From 06a7ca1b7a70d699d9e7a2fa57f8bcef760a3177 Mon Sep 17 00:00:00 2001 From: Michael Jumper Date: Thu, 28 Jul 2016 19:45:43 -0700 Subject: [PATCH] GUACAMOLE-5: Handle shared connections via dedicated AuthenticationProvider. --- .../SharedAuthenticationProviderService.java | 84 +++++++++++++++++++ .../MySQLSharedAuthenticationProvider.java | 52 ++++++++++++ .../src/main/resources/guac-manifest.json | 3 +- ...ostgreSQLSharedAuthenticationProvider.java | 52 ++++++++++++ .../src/main/resources/guac-manifest.json | 3 +- 5 files changed, 192 insertions(+), 2 deletions(-) create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/SharedAuthenticationProviderService.java create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/MySQLSharedAuthenticationProvider.java create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/PostgreSQLSharedAuthenticationProvider.java diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/SharedAuthenticationProviderService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/SharedAuthenticationProviderService.java new file mode 100644 index 000000000..1ca667abb --- /dev/null +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/SharedAuthenticationProviderService.java @@ -0,0 +1,84 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.guacamole.auth.jdbc.sharing; + +import com.google.inject.Inject; +import com.google.inject.Provider; +import org.apache.guacamole.GuacamoleException; +import org.apache.guacamole.auth.jdbc.AuthenticationProviderService; +import org.apache.guacamole.net.auth.AuthenticatedUser; +import org.apache.guacamole.net.auth.AuthenticationProvider; +import org.apache.guacamole.net.auth.Credentials; +import org.apache.guacamole.net.auth.credentials.CredentialsInfo; +import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException; + +/** + * Service which authenticates users based on share keys and provides for the + * creation of corresponding. The created UserContext objects are restricted to + * the connections associated with those share keys via a common + * ConnectionSharingService. + * + * @author Michael Jumper + */ +public class SharedAuthenticationProviderService implements AuthenticationProviderService { + + /** + * Provider for retrieving SharedConnectionUserContext instances. + */ + @Inject + private Provider sharedUserContextProvider; + + /** + * Service for sharing active connections. + */ + @Inject + private ConnectionSharingService sharingService; + + @Override + public AuthenticatedUser authenticateUser(AuthenticationProvider authenticationProvider, + Credentials credentials) throws GuacamoleException { + + // Check whether user is authenticating with a valid sharing key + AuthenticatedUser user = sharingService.retrieveSharedConnectionUser(authenticationProvider, credentials); + if (user != null) + return user; + + // Otherwise, unauthorized + throw new GuacamoleInvalidCredentialsException("Invalid login", CredentialsInfo.USERNAME_PASSWORD); + + } + + @Override + public org.apache.guacamole.net.auth.UserContext getUserContext( + AuthenticatedUser authenticatedUser) throws GuacamoleException { + + // Produce sharing-specific user context if this is the user of a shared connection + if (authenticatedUser instanceof SharedConnectionUser) { + SharedConnectionUserContext context = sharedUserContextProvider.get(); + context.init((SharedConnectionUser) authenticatedUser); + return context; + } + + // No shared connections otherwise + return null; + + } + +} diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/MySQLSharedAuthenticationProvider.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/MySQLSharedAuthenticationProvider.java new file mode 100644 index 000000000..f9ae15e6b --- /dev/null +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/MySQLSharedAuthenticationProvider.java @@ -0,0 +1,52 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.guacamole.auth.mysql; + +import org.apache.guacamole.GuacamoleException; +import org.apache.guacamole.auth.jdbc.InjectedAuthenticationProvider; +import org.apache.guacamole.auth.jdbc.sharing.SharedAuthenticationProviderService; + +/** + * Provides a implementation of AuthenticationProvider which interacts with the + * MySQL AuthenticationProvider, accepting share keys as credentials and + * providing access to the shared connections. + * + * @author Michael Jumper + */ +public class MySQLSharedAuthenticationProvider extends InjectedAuthenticationProvider { + + /** + * Creates a new MySQLSharedAuthenticationProvider that provides access to + * shared connections exposed by the MySQLAuthenticationProvider. + * + * @throws GuacamoleException + * If a required property is missing, or an error occurs while parsing + * a property. + */ + public MySQLSharedAuthenticationProvider() throws GuacamoleException { + super(new MySQLInjectorProvider(), SharedAuthenticationProviderService.class); + } + + @Override + public String getIdentifier() { + return "mysql-shared"; + } + +} diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json index 1aa0b8c57..7d92900e3 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json @@ -6,7 +6,8 @@ "namespace" : "guac-mysql", "authProviders" : [ - "org.apache.guacamole.auth.mysql.MySQLAuthenticationProvider" + "org.apache.guacamole.auth.mysql.MySQLAuthenticationProvider", + "org.apache.guacamole.auth.mysql.MySQLSharedAuthenticationProvider" ], "translations" : [ diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/PostgreSQLSharedAuthenticationProvider.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/PostgreSQLSharedAuthenticationProvider.java new file mode 100644 index 000000000..c2f78c3ec --- /dev/null +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/PostgreSQLSharedAuthenticationProvider.java @@ -0,0 +1,52 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.guacamole.auth.postgresql; + +import org.apache.guacamole.GuacamoleException; +import org.apache.guacamole.auth.jdbc.InjectedAuthenticationProvider; +import org.apache.guacamole.auth.jdbc.sharing.SharedAuthenticationProviderService; + +/** + * Provides a implementation of AuthenticationProvider which interacts with the + * PostgreSQL AuthenticationProvider, accepting share keys as credentials and + * providing access to the shared connections. + * + * @author Michael Jumper + */ +public class PostgreSQLSharedAuthenticationProvider extends InjectedAuthenticationProvider { + + /** + * Creates a new PostgreSQLSharedAuthenticationProvider that provides access + * to shared connections exposed by the PostgreSQLAuthenticationProvider. + * + * @throws GuacamoleException + * If a required property is missing, or an error occurs while parsing + * a property. + */ + public PostgreSQLSharedAuthenticationProvider() throws GuacamoleException { + super(new PostgreSQLInjectorProvider(), SharedAuthenticationProviderService.class); + } + + @Override + public String getIdentifier() { + return "postgresql-shared"; + } + +} diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json index 64d6a23e6..1f259c4c0 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json @@ -6,7 +6,8 @@ "namespace" : "guac-postgresql", "authProviders" : [ - "org.apache.guacamole.auth.postgresql.PostgreSQLAuthenticationProvider" + "org.apache.guacamole.auth.postgresql.PostgreSQLAuthenticationProvider", + "org.apache.guacamole.auth.postgresql.PostgreSQLSharedAuthenticationProvider" ], "translations" : [