|
@@ -672,7 +672,9 @@ class SpnegoMiddleware(object):
|
|
|
if 'desktop.auth.backend.KnoxSpnegoDjangoBackend' in \
|
|
if 'desktop.auth.backend.KnoxSpnegoDjangoBackend' in \
|
|
|
desktop.conf.AUTH.BACKEND.get():
|
|
desktop.conf.AUTH.BACKEND.get():
|
|
|
knox_verification = False
|
|
knox_verification = False
|
|
|
- if username in desktop.conf.KNOX.KNOX_PRINCIPAL.get():
|
|
|
|
|
|
|
+ principals = self.clean_principal(desktop.conf.KNOX.KNOX_PRINCIPAL.get())
|
|
|
|
|
+ principal = self.clean_principal(username)
|
|
|
|
|
+ if principal.intersection(principals):
|
|
|
# This may contain chain of reverse proxies, e.g. knox proxy, hue load balancer
|
|
# This may contain chain of reverse proxies, e.g. knox proxy, hue load balancer
|
|
|
# Compare hostname on both HTTP_X_FORWARDED_HOST & KNOX_PROXYHOSTS. Both of these can be configured to use either hostname or IPs and we have to normalize to one or the other
|
|
# Compare hostname on both HTTP_X_FORWARDED_HOST & KNOX_PROXYHOSTS. Both of these can be configured to use either hostname or IPs and we have to normalize to one or the other
|
|
|
req_hosts = self.clean_host(request.META['HTTP_X_FORWARDED_HOST'])
|
|
req_hosts = self.clean_host(request.META['HTTP_X_FORWARDED_HOST'])
|
|
@@ -682,7 +684,7 @@ class SpnegoMiddleware(object):
|
|
|
else:
|
|
else:
|
|
|
access_warn(request, 'Failed to verify provided host %s with %s ' % (req_hosts, knox_proxy))
|
|
access_warn(request, 'Failed to verify provided host %s with %s ' % (req_hosts, knox_proxy))
|
|
|
else:
|
|
else:
|
|
|
- access_warn(request, 'Failed to verify provided username %s with %s ' % (username, desktop.conf.KNOX.KNOX_PRINCIPAL.get()))
|
|
|
|
|
|
|
+ access_warn(request, 'Failed to verify provided username %s with %s ' % (principal, principals))
|
|
|
# If knox authentication failed then generate 401 (Unauthorized error)
|
|
# If knox authentication failed then generate 401 (Unauthorized error)
|
|
|
if not knox_verification:
|
|
if not knox_verification:
|
|
|
request.META['Return-401'] = ''
|
|
request.META['Return-401'] = ''
|
|
@@ -730,6 +732,15 @@ class SpnegoMiddleware(object):
|
|
|
hosts.append(host)
|
|
hosts.append(host)
|
|
|
return set(hosts)
|
|
return set(hosts)
|
|
|
|
|
|
|
|
|
|
+ def clean_principal(self, pattern):
|
|
|
|
|
+ principals = []
|
|
|
|
|
+ if pattern:
|
|
|
|
|
+ pattern_list = pattern if isinstance(pattern, list) else pattern.split(',')
|
|
|
|
|
+ for principal_host in pattern_list:
|
|
|
|
|
+ principal = principal_host.split('/')[0].strip()
|
|
|
|
|
+ principals.append(principal)
|
|
|
|
|
+ return set(principals)
|
|
|
|
|
+
|
|
|
def clean_username(self, username, request):
|
|
def clean_username(self, username, request):
|
|
|
"""
|
|
"""
|
|
|
Allows the backend to clean the username, if the backend defines a
|
|
Allows the backend to clean the username, if the backend defines a
|