Jelajahi Sumber

HUE-9047 [core] Fix knox principal verification

Change-Id: Idaad77dff64eb1f67dc12eedf8c4b6e2836ae8f0
Jean-Francois Desjeans Gauthier 6 tahun lalu
induk
melakukan
d104675e6d
1 mengubah file dengan 13 tambahan dan 2 penghapusan
  1. 13 2
      desktop/core/src/desktop/middleware.py

+ 13 - 2
desktop/core/src/desktop/middleware.py

@@ -672,7 +672,9 @@ class SpnegoMiddleware(object):
           if 'desktop.auth.backend.KnoxSpnegoDjangoBackend' in \
                 desktop.conf.AUTH.BACKEND.get():
             knox_verification = False
-            if username in desktop.conf.KNOX.KNOX_PRINCIPAL.get():
+            principals = self.clean_principal(desktop.conf.KNOX.KNOX_PRINCIPAL.get())
+            principal = self.clean_principal(username)
+            if principal.intersection(principals):
               # This may contain chain of reverse proxies, e.g. knox proxy, hue load balancer
               # Compare hostname on both HTTP_X_FORWARDED_HOST & KNOX_PROXYHOSTS. Both of these can be configured to use either hostname or IPs and we have to normalize to one or the other
               req_hosts = self.clean_host(request.META['HTTP_X_FORWARDED_HOST'])
@@ -682,7 +684,7 @@ class SpnegoMiddleware(object):
               else:
                 access_warn(request, 'Failed to verify provided host %s with %s ' % (req_hosts, knox_proxy))
             else:
-              access_warn(request, 'Failed to verify provided username %s with %s ' % (username, desktop.conf.KNOX.KNOX_PRINCIPAL.get()))
+              access_warn(request, 'Failed to verify provided username %s with %s ' % (principal, principals))
             # If knox authentication failed then generate 401 (Unauthorized error)
             if not knox_verification:
               request.META['Return-401'] = ''
@@ -730,6 +732,15 @@ class SpnegoMiddleware(object):
           hosts.append(host)
     return set(hosts)
 
+  def clean_principal(self, pattern):
+    principals = []
+    if pattern:
+      pattern_list = pattern if isinstance(pattern, list) else pattern.split(',')
+      for principal_host in pattern_list:
+        principal = principal_host.split('/')[0].strip()
+      principals.append(principal)
+    return set(principals)
+
   def clean_username(self, username, request):
     """
     Allows the backend to clean the username, if the backend defines a