| 831 | } |
| 832 | |
| 833 | bool OAuthTokenAuth(ThriftServer::ConnectionContext* connection_context, |
| 834 | const AuthenticationHash& hash, const string& token) { |
| 835 | JWTHelper::UniqueJWTDecodedToken decoded_token; |
| 836 | Status status = JWTHelper::Decode(token, decoded_token); |
| 837 | if (!status.ok()) { |
| 838 | LOG(ERROR) << "Error decoding OAuth token received from: " |
| 839 | << TNetworkAddressToString(connection_context->network_address) |
| 840 | << " Error: " << status; |
| 841 | return false; |
| 842 | } |
| 843 | if (FLAGS_oauth_jwt_validate_signature) { |
| 844 | status = ExecEnv::GetInstance()->GetOAuthHelperInstance()->Verify( |
| 845 | decoded_token.get()); |
| 846 | if (!status.ok()) { |
| 847 | LOG(ERROR) << "Error verifying OAuth token received from: " |
| 848 | << TNetworkAddressToString(connection_context->network_address) |
| 849 | << " Error: " << status; |
| 850 | connection_context->return_headers.push_back( |
| 851 | Substitute("WWW-Authenticate: Bearer error=\"invalid_token\",\ |
| 852 | error_description=\"$0 \"", status.GetDetail())); |
| 853 | return false; |
| 854 | } |
| 855 | } |
| 856 | |
| 857 | DCHECK(!FLAGS_oauth_jwt_custom_claim_username.empty()); |
| 858 | string username; |
| 859 | status = JWTHelper::GetCustomClaimUsername( |
| 860 | decoded_token.get(), FLAGS_oauth_jwt_custom_claim_username, username); |
| 861 | if (!status.ok()) { |
| 862 | LOG(ERROR) << "Error extracting username from OAuth token received from: " |
| 863 | << TNetworkAddressToString(connection_context->network_address) |
| 864 | << " Error: " << status; |
| 865 | return false; |
| 866 | } |
| 867 | connection_context->username = username; |
| 868 | |
| 869 | // Create a cookie to return. |
| 870 | connection_context->return_headers.push_back( |
| 871 | Substitute("Set-Cookie: $0", GenerateCookie(username, hash, HTTP_AUTH_MECH_OAUTH))); |
| 872 | return true; |
| 873 | } |
| 874 | |
| 875 | // Performs a step of SPNEGO auth for the HTTP transport and sets the username and |
| 876 | // kerberos_user_principal on 'connection_context' if auth is successful. |
no test coverage detected