import org.eclipse.jetty.security.Authenticator; //导入依赖的package包/类
protected ConstraintSecurityHandler configureCommonAuthentication(Server server,
    ServerConnector connector, AvaticaServerConfiguration config, String constraintName,
    String[] allowedRoles, Authenticator authenticator, String realm,
    LoginService loginService) {

  Constraint constraint = new Constraint();
  constraint.setName(constraintName);
  constraint.setRoles(allowedRoles);
  // This is telling Jetty to not allow unauthenticated requests through (very important!)
  constraint.setAuthenticate(true);

  ConstraintMapping cm = new ConstraintMapping();
  cm.setConstraint(constraint);
  cm.setPathSpec("/*");

  ConstraintSecurityHandler sh = new ConstraintSecurityHandler();
  sh.setAuthenticator(authenticator);
  sh.setLoginService(loginService);
  sh.setConstraintMappings(new ConstraintMapping[]{cm});
  sh.setRealmName(realm);

  return sh;
}
 

import org.eclipse.jetty.security.Authenticator; //导入依赖的package包/类
Authentication validateRequestDelegation(ServletRequest request, ServletResponse response, boolean mandatory)
    throws ServerAuthException {
  Authenticator auth = userAuthenticator;
  HttpServletRequest httpReq = (HttpServletRequest) request;
  boolean isRestCall = httpReq.getHeader(SSOConstants.X_REST_CALL) != null;
  boolean isAppCall = httpReq.getHeader(SSOConstants.X_APP_AUTH_TOKEN) != null ||
      httpReq.getHeader(SSOConstants.X_APP_COMPONENT_ID) != null;
  if (isAppCall && isRestCall) {
    auth = appAuthenticator;
    if (getLog().isTraceEnabled()) {
      getLog().trace("App request '{}'", getRequestInfoForLogging(httpReq, "?"));
    }
  } else {
    if (getLog().isTraceEnabled()) {
      getLog().trace("User request '{}'", getRequestInfoForLogging(httpReq, "?"));
    }
  }
  return auth.validateRequest(request, response, mandatory);
}
 

import org.eclipse.jetty.security.Authenticator; //导入依赖的package包/类
@Test
public void testCleanDelegationMethods() throws Exception {
  Authenticator auth = Mockito.mock(Authenticator.class);
  Activation activation = Mockito.mock(Activation.class);
  ActivationAuthenticator activationAuth = new ActivationAuthenticator(auth, activation);

  Authenticator.AuthConfiguration conf = Mockito.mock(Authenticator.AuthConfiguration.class);
  activationAuth.setConfiguration(conf);
  Mockito.verify(auth, Mockito.times(1)).setConfiguration(Mockito.eq(conf));

  Mockito.when(auth.getAuthMethod()).thenReturn("foo");
  Assert.assertEquals("foo", activationAuth.getAuthMethod());

  ServletRequest req = Mockito.mock(ServletRequest.class);
  activationAuth.prepareRequest(req);
  Mockito.verify(auth, Mockito.times(1)).prepareRequest(Mockito.eq(req));

  ServletResponse res = Mockito.mock(ServletResponse.class);
  Authentication.User user = Mockito.mock(Authentication.User.class);
  Mockito.when(auth.secureResponse(Mockito.eq(req), Mockito.eq(res), Mockito.eq(true), Mockito.eq(user)))
         .thenReturn(true);
  Assert.assertTrue(auth.secureResponse(req, res, true, user));
}
 

import org.eclipse.jetty.security.Authenticator; //导入依赖的package包/类
@Test
public void testValidateRequestDelegationNotEnabled() throws Exception {
  Authenticator auth = Mockito.mock(Authenticator.class);
  Activation activation = Mockito.mock(Activation.class);
  ActivationAuthenticator activationAuth = new ActivationAuthenticator(auth, activation);

  ServletRequest req = Mockito.mock(ServletRequest.class);
  ServletResponse res = Mockito.mock(ServletResponse.class);
  Authentication authResponse = Mockito.mock(Authentication.class);

  Mockito.when(auth.validateRequest(Mockito.eq(req), Mockito.eq(res), Mockito.eq(false))).thenReturn(authResponse);

  // test not user, activation not enabled
  Mockito.when(activation.isEnabled()).thenReturn(false);
  Assert.assertEquals(authResponse, activationAuth.validateRequest(req, res, false));

  // test not user, activation enabled
  Mockito.when(activation.isEnabled()).thenReturn(true);
  Assert.assertEquals(authResponse, activationAuth.validateRequest(req, res, false));

  // test user, activation not enabled
  authResponse = Mockito.mock(Authentication.User.class);
  Mockito.when(auth.validateRequest(Mockito.eq(req), Mockito.eq(res), Mockito.eq(false))).thenReturn(authResponse);
  Mockito.when(activation.isEnabled()).thenReturn(false);
  Assert.assertEquals(authResponse, activationAuth.validateRequest(req, res, false));

  // test user, activation enabled, activation not expired
  Mockito.when(activation.isEnabled()).thenReturn(true);
  Activation.Info info = Mockito.mock(Activation.Info.class);
  Mockito.when(info.isValid()).thenReturn(true);
  Mockito.when(activation.getInfo()).thenReturn(info);
  Assert.assertEquals(authResponse, activationAuth.validateRequest(req, res, false));

  // test user, activation enabled, activation expired
  Mockito.when(info.isValid()).thenReturn(false);
  Authentication authResponseGot = activationAuth.validateRequest(req, res, false);
  Assert.assertTrue(authResponseGot instanceof ActivationAuthenticator.ExpiredActivationUser);
}
 

import org.eclipse.jetty.security.Authenticator; //导入依赖的package包/类
@BeforeClass
public static void setupTest() throws Exception {
  spnegoHelper = new KerberosHelper(TestSpnegoAuthentication.class.getSimpleName(), primaryName);
  spnegoHelper.setupKdc(dirTestWatcher.getTmpDir());


  sun.security.krb5.Config.refresh();

  // (2) Reset the default realm.
  final Field defaultRealm = KerberosName.class.getDeclaredField("defaultRealm");
  defaultRealm.setAccessible(true);
  defaultRealm.set(null, KerberosUtil.getDefaultRealm());

  // Create a DrillbitContext with service principal and keytab for DrillSpnegoLoginService
  final DrillConfig newConfig = new DrillConfig(DrillConfig.create()
      .withValue(ExecConstants.HTTP_AUTHENTICATION_MECHANISMS,
          ConfigValueFactory.fromIterable(Lists.newArrayList("spnego")))
      .withValue(ExecConstants.HTTP_SPNEGO_PRINCIPAL,
          ConfigValueFactory.fromAnyRef(spnegoHelper.SERVER_PRINCIPAL))
      .withValue(ExecConstants.HTTP_SPNEGO_KEYTAB,
          ConfigValueFactory.fromAnyRef(spnegoHelper.serverKeytab.toString())),
      false);

  // Create mock objects for optionManager and AuthConfiguration
  final SystemOptionManager optionManager = Mockito.mock(SystemOptionManager.class);
  Mockito.when(optionManager.getOption(ExecConstants.ADMIN_USERS_VALIDATOR))
      .thenReturn(ExecConstants.ADMIN_USERS_VALIDATOR.DEFAULT_ADMIN_USERS);
  Mockito.when(optionManager.getOption(ExecConstants.ADMIN_USER_GROUPS_VALIDATOR))
      .thenReturn(ExecConstants.ADMIN_USER_GROUPS_VALIDATOR.DEFAULT_ADMIN_USER_GROUPS);

  final DrillbitContext drillbitContext = Mockito.mock(DrillbitContext.class);
  Mockito.when(drillbitContext.getConfig()).thenReturn(newConfig);
  Mockito.when(drillbitContext.getOptionManager()).thenReturn(optionManager);

  Authenticator.AuthConfiguration authConfiguration = Mockito.mock(Authenticator.AuthConfiguration.class);

  spnegoAuthenticator = new DrillSpnegoAuthenticator("SPNEGO");
  DrillSpnegoLoginService spnegoLoginService = new DrillSpnegoLoginService(drillbitContext);

  Mockito.when(authConfiguration.getLoginService()).thenReturn(spnegoLoginService);
  Mockito.when(authConfiguration.getIdentityService()).thenReturn(new DefaultIdentityService());
  Mockito.when(authConfiguration.isSessionRenewedOnAuthentication()).thenReturn(true);

  // Set the login service and identity service inside SpnegoAuthenticator
  spnegoAuthenticator.setConfiguration(authConfiguration);
}
 

import org.eclipse.jetty.security.Authenticator; //导入依赖的package包/类
public Authenticator createAuthenticator() throws IllegalAccessException, InstantiationException {
    return authenticatorClass.newInstance();
}
 

import org.eclipse.jetty.security.Authenticator; //导入依赖的package包/类
private AuthenticationType(CredentialType credentialType, Class<? extends Authenticator> authenticatorClass) {
    this.credentialType = credentialType;
    this.authenticatorClass = authenticatorClass;
}
 

import org.eclipse.jetty.security.Authenticator; //导入依赖的package包/类
public ActivationAuthenticator(Authenticator authenticator, Activation activation) {
  Utils.checkNotNull(authenticator, "authenticator");
  Utils.checkNotNull(activation, "activation");
  this.authenticator = authenticator;
  this.activation = activation;
}
 

import org.eclipse.jetty.security.Authenticator; //导入依赖的package包/类
protected Authenticator injectActivationCheck(Authenticator authenticator) {
  return (activation == null) ? authenticator : new ActivationAuthenticator(authenticator, activation);
}
 

import org.eclipse.jetty.security.Authenticator; //导入依赖的package包/类
@Test
public void testExpiredActivationUser() {
  Authenticator auth = Mockito.mock(Authenticator.class);
  Activation activation = Mockito.mock(Activation.class);
  ActivationAuthenticator activationAuth = new ActivationAuthenticator(auth, activation);

  Authentication.User authUser = Mockito.mock(Authentication.User.class);
  Subject subject = new Subject();
  Principal principal = Mockito.mock(Principal.class);
  UserIdentity userIdentity = Mockito.mock(UserIdentity.class);
  Mockito.when(userIdentity.getSubject()).thenReturn(subject);
  Mockito.when(userIdentity.getUserPrincipal()).thenReturn(principal);
  Mockito.when(authUser.getUserIdentity()).thenReturn(userIdentity);
  Authentication.User expiredAuthUser = activationAuth.createExpiredActivationUser(authUser);

  Mockito.when(authUser.getAuthMethod()).thenReturn("foo");
  Assert.assertEquals("foo", expiredAuthUser.getAuthMethod());
  Mockito.verify(authUser, Mockito.times(1)).getAuthMethod();

  expiredAuthUser.logout();
  Mockito.verify(authUser, Mockito.times(1)).logout();

  // non admin user
  Assert.assertTrue(expiredAuthUser.isUserInRole(null, "user"));
  Assert.assertTrue(expiredAuthUser.isUserInRole(null, AuthzRole.GUEST));
  Assert.assertTrue(expiredAuthUser.isUserInRole(null, AuthzRole.GUEST_REMOTE));
  Assert.assertFalse(expiredAuthUser.isUserInRole(null, AuthzRole.ADMIN_ACTIVATION));
  Assert.assertFalse(expiredAuthUser.isUserInRole(null, AuthzRole.ADMIN));
  Assert.assertFalse(expiredAuthUser.isUserInRole(null, "foo"));

  // admin user
  Mockito.when(authUser.isUserInRole(Mockito.eq(null), Mockito.eq(AuthzRole.ADMIN))).thenReturn(true);
  Assert.assertTrue(expiredAuthUser.isUserInRole(null, "user"));
  Assert.assertTrue(expiredAuthUser.isUserInRole(null, AuthzRole.GUEST));
  Assert.assertTrue(expiredAuthUser.isUserInRole(null, AuthzRole.GUEST_REMOTE));
  Assert.assertTrue(expiredAuthUser.isUserInRole(null, AuthzRole.ADMIN_ACTIVATION));
  Assert.assertFalse(expiredAuthUser.isUserInRole(null, AuthzRole.ADMIN));
  Assert.assertFalse(expiredAuthUser.isUserInRole(null, AuthzRole.ADMIN_REMOTE));
  Assert.assertFalse(expiredAuthUser.isUserInRole(null, "foo"));

  // remote admin user
  Mockito.when(authUser.isUserInRole(Mockito.eq(null), Mockito.eq(AuthzRole.ADMIN_REMOTE))).thenReturn(true);
  Assert.assertTrue(expiredAuthUser.isUserInRole(null, "user"));
  Assert.assertTrue(expiredAuthUser.isUserInRole(null, AuthzRole.GUEST));
  Assert.assertTrue(expiredAuthUser.isUserInRole(null, AuthzRole.GUEST_REMOTE));
  Assert.assertTrue(expiredAuthUser.isUserInRole(null, AuthzRole.ADMIN_ACTIVATION));
  Assert.assertFalse(expiredAuthUser.isUserInRole(null, AuthzRole.ADMIN));
  Assert.assertFalse(expiredAuthUser.isUserInRole(null, AuthzRole.ADMIN_REMOTE));
  Assert.assertFalse(expiredAuthUser.isUserInRole(null, "foo"));

  // verify UserIdentity.isUserInRole() delegation to ExpiredActivationUser.isUserInRole()
  expiredAuthUser = activationAuth.createExpiredActivationUser(authUser);
  expiredAuthUser = Mockito.spy(expiredAuthUser);
  userIdentity = expiredAuthUser.getUserIdentity();
  UserIdentity.Scope scope = Mockito.mock(UserIdentity.Scope.class);
  Assert.assertTrue(userIdentity.isUserInRole(AuthzRole.GUEST,scope));
  Mockito.verify(expiredAuthUser, Mockito.times(1)).isUserInRole(Mockito.eq(scope), Mockito.eq(AuthzRole.GUEST));
}