org.apache.hive.service.auth.saml

Class HiveSaml2Client

java.lang.Object

org.pac4j.core.util.InitializableObject

org.pac4j.core.client.BaseClient<C>

org.pac4j.core.client.IndirectClient<org.pac4j.saml.credentials.SAML2Credentials>

org.pac4j.saml.client.SAML2Client

org.apache.hive.service.auth.saml.HiveSaml2Client

All Implemented Interfaces:

org.pac4j.core.client.Client<org.pac4j.saml.credentials.SAML2Credentials>

public class HiveSaml2Client
extends org.pac4j.saml.client.SAML2Client

HiveServer2's implementation of SAML2Client. We mostly rely on pac4j to do most of the heavy lifting. This class implements the initialization logic of the underlying SAML2Client using the HiveConf. Also, implements the generation of SAML requests using HTTP-Redirect binding. //TODO: Add support for HTTP-Post binding for SAML request. //TODO Note that this implementation is only to be used when HiveServer2 is not deployed in HA mode. In case of HA mode, we should implement a ReplayCacheProvider such that the ReplayCache is shared between all HS2 instances. Ref: http://www.pac4j.org/docs/clients/saml.html

Field Summary

Fields inherited from class org.pac4j.saml.client.SAML2Client

authnResponseValidator, configuration, contextProvider, credentialProvider, decrypter, idpMetadataResolver, logoutProfileHandler, logoutValidator, profileHandler, replayCache, signatureSigningParametersProvider, signatureTrustEngineProvider, soapPipelineProvider, spMetadataResolver, stateGenerator

Fields inherited from class org.pac4j.core.client.IndirectClient

ATTEMPTED_AUTHENTICATION_SUFFIX, callbackUrl, callbackUrlResolver, urlResolver

Fields inherited from class org.pac4j.core.client.BaseClient

logger

Method Summary

Modifier and Type	Method and Description
static HiveSaml2Client	get(HiveConf conf)
void	setRedirect(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Generates a SAML request using the HTTP-Redirect Binding.
static void	shutdown()
String	validate(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Given a response which may contain a SAML Assertion, validates it.

Methods inherited from class org.pac4j.saml.client.SAML2Client

clientInit, destroy, getAuthnResponseValidator, getConfiguration, getContextProvider, getIdentityProviderMetadataResolver, getIdentityProviderResolvedEntityId, getLogoutProfileHandler, getProfileHandler, getReplayCache, getServiceProviderMetadataResolver, getServiceProviderResolvedEntityId, getSignatureSigningParametersProvider, getSignatureTrustEngineProvider, getStateGenerator, initCredentialProvider, initDecrypter, initIdentityProviderMetadataResolver, initSAMLContextProvider, initSAMLLogoutProfileHandler, initSAMLLogoutResponseValidator, initSAMLProfileHandler, initSAMLReplayCache, initSAMLResponseValidator, initServiceProviderMetadataResolver, initSignatureSigningParametersProvider, initSignatureTrustEngineProvider, initSOAPPipelineProvider, notifySessionRenewal, setConfiguration, setLogoutProfileHandler, setStateGenerator

Methods inherited from class org.pac4j.core.client.IndirectClient

computeFinalCallbackUrl, defaultLogoutActionBuilder, defaultRedirectionActionBuilder, getAjaxRequestResolver, getCallbackUrl, getCallbackUrlResolver, getCodeVerifierSessionAttributeName, getCredentials, getLogoutAction, getLogoutActionBuilder, getNonceSessionAttributeName, getRedirectionAction, getRedirectionActionBuilder, getStateSessionAttributeName, getUrlResolver, internalInit, newDefaultCallbackUrlResolver, setAjaxRequestResolver, setCallbackUrl, setCallbackUrlResolver, setLogoutActionBuilder, setRedirectionActionBuilder, setUrlResolver, toString

Methods inherited from class org.pac4j.core.client.BaseClient

addAuthorizationGenerator, addAuthorizationGenerators, defaultAuthenticator, defaultCredentialsExtractor, defaultProfileCreator, getAuthenticator, getAuthorizationGenerators, getCredentialsExtractor, getCustomProperties, getName, getProfileCreator, getProfileFactoryWhenNotAuthenticated, getUserProfile, renewUserProfile, retrieveCredentials, retrieveUserProfile, setAuthenticator, setAuthorizationGenerator, setAuthorizationGenerators, setAuthorizationGenerators, setCredentialsExtractor, setCustomProperties, setName, setProfileCreator, setProfileFactoryWhenNotAuthenticated

Methods inherited from class org.pac4j.core.util.InitializableObject

init, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Method Detail

get

public static HiveSaml2Client get(HiveConf conf)
                           throws HttpSamlAuthenticationException

Throws:

HttpSamlAuthenticationException

shutdown

public static void shutdown()

setRedirect

public void setRedirect(javax.servlet.http.HttpServletRequest request,
                        javax.servlet.http.HttpServletResponse response)
                 throws HttpSamlAuthenticationException

Generates a SAML request using the HTTP-Redirect Binding.

Throws:

HttpSamlAuthenticationException

validate

public String validate(javax.servlet.http.HttpServletRequest request,
                       javax.servlet.http.HttpServletResponse response)
                throws HttpSamlAuthenticationException

Given a response which may contain a SAML Assertion, validates it. If the validation is successful, it extracts the nameId from the assertion which is used as the identity of the end user.

Parameters:

request -

response -

Returns:

the NameId as received in the assertion if the assertion was valid.

Throws:

HttpSamlAuthenticationException - In case the assertion is not present or is invalid.