import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
/**
 * Populates a given context with a new Subject derived from the credentials in a servlet request.
 * 
 * @param context the context to be populated
 * @param req the servlet request
 * @return the context
 */
@Override
public ReqContext populateContext(ReqContext context, HttpServletRequest req) {
    String userName = getUserName(req);

    String doAsUser = req.getHeader("doAsUser");
    if (doAsUser == null) {
        doAsUser = req.getParameter("doAsUser");
    }

    if (doAsUser != null) {
        context.setRealPrincipal(new SingleUserPrincipal(userName));
        userName = doAsUser;
    }

    Set<Principal> principals = new HashSet<Principal>();
    if (userName != null) {
        Principal p = new SingleUserPrincipal(userName);
        principals.add(p);
    }
    Subject s = new Subject(true, principals, new HashSet(), new HashSet());
    context.setSubject(s);

    return context;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
private void handleAuthorizeCallback(AuthorizeCallback ac) {
    String authenticationID = ac.getAuthenticationID();
    LOG.info("Successfully authenticated client: authenticationID=" + authenticationID + " authorizationID= " + ac.getAuthorizationID());

    // if authorizationId is not set, set it to authenticationId.
    if (ac.getAuthorizationID() == null) {
        ac.setAuthorizedID(authenticationID);
    }

    // When authNid and authZid are not equal , authNId is attempting to impersonate authZid, We
    // add the authNid as the real user in reqContext's subject which will be used during authorization.
    if (!ac.getAuthenticationID().equals(ac.getAuthorizationID())) {
        ReqContext.context().setRealPrincipal(new SaslTransportPlugin.User(ac.getAuthenticationID()));
    }

    ac.setAuthorized(true);
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
private void handleAuthorizeCallback(AuthorizeCallback ac) {
    String authenticationID = ac.getAuthenticationID();
    LOG.info("Successfully authenticated client: authenticationID = " + authenticationID + " authorizationID = " + ac.getAuthorizationID());

    // if authorizationId is not set, set it to authenticationId.
    if (ac.getAuthorizationID() == null) {
        ac.setAuthorizedID(authenticationID);
    }

    // When authNid and authZid are not equal , authNId is attempting to impersonate authZid, We
    // add the authNid as the real user in reqContext's subject which will be used during authorization.
    if (!authenticationID.equals(ac.getAuthorizationID())) {
        LOG.info("Impersonation attempt  authenticationID = " + ac.getAuthenticationID() + " authorizationID = " + ac.getAuthorizationID());
        ReqContext.context().setRealPrincipal(new SaslTransportPlugin.User(ac.getAuthenticationID()));
    }

    ac.setAuthorized(true);
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
/**
 * permit() method is invoked for each incoming Thrift request
 * 
 * @param context
 *            request context includes info about
 * @param operation
 *            operation name
 * @param topology_storm
 *            configuration of targeted topology
 * @return true if the request is authorized, false if reject
 */
@Override
public boolean permit(ReqContext context, String operation,
		Map topology_conf) {
	LOG.info("[req "
			+ context.requestID()
			+ "] Access "
			+ " from: "
			+ (context.remoteAddress() == null ? "null" : context
					.remoteAddress().toString()) + " principal:"
			+ (context.principal() == null ? "null" : context.principal())
			+ " op:" + operation + " topoology:"
			+ topology_conf.get(Config.TOPOLOGY_NAME));
	return true;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
/**
 * permit() method is invoked for each incoming Thrift request
 * 
 * @param contrext
 *            request context
 * @param operation
 *            operation name
 * @param topology_storm
 *            configuration of targeted topology
 * @return true if the request is authorized, false if reject
 */
@Override
public boolean permit(ReqContext context, String operation,
		Map topology_conf) {
	LOG.info("[req "
			+ context.requestID()
			+ "] Access "
			+ " from: "
			+ (context.remoteAddress() == null ? "null" : context
					.remoteAddress().toString()) + " principal:"
			+ (context.principal() == null ? "null" : context.principal())
			+ " op:" + operation + " topoology:"
			+ topology_conf.get(Config.TOPOLOGY_NAME));
	return false;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
/**
 * permit() method is invoked for each incoming Thrift request
 * 
 * @param context
 *            request context includes info about
 * @param operation
 *            operation name
 * @param topology_storm
 *            configuration of targeted topology
 * @return true if the request is authorized, false if reject
 */
public boolean permit(ReqContext context, String operation,
		Map topology_conf) {
	LOG.info("[req "
			+ context.requestID()
			+ "] Access "
			+ " from: "
			+ (context.remoteAddress() == null ? "null" : context
					.remoteAddress().toString()) + " principal:"
			+ (context.principal() == null ? "null" : context.principal())
			+ " op:" + operation + " topoology:"
			+ topology_conf.get(Config.TOPOLOGY_NAME));
	return true;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
/**
 * permit() method is invoked for each incoming Thrift request
 * 
 * @param contrext
 *            request context
 * @param operation
 *            operation name
 * @param topology_storm
 *            configuration of targeted topology
 * @return true if the request is authorized, false if reject
 */
public boolean permit(ReqContext context, String operation,
		Map topology_conf) {
	LOG.info("[req "
			+ context.requestID()
			+ "] Access "
			+ " from: "
			+ (context.remoteAddress() == null ? "null" : context
					.remoteAddress().toString()) + " principal:"
			+ (context.principal() == null ? "null" : context.principal())
			+ " op:" + operation + " topoology:"
			+ topology_conf.get(Config.TOPOLOGY_NAME));
	return false;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
/**
 * Authorizes request from to the DRPC server.
 * 
 * @param context the client request context
 * @param operation the operation requested by the DRPC server
 * @param params a Map with any key-value entries of use to the authorization implementation
 */
@Override
public boolean permit(ReqContext context, String operation, Map params) {
    if ("execute".equals(operation)) {
        return permitClientRequest(context, operation, params);
    } else if ("failRequest".equals(operation) || "fetchRequest".equals(operation) || "result".equals(operation)) {
        return permitInvocationRequest(context, operation, params);
    }
    // Deny unsupported operations.
    LOG.warn("Denying unsupported operation \"" + operation + "\" from " + context.remoteAddress());
    return false;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
private String getUserFromContext(ReqContext context) {
    if (context != null) {
        Principal princ = context.principal();
        if (princ != null) {
            return princ.getName();
        }
    }
    return null;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
protected boolean permitClientOrInvocationRequest(ReqContext context, Map params, String fieldName) {
    Map<String, AclFunctionEntry> acl = readAclFromConfig();
    String function = (String) params.get(FUNCTION_KEY);
    if (function != null && !function.isEmpty()) {
        AclFunctionEntry entry = acl.get(function);
        if (entry == null && _permitWhenMissingFunctionEntry) {
            return true;
        }
        if (entry != null) {
            Object value;
            try {
                Field field = AclFunctionEntry.class.getDeclaredField(fieldName);
                value = field.get(entry);
            } catch (Exception ex) {
                LOG.warn("Caught Exception while accessing ACL", ex);
                return false;
            }
            String principal = getUserFromContext(context);
            String user = getLocalUserFromContext(context);
            if (value == null) {
                LOG.warn("Configuration for function '" + function + "' is " + "invalid: it should have both an invocation user "
                        + "and a list of client users defined.");
            } else if (value instanceof Set && (((Set<String>) value).contains(principal) || ((Set<String>) value).contains(user))) {
                return true;
            } else if (value instanceof String && (value.equals(principal) || value.equals(user))) {
                return true;
            }
        }
    }
    return false;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
/**
 * permit() method is invoked for each incoming Thrift request
 * @param context request context includes info about 
 * @param operation operation name
 * @param topology_storm configuration of targeted topology 
 * @return true if the request is authorized, false if reject
 */
public boolean permit(ReqContext context, String operation, Map topology_conf) {
    LOG.info("[req "+ context.requestID()+ "] Access "
            + " from: " + (context.remoteAddress() == null? "null" : context.remoteAddress().toString())
            + " principal:"+(context.principal() == null? "null" : context.principal()) 
            +" op:"+ operation
            + " topoology:"+ topology_conf.get(Config.TOPOLOGY_NAME));
    return true;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
/**
 * permit() method is invoked for each incoming Thrift request
 * @param contrext request context 
 * @param operation operation name
 * @param topology_storm configuration of targeted topology 
 * @return true if the request is authorized, false if reject
 */
public boolean permit(ReqContext context, String operation, Map topology_conf) {
    LOG.info("[req "+ context.requestID()+ "] Access "
            + " from: " + (context.remoteAddress() == null? "null" : context.remoteAddress().toString())
            + " principal:"+ (context.principal() == null? "null" : context.principal())
            +" op:"+operation
            + " topoology:"+topology_conf.get(Config.TOPOLOGY_NAME));
    return false;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
private String getLocalUserFromContext(ReqContext context) {
    if (context != null) {
        return _ptol.toLocal(context.principal());
    }
    return null;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
@Override
protected boolean permitClientRequest(ReqContext context, String operation, Map params) {
    return permitClientOrInvocationRequest(context, params, "clientUsers");
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
@Override
protected boolean permitInvocationRequest(ReqContext context, String operation, Map params) {
    return permitClientOrInvocationRequest(context, params, "invocationUser");
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
/**
 * permit() method is invoked for each incoming Thrift request
 * 
 * @param context request context includes info about
 * @param operation operation name
 * @param topology_storm configuration of targeted topology
 * @return true if the request is authorized, false if reject
 */
@Override
public boolean permit(ReqContext context, String operation, Map topology_conf) {
    LOG.info("[req " + context.requestID() + "] Access " + " from: " + (context.remoteAddress() == null ? "null" : context.remoteAddress().toString())
            + (context.principal() == null ? "" : (" principal:" + context.principal())) + " op:" + operation
            + (topology_conf == null ? "" : (" topoology:" + topology_conf.get(Config.TOPOLOGY_NAME))));
    return context.principal() != null ? users.contains(context.principal().getName()) : false;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
/**
 * permit() method is invoked for each incoming Thrift request
 * 
 * @param context request context includes info about
 * @param operation operation name
 * @param topology_storm configuration of targeted topology
 * @return true if the request is authorized, false if reject
 */
public boolean permit(ReqContext context, String operation, Map topology_conf) {
    LOG.info("[req " + context.requestID() + "] Access " + " from: " + (context.remoteAddress() == null ? "null" : context.remoteAddress().toString())
            + (context.principal() == null ? "" : (" principal:" + context.principal())) + " op:" + operation
            + (topology_conf == null ? "" : (" topoology:" + topology_conf.get(Config.TOPOLOGY_NAME))));
    return true;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
/**
 * permit() method is invoked for each incoming Thrift request
 * 
 * @param contrext request context
 * @param operation operation name
 * @param topology_storm configuration of targeted topology
 * @return true if the request is authorized, false if reject
 */
public boolean permit(ReqContext context, String operation, Map topology_conf) {
    LOG.info("[req " + context.requestID() + "] Access " + " from: " + (context.remoteAddress() == null ? "null" : context.remoteAddress().toString())
            + (context.principal() == null ? "" : (" principal:" + context.principal())) + " op:" + operation
            + (topology_conf == null ? "" : (" topoology:" + topology_conf.get(Config.TOPOLOGY_NAME))));
    return false;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
/**
 * permit() method is invoked for each incoming Thrift request
 *
 * @param context       request context
 * @param operation     operation name
 * @param topology_conf configuration of targeted topology
 * @return true if the request is authorized, false if reject
 */
public boolean permit(ReqContext context, String operation, Map topology_conf) {
    LOG.info("[req " + context.requestID() + "] Access " + " from: " +
            (context.remoteAddress() == null ? "null" : context.remoteAddress().toString())
            + (context.principal() == null ? "" : (" principal:" + context.principal())) + " op:" + operation
            + (topology_conf == null ? "" : (" topoology:" + topology_conf.get(Config.TOPOLOGY_NAME))));
    return false;
}
 

import backtype.storm.security.auth.ReqContext; //导入依赖的package包/类
/**
 * Populates a given context with credentials information from an HTTP request.
 * 
 * @param req the servlet request
 * @return the context
 */
ReqContext populateContext(ReqContext context, HttpServletRequest req);