| 1466 | } |
| 1467 | |
| 1468 | Status SecureAuthProvider::GetServerTransportFactory( |
| 1469 | ThriftServer::TransportType underlying_transport_type, const std::string& server_name, |
| 1470 | MetricGroup* metrics, std::shared_ptr<TTransportFactory>* factory) { |
| 1471 | DCHECK(!principal_.empty() || has_ldap_ || has_saml_ || has_jwt_ || has_oauth_); |
| 1472 | |
| 1473 | if (underlying_transport_type == ThriftServer::HTTP) { |
| 1474 | bool has_kerberos = !principal_.empty(); |
| 1475 | bool use_cookies = FLAGS_max_cookie_lifetime_s > 0; |
| 1476 | bool check_trusted_domain = !FLAGS_trusted_domain.empty(); |
| 1477 | bool check_trusted_auth_header = !FLAGS_trusted_auth_header.empty(); |
| 1478 | factory->reset(new THttpServerTransportFactory(server_name, metrics, has_ldap_, |
| 1479 | has_kerberos, use_cookies, check_trusted_domain, check_trusted_auth_header, |
| 1480 | has_saml_, has_jwt_, has_oauth_)); |
| 1481 | return Status::OK(); |
| 1482 | } |
| 1483 | |
| 1484 | DCHECK(underlying_transport_type == ThriftServer::BINARY); |
| 1485 | |
| 1486 | DCHECK(!principal_.empty() || has_ldap_); |
| 1487 | |
| 1488 | // This is the heart of the link between this file and thrift. Here we |
| 1489 | // associate a Sasl mechanism with our callbacks. |
| 1490 | try { |
| 1491 | map<string, string> sasl_props; // Empty; unused by Thrift |
| 1492 | TSaslServerTransport::Factory* sst_factory = NULL; |
| 1493 | factory->reset(sst_factory = new TSaslServerTransport::Factory()); |
| 1494 | |
| 1495 | if(!principal_.empty()) { |
| 1496 | // Tell it about Kerberos: |
| 1497 | sst_factory->addServerDefinition(KERBEROS_MECHANISM, service_name_, |
| 1498 | hostname_, realm_, 0, sasl_props, |
| 1499 | is_internal_ ? KERB_INT_CALLBACKS : KERB_EXT_CALLBACKS); |
| 1500 | } |
| 1501 | |
| 1502 | if (has_ldap_) { |
| 1503 | // Tell it about LDAP: |
| 1504 | sst_factory->addServerDefinition(PLAIN_MECHANISM, "LDAP", hostname_, |
| 1505 | "", 0, sasl_props, LDAP_EXT_CALLBACKS); |
| 1506 | } |
| 1507 | |
| 1508 | } catch (const TException& e) { |
| 1509 | LOG(ERROR) << "Failed to create Sasl Server transport factory: " |
| 1510 | << e.what(); |
| 1511 | return Status(e.what()); |
| 1512 | } |
| 1513 | |
| 1514 | VLOG_RPC << "Made " << (is_internal_ ? "internal" : "external") |
| 1515 | << " server transport factory with " |
| 1516 | << (!principal_.empty() ? "Kerberos " : " ") |
| 1517 | << (has_ldap_ ? "LDAP " : " ") << "authentication"; |
| 1518 | |
| 1519 | return Status::OK(); |
| 1520 | } |
| 1521 | |
| 1522 | Status SecureAuthProvider::WrapClientTransport(const string& hostname, |
| 1523 | std::shared_ptr<TTransport> raw_transport, const string& service_name, |
no test coverage detected