| 1710 | AuthManager::~AuthManager() {} |
| 1711 | |
| 1712 | Status AuthManager::Init() { |
| 1713 | // Tell Thrift not to initialize SSL for us, as we use Kudu's SSL initializtion. |
| 1714 | TSSLSocketFactory::setManualOpenSSLInitialization(true); |
| 1715 | kudu::security::InitializeOpenSSL(); |
| 1716 | LOG(INFO) << "Initialized " << OPENSSL_VERSION_TEXT; |
| 1717 | LOG(INFO) << "Runtime OpenSSL version " << SSLeay_version(SSLEAY_VERSION); |
| 1718 | unsigned long openssl_version = SSLeay(); |
| 1719 | // Check if we are running against an OpenSSL version that is vulnerable to |
| 1720 | // CVE-2009-3555 |
| 1721 | if (openssl_version >= 0x10100000L && openssl_version <= 0x1010007fL) { |
| 1722 | LOG(WARNING) << |
| 1723 | "OpenSSL runtime version detected that is vulnerable to CVE-2009-3555"; |
| 1724 | } |
| 1725 | |
| 1726 | // Could use any other requiered flag for SAML |
| 1727 | bool use_saml = !FLAGS_saml2_sp_callback_url.empty(); |
| 1728 | if (use_saml) { |
| 1729 | RETURN_IF_ERROR(ParseSamlSpUrl(nullptr)); |
| 1730 | if (!IsExternalTlsConfigured()) { |
| 1731 | if (!FLAGS_saml2_allow_without_tls_debug_only) { |
| 1732 | return Status("SAML SSO authentication should be only used with TLS enabled."); |
| 1733 | } |
| 1734 | LOG(WARNING) << "SAML SSO authentication is used without TLS."; |
| 1735 | } |
| 1736 | } |
| 1737 | |
| 1738 | bool use_jwt = FLAGS_jwt_token_auth; |
| 1739 | if (use_jwt) { |
| 1740 | if (!IsExternalTlsConfigured()) { |
| 1741 | if (!FLAGS_jwt_allow_without_tls) { |
| 1742 | return Status("JWT authentication should be only used with TLS enabled."); |
| 1743 | } |
| 1744 | LOG(WARNING) << "JWT authentication is used without TLS."; |
| 1745 | } |
| 1746 | if (FLAGS_jwt_custom_claim_username.empty()) { |
| 1747 | return Status( |
| 1748 | "JWT authentication requires jwt_custom_claim_username to be specified."); |
| 1749 | } |
| 1750 | } |
| 1751 | |
| 1752 | if (FLAGS_oauth_token_auth) { |
| 1753 | if (!IsExternalTlsConfigured()) { |
| 1754 | if (!FLAGS_oauth_allow_without_tls) { |
| 1755 | return Status("OAuth authentication should be only used with TLS enabled."); |
| 1756 | } |
| 1757 | LOG(WARNING) << "OAuth authentication is used without TLS."; |
| 1758 | } |
| 1759 | if (FLAGS_oauth_jwt_custom_claim_username.empty()) { |
| 1760 | return Status( |
| 1761 | "OAuth authentication requires oauth_jwt_custom_claim_username to be " |
| 1762 | "specified."); |
| 1763 | } |
| 1764 | } |
| 1765 | |
| 1766 | // Get all of the flag validation out of the way |
| 1767 | if (FLAGS_enable_ldap_auth) { |
| 1768 | RETURN_IF_ERROR( |
| 1769 | ImpalaLdap::CreateLdap(&ldap_, FLAGS_ldap_user_filter, FLAGS_ldap_group_filter)); |
no test coverage detected