Authorizes authenticated users on an internal connection after validating that the first components of the 'requested_user' and our principal are the same. conn: Sasl connection - Ignored context: Always NULL except for testing. requested_user: The identity/username to authorize rlen: Length of above auth_identity: "The identity associated with the secret" alen: Length of above def_realm: Default
| 529 | // propctx: Auxiliary properties - Ignored |
| 530 | // Return: SASL_OK |
| 531 | int SaslAuthorizeInternal(sasl_conn_t* conn, void* context, |
| 532 | const char* requested_user, unsigned rlen, |
| 533 | const char* auth_identity, unsigned alen, |
| 534 | const char* def_realm, unsigned urlen, |
| 535 | struct propctx* propctx) { |
| 536 | string requested_principal(requested_user, rlen); |
| 537 | vector<string> names; |
| 538 | split(names, requested_principal, is_any_of("/@")); |
| 539 | |
| 540 | if (names.size() != 3) { |
| 541 | LOG(INFO) << "Kerberos principal should be of the form: " |
| 542 | << "<service>/<hostname>@<realm> - got: " << requested_user; |
| 543 | return SASL_BADAUTH; |
| 544 | } |
| 545 | SecureAuthProvider* internal_auth_provider; |
| 546 | if (context == NULL) { |
| 547 | internal_auth_provider = static_cast<SecureAuthProvider*>( |
| 548 | AuthManager::GetInstance()->GetInternalAuthProvider()); |
| 549 | } else { |
| 550 | // Branch should only be taken for testing, where context is used to inject an auth |
| 551 | // provider. |
| 552 | internal_auth_provider = static_cast<SecureAuthProvider*>(context); |
| 553 | } |
| 554 | |
| 555 | vector<string> whitelist; |
| 556 | split(whitelist, FLAGS_internal_principals_whitelist, is_any_of(",")); |
| 557 | whitelist.push_back(internal_auth_provider->service_name()); |
| 558 | for (string& s: whitelist) { |
| 559 | trim(s); |
| 560 | if (s.empty()) continue; |
| 561 | if (names[0] == s) { |
| 562 | // We say "principal" here becase this is for internal communication, and hence |
| 563 | // ought always be --principal or --be_principal |
| 564 | VLOG(1) << "Successfully authenticated principal \"" << requested_principal |
| 565 | << "\" on an internal connection"; |
| 566 | return SASL_OK; |
| 567 | } |
| 568 | } |
| 569 | string expected_names = FLAGS_internal_principals_whitelist.empty() ? "" : |
| 570 | Substitute(" or one of $0", FLAGS_internal_principals_whitelist); |
| 571 | LOG(INFO) << "Principal \"" << requested_principal << "\" not authenticated. " |
| 572 | << "Reason: 'service' does not match from <service>/<hostname>@<realm>.\n" |
| 573 | << "Got: " << names[0] |
| 574 | << ". Expected: " << internal_auth_provider->service_name() << expected_names; |
| 575 | return SASL_BADAUTH; |
| 576 | } |
| 577 | |
| 578 | // If Kerberos and LDAP authentications are enabled and |
| 579 | // enable_group_filter_check_for_authenticated_kerberos_user flag is set, |