Performs a step of SPNEGO authorization by parsing the HTTP Authorization header 'authz_header' and running it through GSSAPI. If authentication fails or the header is invalid, a bad Status will be returned (and the other out-parameters left untouched).
| 281 | // is invalid, a bad Status will be returned (and the other out-parameters left |
| 282 | // untouched). |
| 283 | kudu::Status RunSpnegoStep( |
| 284 | const char* authz_header, vector<string>* response_headers, string* authn_user) { |
| 285 | string neg_token; |
| 286 | if (authz_header && !TryStripPrefixString(authz_header, "Negotiate ", &neg_token)) { |
| 287 | return kudu::Status::InvalidArgument("bad Negotiate header"); |
| 288 | } |
| 289 | |
| 290 | if (!authz_header) { |
| 291 | response_headers->push_back("WWW-Authenticate: Negotiate"); |
| 292 | return kudu::Status::Incomplete("authn incomplete"); |
| 293 | } |
| 294 | |
| 295 | string resp_token_b64; |
| 296 | bool is_complete; |
| 297 | KUDU_RETURN_NOT_OK(kudu::gssapi::SpnegoStep( |
| 298 | neg_token, &resp_token_b64, &is_complete, authn_user)); |
| 299 | |
| 300 | if (!resp_token_b64.empty()) { |
| 301 | response_headers->push_back( |
| 302 | Substitute("WWW-Authenticate: Negotiate $0", resp_token_b64)); |
| 303 | } |
| 304 | return is_complete ? kudu::Status::OK() : kudu::Status::Incomplete("authn incomplete"); |
| 305 | } |
| 306 | |
| 307 | } // anonymous namespace |
| 308 |
no test coverage detected