jffwang
/
hetu-core
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

!535 Add support for webui kerberos authentication 

Merge pull request !535 from Peikun Chen/feature/kerberosLogin
This commit is contained in:
i-robot 2021-01-30 14:55:29 +08:00 committed by Gitee
parent 35400ef6f5 5adebfdcd1
commit a1b236d935
2 changed files with 81 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
presto-main/src/main/java/io/prestosql/server/security/AuthenticationFilter.java
View File

@ -101,12 +101,21 @@ public class AuthenticationFilter
nextFilter.doFilter(withPrincipal(request, new BasicPrincipal(authenticatedUser.get())), response);
return;
}
// skip authentication for login/logout page
if (isSkipAuth(request)) {
nextFilter.doFilter(request, response);
return;
}
if (needRedirect(request, authenticators)) {
// redirect to login page
URI redirectUri = UiAuthenticator.buildLoginFormURI(URI.create(request.getRequestURI()));
response.sendRedirect(redirectUri.toString());
return;
}
}
// skip authentication for login/logout page
if (isSkipAuth(request)) {
nextFilter.doFilter(request, response);
return;
}
// try to authenticate, collecting errors and authentication headers
Set<String> messages = new LinkedHashSet<>();
Set<String> authenticateHeaders = new LinkedHashSet<>();
@ -132,16 +141,8 @@ public class AuthenticationFilter
// authentication failed
skipRequestBody(request);
// skip authentication if non-secure or not configured
if (isWebUi(request)) {
URI redirectUri = UiAuthenticator.buildLoginFormURI(URI.create(request.getRequestURI()));
response.sendRedirect(redirectUri.toString());
return;
}
else {
for (String value : authenticateHeaders) {
response.addHeader(WWW_AUTHENTICATE, value);
}
for (String value : authenticateHeaders) {
response.addHeader(WWW_AUTHENTICATE, value);
}
if (messages.isEmpty()) {
@ -150,6 +151,38 @@ public class AuthenticationFilter
response.sendError(SC_UNAUTHORIZED, Joiner.on(" | ").join(messages));
}
public static boolean needRedirect(HttpServletRequest request, final List<Authenticator> authenticators)
{
boolean pwdAuthentication = false;
boolean kerberosAuthentication = false;
for (Authenticator authenticator : authenticators) {
if (authenticator instanceof PasswordAuthenticator) {
pwdAuthentication = true;
}
else if (authenticator instanceof KerberosAuthenticator) {
kerberosAuthentication = true;
}
}
// Only use PasswordAuthenticator, all pages needs to redirect to login page
if (pwdAuthentication && !kerberosAuthentication) {
return true;
}
// If request path is web uri : "/" and enable kerberos or ldap authenticator, request path "/" needs to redirect to login page
if (isWebUri(request) && (pwdAuthentication || kerberosAuthentication)) {
return true;
}
return false;
}
public static boolean isWebUri(HttpServletRequest request)
{
String pathInfo = request.getPathInfo();
return pathInfo.equals("/");
}
public static boolean isWebUi(HttpServletRequest request)
{
String pathInfo = request.getPathInfo();

34
presto-main/src/main/resources/webapp/login.html
View File

@ -80,23 +80,43 @@
font-size: 15px;
font-weight: bold;
}
.login-form .radio-Group {
min-height: 38px;
border-radius: 2px;
}
.login-form .radio-Group label{
padding: 7px;
font-size: 15px;
font-weight: normal;
}
</style>
</head>
<body>
<div class="loader">Loading...</div>
<div class="login-form">
<form id="login" action="../ui/api/login" method="post" style="display: none">
<div>
<img src="assets/lk-logos.svg" width="140px" height="40px"/>
<h2 class="text-center">Log In</h2>
</div>
<br/>
<div class="form-group">
<input id="username" name="username" type="text" class="form-control" placeholder="Username" required="required">
</div>
<div class="form-group">
<input id="password" name="password" type="password" class="form-control" placeholder="Password" required="required">
</div>
<div class="radio-Group">
<input type="radio" name="loginOptions" id="basicRadio" autocomplete="off" onclick="basicAuthentication()" checked /><label for="basicRadio" >Basic</label>
<input type="radio" name="loginOptions" id="kerberosRadio" autocomplete="off" onclick="kerberosAuthentication()" /><label for="kerberosRadio" >Kerberos</label>
<span class="glyphicon glyphicon-question-sign" aria-hidden="true" title="When Kerberos authentication is selected, it is recommended to configure Kerberos authentication with Firefox browser."></span>
</div>
<input id="redirectPath" name="redirectPath" type="hidden">
<div class="form-group">
<button id="submit" type="submit" class="btn btn-primary btn-block">Log In</button>
@ -120,7 +140,19 @@
.prop('readonly', true);
}
$("#login").show();
$(".loader").hide();
$("#username").focus().val("");
function basicAuthentication(){
$(".login-form").show();
$(".loader").hide();
}
function kerberosAuthentication(){
$(".login-form").hide();
$(".loader").show();
window.location.href='/ui';
}
</script>
<!-- Fonts -->
<link href="https://fonts.googleapis.com/css?family=Roboto:400,500,700" rel="stylesheet">