Function authenticateUserByHTTP

src/Server/HTTP/authenticateUserByHTTP.cpp:69–258

    ContextPtr global_context,
    LoggerPtr log);
bool authenticateUserByHTTP(
    const HTTPServerRequest & request,
    const HTMLForm & params,
    HTTPServerResponse & response,
    Session & session,
    std::unique_ptr<Credentials> & request_credentials,
    const HTTPHandlerConnectionConfig & connection_config,
    ContextPtr global_context,
    LoggerPtr log)
{
    /// Get the credentials created by the previous call of authenticateUserByHTTP() while handling the previous HTTP request.
    auto current_credentials = std::move(request_credentials);
    const auto & config_credentials = connection_config.credentials;

    /// The user and password can be passed by headers (similar to X-Auth-*),
    /// which is used by load balancers to pass authentication information.
    std::string user = request.get("X-ClickHouse-User", "");
    std::string password = request.get("X-ClickHouse-Key", "");
    std::string quota_key = request.get("X-ClickHouse-Quota", "");
    bool has_auth_headers = !user.empty() || !password.empty();

    /// The header 'X-ClickHouse-SSL-Certificate-Auth: on' enables checking the common name
    /// extracted from the SSL certificate used for this connection instead of checking password.
    bool has_ssl_certificate_auth = (request.get("X-ClickHouse-SSL-Certificate-Auth", "") == "on");
    bool has_config_credentials = config_credentials.has_value();

    /// User name and password can be passed using HTTP Basic auth or query parameters
    /// (both methods are insecure).
    bool has_http_credentials = request.hasCredentials() && request.get("Authorization") != "never";
    bool has_credentials_in_query_params = params.has("user") || params.has("password");

    std::string spnego_challenge;
#if USE_SSL
    X509Certificate::Subjects certificate_subjects;

    /// Capture the TLS client certificate (if the client presented one) regardless of the selected
    /// authentication method, so that session_log records it even when the connection authenticates
    /// by another method (headers, basic, query parameters, config) or the login fails.
    /// Mirrors the native protocol path in TCPHandler::receiveHello.
    std::optional<X509Certificate> peer_certificate;
    if (request.havePeerCertificate())
    {
        peer_certificate = request.peerCertificate();
        session.setClientCertificate(*peer_certificate);
    }
#endif

    if (config_credentials)
    {
        checkUserNameNotEmptyAndServerHasEnoughMemory(config_credentials->getUserName(), "config authentication", global_context);
    }
    if (has_ssl_certificate_auth)
    {
#if USE_SSL
        /// For SSL certificate authentication we extract the user name from the "X-ClickHouse-User" HTTP header.
        checkUserNameNotEmptyAndServerHasEnoughMemory(user, "X-ClickHouse HTTP headers", global_context);

        /// It is prohibited to mix different authorization schemes.