
||||
public String apply(String from) {
|
||||
return from.toLowerCase();
|
||||
}
|
||||
}));
|
||||
|
||||
for (String header : lowercaseHeaders) {
|
||||
// Combine headers with the same name into one header. The resulting header should be a
|
||||
// name-value pair of the format "header-name:comma-separated-value-list", without any
|
||||
// white
|
||||
// space between values.
|
||||
toSign.append(header).append(":");
|
||||
// Trim any white space around the colon in the header.
|
||||
// TODO: not sure why there would be...
|
||||
for (String value : request.getHeaders().get(header))
|
||||
// Replace any breaking white space with a single space.
|
||||
toSign.append(value.replaceAll("\r?\n", " ")).append(",");
|
||||
toSign.deleteCharAt(toSign.lastIndexOf(","));
|
||||
// Finally, append a new line character to each canonicalized header in the resulting list.
|
||||
// Construct the CanonicalizedHeaders string by concatenating all headers in this list into
|
||||
// a
|
||||
// single string.
|
||||
toSign.append("\n");
|
||||
}
|
||||
}
|
||||
|
||||
private void appendHttpHeaders(HttpRequest request, StringBuilder toSign) {
|
||||
for (String header : firstHeadersToSign)
|
||||
toSign.append(valueOrEmpty(request.getHeaders().get(header))).append("\n");
|
||||
}
|
||||
|
||||
@VisibleForTesting
|
||||
void appendCanonicalizedResource(HttpRequest request, StringBuilder toSign) {
|
||||
|
||||
// 1. Beginning with an empty string (""), append a forward slash (/), followed by the name of
|
||||
// the account that owns the resource being accessed.
|
||||
toSign.append("/").append(account);
|
||||
appendUriPath(request, toSign);
|
||||
}
|
||||
|
||||
@VisibleForTesting
|
||||
void appendUriPath(HttpRequest request, StringBuilder toSign) {
|
||||
// 2. Append the resource's encoded URI path
|
||||
toSign.append(request.getEndpoint().getRawPath());
|
||||
|
||||
// If the request URI addresses a component of the
|
||||
// resource, append the appropriate query string. The query string should include the question
|
||||
// mark and the comp parameter (for example, ?comp=metadata). No other parameters should be
|
||||
// included on the query string.
|
||||
if (request.getEndpoint().getQuery() != null) {
|
||||
// TODO: determine what components of the query string are really needed.
|
||||
toSign.append("?").append(request.getEndpoint().getQuery());
|
||||
}
|
||||
}
|
||||
|
||||
private String valueOrEmpty(Collection<String> collection) {
|
||||
return (collection != null && collection.size() >= 1) ? collection.iterator().next() : "";
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
package org.jclouds.azure.storage.reference;
|
||||
|
||||
/**
|
||||
* Configuration properties and constants used in Azure Storage connections.
|
||||
*
|
||||
* @author Adrian Cole
|
||||
*/
|
||||
public interface AzureStorageConstants {
|
||||
public static final String PROPERTY_AZURESTORAGE_ACCOUNT = "jclouds.azure.storage.account";
|
||||
public static final String PROPERTY_AZURESTORAGE_KEY = "jclouds.azure.storage.key";
|
||||
}
|
||||
|
|
@ -0,0 +1,77 @@
|
|||
package org.jclouds.azure.storage.filters;
|
||||
|
||||
import java.net.URI;
|
||||
|
||||
import javax.ws.rs.GET;
|
||||
import javax.ws.rs.Path;
|
||||
import static org.testng.Assert.assertTrue;
|
||||
import org.jclouds.azure.storage.reference.AzureStorageConstants;
|
||||
import org.jclouds.concurrent.WithinThreadExecutorService;
|
||||
import org.jclouds.concurrent.config.ExecutorServiceModule;
|
||||
import org.jclouds.http.config.JavaUrlHttpCommandExecutorServiceModule;
|
||||
import org.jclouds.logging.log4j.config.Log4JLoggingModule;
|
||||
import org.jclouds.rest.Query;
|
||||
import org.jclouds.rest.RequestFilters;
|
||||
import org.jclouds.rest.RestClientFactory;
|
||||
import org.jclouds.rest.config.JaxrsModule;
|
||||
import org.testng.annotations.BeforeClass;
|
||||
import org.testng.annotations.Test;
|
||||
|
||||
import com.google.inject.AbstractModule;
|
||||
import com.google.inject.Guice;
|
||||
import com.google.inject.Injector;
|
||||
import com.google.inject.name.Names;
|
||||
|
||||
/**
|
||||
* Tests behavior of {@code JaxrsAnnotationProcessor}
|
||||
*
|
||||
* @author Adrian Cole
|
||||
*/
|
||||
@Test(groups = "live", testName = "azure.SharedKeyAuthenticationLiveTest")
|
||||
public class SharedKeyAuthenticationLiveTest {
|
||||
|
||||
@RequestFilters(SharedKeyAuthentication.class)
|
||||
public interface IntegrationTestClient {
|
||||
|
||||
@GET
|
||||
@Path("/")
|
||||
@Query(key = "comp", value = "list")
|
||||
String authenticate();
|
||||
|
||||
}
|
||||
|
||||
protected static final String sysAzureStorageAccount = System
|
||||
.getProperty(AzureStorageConstants.PROPERTY_AZURESTORAGE_ACCOUNT);
|
||||
protected static final String sysAzureStorageKey = System
|
||||
.getProperty(AzureStorageConstants.PROPERTY_AZURESTORAGE_KEY);
|
||||
private Injector injector;
|
||||
private IntegrationTestClient client;
|
||||
private String uri;
|
||||
|
||||
@Test
|
||||
public void testAuthentication() throws Exception {
|
||||
String response = client.authenticate();
|
||||
assertTrue(response.contains(uri), String.format("expected %s to contain %s", response, uri));
|
||||
}
|
||||
|
||||
@BeforeClass
|
||||
void setupFactory() {
|
||||
injector = Guice.createInjector(new AbstractModule() {
|
||||
|
||||
@Override
|
||||
protected void configure() {
|
||||
bindConstant().annotatedWith(
|
||||
Names.named(AzureStorageConstants.PROPERTY_AZURESTORAGE_ACCOUNT)).to(
|
||||
sysAzureStorageAccount);
|
||||
bindConstant().annotatedWith(
|
||||
Names.named(AzureStorageConstants.PROPERTY_AZURESTORAGE_KEY)).to(
|
||||
sysAzureStorageKey);
|
||||
}
|
||||
|
||||
}, new JaxrsModule(), new Log4JLoggingModule(), new ExecutorServiceModule(
|
||||
new WithinThreadExecutorService()), new JavaUrlHttpCommandExecutorServiceModule());
|
||||
RestClientFactory factory = injector.getInstance(RestClientFactory.class);
|
||||
uri = "http://" + sysAzureStorageAccount + ".blob.core.windows.net";
|
||||
client = factory.create(URI.create(uri), IntegrationTestClient.class);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,140 @@
|
|||
/**
|
||||
*
|
||||
* Copyright (C) 2009 Global Cloud Specialists, Inc. <info@globalcloudspecialists.com>
|
||||
*
|
||||
* ====================================================================
|
||||
* Licensed to the Apache Software Foundation (ASF) under one
|
||||
* or more contributor license agreements. See the NOTICE file
|
||||
* distributed with this work for additional information
|
||||
* regarding copyright ownership. The ASF licenses this file
|
||||
* to you under the Apache License, Version 2.0 (the
|
||||
* "License"); you may not use this file except in compliance
|
||||
* with the License. You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing,
|
||||
* software distributed under the License is distributed on an
|
||||
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
* KIND, either express or implied. See the License for the
|
||||
* specific language governing permissions and limitations
|
||||
* under the License.
|
||||
* ====================================================================
|
||||
*/
|
||||
package org.jclouds.azure.storage.filters;
|
||||
|
||||
import static org.testng.Assert.assertEquals;
|
||||
|
||||
import java.net.URI;
|
||||
|
||||
import javax.ws.rs.HttpMethod;
|
||||
import javax.ws.rs.core.HttpHeaders;
|
||||
|
||||
import org.jclouds.azure.storage.reference.AzureStorageConstants;
|
||||
import org.jclouds.http.HttpRequest;
|
||||
import org.jclouds.http.HttpUtils;
|
||||
import org.jclouds.util.DateService;
|
||||
import org.testng.annotations.BeforeClass;
|
||||
import org.testng.annotations.DataProvider;
|
||||
import org.testng.annotations.Test;
|
||||
|
||||
import com.google.inject.AbstractModule;
|
||||
import com.google.inject.Guice;
|
||||
import com.google.inject.Injector;
|
||||
import com.google.inject.name.Names;
|
||||
|
||||
@Test(groups = "unit", testName = "azurestorage.SharedKeyAuthenticationTest")
|
||||
public class SharedKeyAuthenticationTest {
|
||||
|
||||
private static final String KEY = HttpUtils.toBase64String("bar".getBytes());
|
||||
private static final String ACCOUNT = "foo";
|
||||
private Injector injector;
|
||||
private SharedKeyAuthentication filter;
|
||||
|
||||
@DataProvider(parallel = true)
|
||||
public Object[][] dataProvider() {
|
||||
return new Object[][] {
|
||||
{ new HttpRequest(
|
||||
HttpMethod.PUT,
|
||||
URI
|
||||
.create("http://"
|
||||
+ ACCOUNT
|
||||
+ ".blob.core.windows.net/movies/MOV1.avi?comp=block&blockid=BlockId1&timeout=60")) },
|
||||
{ new HttpRequest(HttpMethod.PUT, URI.create("http://" + ACCOUNT
|
||||
+ ".blob.core.windows.net/movies/MOV1.avi?comp=blocklist&timeout=120")) },
|
||||
{ new HttpRequest(HttpMethod.GET, URI.create("http://" + ACCOUNT
|
||||
+ ".blob.core.windows.net/movies/MOV1.avi")) } };
|
||||
}
|
||||
|
||||
/**
|
||||
* NOTE this test is dependent on how frequently the timestamp updates. At the time of writing,
|
||||
* this was once per second. If this timestamp update interval is increased, it could make this
|
||||
* test appear to hang for a long time.
|
||||
*/
|
||||
@Test(threadPoolSize = 3, dataProvider = "dataProvider", timeOut = 3000)
|
||||
void testIdempotent(HttpRequest request) {
|
||||
filter.filter(request);
|
||||
String signature = request.getFirstHeaderOrNull(HttpHeaders.AUTHORIZATION);
|
||||
String date = request.getFirstHeaderOrNull(HttpHeaders.DATE);
|
||||
int iterations = 1;
|
||||
while (filter.filter(request).getFirstHeaderOrNull(HttpHeaders.DATE).equals(date)) {
|
||||
iterations++;
|
||||
assertEquals(signature, request.getFirstHeaderOrNull(HttpHeaders.AUTHORIZATION));
|
||||
}
|
||||
System.out.printf("%s: %d iterations before the timestamp updated %n", Thread.currentThread()
|
||||
.getName(), iterations);
|
||||
}
|
||||
|
||||
@Test
|
||||
void testAclQueryStringRoot() {
|
||||
URI host = URI.create("http://" + ACCOUNT + ".blob.core.windows.net/?comp=list");
|
||||
HttpRequest request = new HttpRequest(HttpMethod.GET, host);
|
||||
StringBuilder builder = new StringBuilder();
|
||||
filter.appendUriPath(request, builder);
|
||||
assertEquals(builder.toString(), "/?comp=list");
|
||||
}
|
||||
|
||||
@Test
|
||||
void testAclQueryStringRelative() {
|
||||
URI host = URI.create("http://" + ACCOUNT
|
||||
+ ".blob.core.windows.net/mycontainer?restype=container");
|
||||
HttpRequest request = new HttpRequest(HttpMethod.GET, host);
|
||||
StringBuilder builder = new StringBuilder();
|
||||
filter.appendUriPath(request, builder);
|
||||
assertEquals(builder.toString(), "/mycontainer?restype=container");
|
||||
}
|
||||
|
||||
@Test
|
||||
void testUpdatesOnlyOncePerSecond() throws NoSuchMethodException, InterruptedException {
|
||||
// filter.createNewStamp();
|
||||
String timeStamp = filter.timestampAsHeaderString();
|
||||
// replay(filter);
|
||||
for (int i = 0; i < 10; i++)
|
||||
filter.updateIfTimeOut();
|
||||
assert timeStamp.equals(filter.timestampAsHeaderString());
|
||||
Thread.sleep(1000);
|
||||
assert !timeStamp.equals(filter.timestampAsHeaderString());
|
||||
// verify(filter);
|
||||
}
|
||||
|
||||
/**
|
||||
* before class, as we need to ensure that the filter is threadsafe.
|
||||
*
|
||||
*/
|
||||
@BeforeClass
|
||||
protected void createFilter() {
|
||||
injector = Guice.createInjector(new AbstractModule() {
|
||||
|
||||
protected void configure() {
|
||||
bindConstant().annotatedWith(
|
||||
Names.named(AzureStorageConstants.PROPERTY_AZURESTORAGE_ACCOUNT)).to(ACCOUNT);
|
||||
bindConstant().annotatedWith(
|
||||
Names.named(AzureStorageConstants.PROPERTY_AZURESTORAGE_KEY)).to(KEY);
|
||||
bind(DateService.class);
|
||||
|
||||
}
|
||||
});
|
||||
filter = injector.getInstance(SharedKeyAuthentication.class);
|
||||
}
|
||||
|
||||
}
|
||||
Loading…
Reference in New Issue