| 218 | } |
| 219 | |
| 220 | bool RpcMgr::Authorize(const string& service_name, RpcContext* context, |
| 221 | MemTracker* mem_tracker) const { |
| 222 | // Authorization is enforced iff Kerberos is enabled. |
| 223 | if (!IsInternalKerberosEnabled()) return true; |
| 224 | |
| 225 | // Check if the mapped username matches that of the kinit'ed principal. |
| 226 | const RemoteUser& remote_user = context->remote_user(); |
| 227 | const string& logged_in_username = |
| 228 | kudu::security::GetLoggedInUsernameFromKeytab().value_or(""); |
| 229 | DCHECK(!logged_in_username.empty()); |
| 230 | bool authorized = remote_user.username() == logged_in_username && |
| 231 | remote_user.authenticated_by() == RemoteUser::Method::KERBEROS; |
| 232 | if (UNLIKELY(!authorized)) { |
| 233 | LOG(ERROR) << Substitute("Rejecting unauthorized access to $0 from $1. Expected " |
| 234 | "user $2", service_name, context->requestor_string(), logged_in_username); |
| 235 | mem_tracker->Release(context->GetTransferSize()); |
| 236 | context->RespondFailure(kudu::Status::NotAuthorized( |
| 237 | Substitute("$0 is not allowed to access $1", |
| 238 | remote_user.ToString(), service_name))); |
| 239 | return false; |
| 240 | } |
| 241 | return true; |
| 242 | } |
| 243 | |
| 244 | Status RpcMgr::StartServices() { |
| 245 | DCHECK(is_inited()) << "Must call Init() before StartServices()"; |
nothing calls this directly
no test coverage detected