| 1520 | } |
| 1521 | |
| 1522 | Status SecureAuthProvider::WrapClientTransport(const string& hostname, |
| 1523 | std::shared_ptr<TTransport> raw_transport, const string& service_name, |
| 1524 | std::shared_ptr<TTransport>* wrapped_transport) { |
| 1525 | std::shared_ptr<sasl::TSasl> sasl_client; |
| 1526 | const map<string, string> props; // Empty; unused by thrift |
| 1527 | const string auth_id; // Empty; unused by thrift |
| 1528 | |
| 1529 | DCHECK(!has_ldap_); |
| 1530 | DCHECK(is_internal_); |
| 1531 | |
| 1532 | // Since the daemons are never LDAP clients, we go straight to Kerberos |
| 1533 | try { |
| 1534 | const string& service = service_name.empty() ? service_name_ : service_name; |
| 1535 | sasl_client.reset(new sasl::TSaslClient(KERBEROS_MECHANISM, auth_id, |
| 1536 | service, hostname, props, KERB_INT_CALLBACKS.data())); |
| 1537 | } catch (sasl::SaslClientImplException& e) { |
| 1538 | LOG(ERROR) << "Failed to create a GSSAPI/SASL client: " << e.what(); |
| 1539 | return Status(e.what()); |
| 1540 | } |
| 1541 | wrapped_transport->reset(new TSaslClientTransport(sasl_client, raw_transport)); |
| 1542 | // Verify that the wrapped transport inherits the max message size properly. |
| 1543 | VerifyMaxMessageSizeInheritance(raw_transport.get(), wrapped_transport->get()); |
| 1544 | |
| 1545 | // This function is called immediately prior to sasl_client_start(), and so |
| 1546 | // can be used to log an "I'm beginning authentication for this principal" |
| 1547 | // message. Unfortunately, there are no hooks for us at this level to say |
| 1548 | // that we successfully authenticated as a client. |
| 1549 | VLOG_RPC << "Initiating client connection using principal " << principal_; |
| 1550 | |
| 1551 | return Status::OK(); |
| 1552 | } |
| 1553 | |
| 1554 | void SecureAuthProvider::SetupConnectionContext( |
| 1555 | const shared_ptr<ThriftServer::ConnectionContext>& connection_ptr, |
no test coverage detected