Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cadc-gms: add timeouts in PosixMapperClient #171

Merged
merged 1 commit into from
Jul 25, 2024
Merged

cadc-gms: add timeouts in PosixMapperClient #171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions cadc-gms/src/intTest/java/org/opencadc/auth/StandardIdentityManagerTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@
import ca.nrc.cadc.auth.AuthorizationTokenPrincipal;
import ca.nrc.cadc.auth.HttpPrincipal;
import ca.nrc.cadc.auth.IdentityManager;
import ca.nrc.cadc.auth.NumericPrincipal;
import ca.nrc.cadc.auth.OpenIdPrincipal;
import ca.nrc.cadc.auth.PrincipalExtractor;
import ca.nrc.cadc.auth.SSLUtil;
import ca.nrc.cadc.auth.X509CertificateChain;
Expand Down Expand Up @@ -102,8 +102,9 @@ public class StandardIdentityManagerTest {
private static final Logger log = Logger.getLogger(StandardIdentityManagerTest.class);

static {
Log4jInit.setLevel("ca.nrc.cadc.auth", Level.INFO);
Log4jInit.setLevel("org.opencadc.auth", Level.INFO);
Log4jInit.setLevel("ca.nrc.cadc.auth", Level.INFO);
Log4jInit.setLevel("ca.nrc.cadc.net", Level.INFO);
}

private X509CertificateChain chain;
Expand Down Expand Up @@ -168,26 +169,26 @@ public void testAccessToken() {
Subject validated = AuthenticationUtil.getSubject(new DummyPrincipalExtractor(false, true), false);
final StandardIdentityManager im = new StandardIdentityManager();
log.info("validated: " + validated);
Assert.assertFalse("oidc uuid", validated.getPrincipals(NumericPrincipal.class).isEmpty());
Assert.assertFalse("oidc iss/sub", validated.getPrincipals(OpenIdPrincipal.class).isEmpty());
Assert.assertFalse("oidc username", validated.getPrincipals(HttpPrincipal.class).isEmpty());

Subject augmented = im.augment(validated);
log.info("augmented: " + augmented);
Assert.assertFalse("oidc uuid", validated.getPrincipals(NumericPrincipal.class).isEmpty());
Assert.assertFalse("oidc iss/sub", validated.getPrincipals(OpenIdPrincipal.class).isEmpty());
Assert.assertFalse("oidc username", validated.getPrincipals(HttpPrincipal.class).isEmpty());

final Object owner = im.toOwner(augmented);
Subject s = im.toSubject(owner);
log.info("owner round trip: " + s);
Assert.assertNotNull(s);
Assert.assertFalse(s.getPrincipals(NumericPrincipal.class).isEmpty());
Assert.assertFalse(s.getPrincipals(OpenIdPrincipal.class).isEmpty());
Assert.assertTrue(s.getPrincipals(HttpPrincipal.class).isEmpty());

// test using current subject as cache for augment
Subject as = Subject.doAs(augmented, (PrivilegedExceptionAction<Subject>) () -> im.toSubject(owner));
log.info("owner round trip inside doAs(augmented): " + as);
Assert.assertNotNull(as);
Assert.assertFalse(as.getPrincipals(NumericPrincipal.class).isEmpty());
Assert.assertFalse(as.getPrincipals(OpenIdPrincipal.class).isEmpty());
Assert.assertFalse(as.getPrincipals(HttpPrincipal.class).isEmpty());

} catch (Exception unexpected) {
Expand Down
5 changes: 3 additions & 2 deletions cadc-gms/src/intTest/resources/config/cadc-registry.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ ca.nrc.cadc.reg.client.RegistryClient.baseURL = https://haproxy.cadc.dao.nrc.ca/
# configure LocalAuthority lookups
## SRC IAM prototype
ivo://ivoa.net/sso#OpenID = https://ska-iam.stfc.ac.uk/

http://www.opencadc.org/std/posix#user-mapping-0.1 = ivo://opencadc.org/src/posix-mapper
## these make the StandardIdentityManagerTest require a running posix-mapper so
## commented out by default
#http://www.opencadc.org/std/posix#user-mapping-0.1 = ivo://opencadc.org/src/posix-mapper
#http://www.opencadc.org/std/posix#user-mapping-0.1 = https://haproxy.cadc.dao.nrc.ca/src/posix-mapper
14 changes: 13 additions & 1 deletion cadc-gms/src/main/java/org/opencadc/auth/PosixMapperClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,8 +115,10 @@ public PosixMapperClient(URI resourceID) {
this.service = resourceID.toASCIIString();
try {
final RegistryClient regClient = new RegistryClient();
regClient.setConnectionTimeout(6000); // ms
regClient.setReadTimeout(12000); // ms
this.capabilities = regClient.getCapabilities(resourceID);
} catch (ResourceNotFoundException | IOException ex) {
} catch (Exception ex) {
throw new RuntimeException("failed to read capabilities for " + service, ex);
}
}
Expand All @@ -129,6 +131,8 @@ public PosixMapperClient(URL baseURL) {
try {
URL capURL = new URL(baseURL.toExternalForm() + "/capabilities");
HttpGet get = new HttpGet(capURL, true);
get.setConnectionTimeout(6000); // ms
get.setReadTimeout(12000); // ms
get.prepare();
CapabilitiesReader r = new CapabilitiesReader();
this.capabilities = r.read(get.getInputStream());
Expand Down Expand Up @@ -179,6 +183,8 @@ public Subject augment(Subject subject)
URL queryURL = new URL(query.toString());

HttpGet get = new HttpGet(queryURL, true);
get.setConnectionTimeout(6000); // ms
get.setReadTimeout(30000); // ms
get.setRequestProperty("accept", "text/tab-separated-values");
get.prepare();

Expand Down Expand Up @@ -238,6 +244,8 @@ public ResourceIterator<PosixPrincipal> getUserMap() throws IOException, Resourc
ResourceAlreadyExistsException, InterruptedException {
final URL userMapURL = getServiceURL(Standards.POSIX_USERMAP);
final HttpGet get = new HttpGet(userMapURL, true);
get.setConnectionTimeout(6000); // ms
get.setReadTimeout(30000); // ms
get.setRequestProperty("accept", "text/tab-separated-values");
get.prepare();

Expand Down Expand Up @@ -284,6 +292,8 @@ public ResourceIterator<PosixGroup> getGroupMap() throws IOException, ResourceNo
ResourceAlreadyExistsException, InterruptedException {
final URL userMapURL = getServiceURL(Standards.POSIX_GROUPMAP);
final HttpGet get = new HttpGet(userMapURL, true);
get.setConnectionTimeout(6000); // ms
get.setReadTimeout(30000); // ms
get.setRequestProperty("accept", "text/tab-separated-values");
get.prepare();

Expand Down Expand Up @@ -334,6 +344,8 @@ private List<PosixGroup> getPosixGroups(List<GroupURI> groupURIs, List<Integer>
URL queryURL = new URL(query.toString());

HttpGet get = new HttpGet(queryURL, true);
get.setConnectionTimeout(6000); // ms
get.setReadTimeout(30000); // ms
get.setRequestProperty("accept", "text/tab-separated-values");
get.prepare();

Expand Down
3 changes: 1 addition & 2 deletions cadc-gms/src/main/java/org/opencadc/auth/StandardIdentityManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -287,13 +287,12 @@ public Subject toSubject(Object owner) {

@Override
public Object toOwner(Subject subject) {
// use NumericPrincipal aka OIDC sub for persistence
Set<OpenIdPrincipal> ps = subject.getPrincipals(OpenIdPrincipal.class);
if (ps.isEmpty()) {
return null;
}
OpenIdPrincipal openIdPrincipal = ps.iterator().next();
return openIdPrincipal.getIssuer().toString() + OID_OWNER_DELIM + openIdPrincipal.getName();
return openIdPrincipal.getIssuer().toExternalForm() + OID_OWNER_DELIM + openIdPrincipal.getName();
}

@Override
Expand Down
Loading