{"action":"created","comment":{"url":"https://api.github.com/repos/airlift/airlift/pulls/comments/30107324","id":30107324,"diff_hunk":"@@ -0,0 +1,173 @@\n+package io.airlift.security.utils;\n+\n+import com.google.common.base.Throwables;\n+import io.airlift.log.Logger;\n+import io.airlift.security.exception.AuthenticationException;\n+import org.ietf.jgss.GSSContext;\n+import org.ietf.jgss.GSSCredential;\n+import org.ietf.jgss.GSSException;\n+import org.ietf.jgss.GSSManager;\n+import org.ietf.jgss.GSSName;\n+import org.ietf.jgss.Oid;\n+\n+import javax.security.auth.Subject;\n+import javax.security.auth.login.AppConfigurationEntry;\n+import javax.security.auth.login.Configuration;\n+import javax.security.auth.login.LoginContext;\n+import javax.security.auth.login.LoginException;\n+\n+import java.net.InetAddress;\n+import java.net.UnknownHostException;\n+import java.security.Principal;\n+import java.security.PrivilegedAction;\n+import java.util.HashMap;\n+import java.util.Locale;\n+import java.util.Map;\n+\n+import static com.google.common.base.Preconditions.checkState;\n+\n+public class KerberosUtil\n+{\n+    private static final String KRB5_LOGIN_MODULE_NAME = \"com.sun.security.auth.module.Krb5LoginModule\";\n+    private static final Oid SPNEGO_OID;\n+    private static final Oid KERBEROS_OID;\n+    private static final Oid[] SUPPORTED_OIDS;\n+\n+    static {\n+        try {\n+            SPNEGO_OID = new Oid(\"1.3.6.1.5.5.2\");\n+            KERBEROS_OID = new Oid(\"1.2.840.113554.1.2.2\");\n+            SUPPORTED_OIDS = new Oid[] {SPNEGO_OID, KERBEROS_OID};\n+        }\n+        catch (GSSException e) {\n+            throw new AuthenticationException(e);\n+        }\n+    }\n+\n+    /**\n+     * Create Kerberos principal for a given service and hostname. It converts\n+     * hostname to lower case. If hostname is null or \"0.0.0.0\", it uses\n+     * dynamically looked-up fqdn of the current host instead.\n+     *\n+     * @param serviceName Service for which you want to generate the principal.\n+     * @param hostName Fully-qualified domain name.\n+     * @return Converted Kerberos principal name.\n+     * @throws UnknownHostException If no IP address for the local host could be found.\n+     */\n+    public static final String getServicePrincipal(String serviceName, String hostName)\n+            throws UnknownHostException\n+    {\n+        InetAddress address = hostName == null ? null : InetAddress.getByName(hostName);\n+        String fqdn;\n+        if (address == null || address.getHostName().toLowerCase().startsWith(\"localhost\")) {\n+            fqdn = InetAddress.getLocalHost().getCanonicalHostName();\n+            checkState(!fqdn.equalsIgnoreCase(\"localhost\"), \"Fully qualified host name for localhost is not retrieved\");\n+        }\n+        else {\n+            fqdn = address.getCanonicalHostName();\n+        }\n+\n+        return String.format(\"%s/%s\", serviceName, fqdn.toLowerCase(Locale.US));\n+    }\n+\n+    public static Subject getSubject(String subjectName, boolean client)\n+            throws LoginException, UnknownHostException\n+    {\n+        KerberosConfiguration kerberosConfiguration = new KerberosConfiguration(subjectName, client);\n+        String configName = client ? KerberosConfiguration.GSS_CLIENT : KerberosConfiguration.GSS_SERVER;\n+        LoginContext context = new LoginContext(configName, null, null, kerberosConfiguration);\n+        context.login();\n+        return context.getSubject();\n+    }\n+\n+    public static GSSContext getGssContext(Subject subject, String servicePrincipal, boolean initiator)\n+    {\n+        return Subject.doAs(subject, (PrivilegedAction<GSSContext>) () -> {\n+            GSSContext context = null;\n+            try {\n+                Principal subjectPrincipal = subject.getPrincipals().iterator().next();\n+                GSSManager gssManager = GSSManager.getInstance();\n+\n+                if (initiator) {\n+                    GSSName gssUserName = gssManager.createName(subjectPrincipal.getName(), GSSName.NT_USER_NAME);\n+                    GSSCredential clientCredential = gssManager.createCredential(gssUserName, GSSCredential.DEFAULT_LIFETIME,\n+                            KERBEROS_OID, GSSCredential.INITIATE_ONLY);\n+\n+                    GSSName gssServiceName = gssManager.createName(servicePrincipal, null);\n+                    context = gssManager.createContext(gssServiceName, SPNEGO_OID, clientCredential, GSSContext.INDEFINITE_LIFETIME);\n+                }\n+                else {\n+                    GSSName gssServiceName = gssManager.createName(servicePrincipal, null);\n+                    GSSCredential serverCredential = gssManager.createCredential(gssServiceName, GSSCredential.INDEFINITE_LIFETIME,\n+                            SUPPORTED_OIDS, GSSCredential.ACCEPT_ONLY);\n+                    context = gssManager.createContext(serverCredential);\n+                }\n+                context.requestMutualAuth(true);\n+                context.requestConf(true);\n+                context.requestInteg(true);\n+                context.requestCredDeleg(false);\n+                return context;\n+            }\n+            catch (GSSException e) {\n+                throw Throwables.propagate(e);\n+            }\n+        });\n+    }\n+\n+    public static class KerberosConfiguration\n+            extends Configuration\n+    {\n+        public static final String GSS_SERVER = \"gss-server\";\n+        public static final String GSS_CLIENT = \"gss-client\";\n+        private static final Logger log = Logger.get(KerberosConfiguration.class);\n+        private final String principal;\n+\n+        public KerberosConfiguration(String subjectName, boolean fromClient)\n+                throws UnknownHostException\n+        {\n+            if (fromClient) {","path":"security/src/main/java/io/airlift/security/utils/KerberosUtil.java","position":128,"original_position":128,"commit_id":"0e3be58a4552ade8c1ad6815f37670a71756719e","original_commit_id":"0e3be58a4552ade8c1ad6815f37670a71756719e","user":{"login":"zhenyuy-fb","id":9911545,"avatar_url":"https://avatars.githubusercontent.com/u/9911545?v=3","gravatar_id":"","url":"https://api.github.com/users/zhenyuy-fb","html_url":"https://github.com/zhenyuy-fb","followers_url":"https://api.github.com/users/zhenyuy-fb/followers","following_url":"https://api.github.com/users/zhenyuy-fb/following{/other_user}","gists_url":"https://api.github.com/users/zhenyuy-fb/gists{/gist_id}","starred_url":"https://api.github.com/users/zhenyuy-fb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zhenyuy-fb/subscriptions","organizations_url":"https://api.github.com/users/zhenyuy-fb/orgs","repos_url":"https://api.github.com/users/zhenyuy-fb/repos","events_url":"https://api.github.com/users/zhenyuy-fb/events{/privacy}","received_events_url":"https://api.github.com/users/zhenyuy-fb/received_events","type":"User","site_admin":false},"body":"agree.","created_at":"2015-05-12T06:17:19Z","updated_at":"2015-05-12T06:17:19Z","html_url":"https://github.com/airlift/airlift/pull/291#discussion_r30107324","pull_request_url":"https://api.github.com/repos/airlift/airlift/pulls/291","_links":{"self":{"href":"https://api.github.com/repos/airlift/airlift/pulls/comments/30107324"},"html":{"href":"https://github.com/airlift/airlift/pull/291#discussion_r30107324"},"pull_request":{"href":"https://api.github.com/repos/airlift/airlift/pulls/291"}}},"pull_request":{"url":"https://api.github.com/repos/airlift/airlift/pulls/291","id":31370926,"html_url":"https://github.com/airlift/airlift/pull/291","diff_url":"https://github.com/airlift/airlift/pull/291.diff","patch_url":"https://github.com/airlift/airlift/pull/291.patch","issue_url":"https://api.github.com/repos/airlift/airlift/issues/291","number":291,"state":"open","locked":false,"title":"Add support for client authentication","user":{"login":"zhenyuy-fb","id":9911545,"avatar_url":"https://avatars.githubusercontent.com/u/9911545?v=3","gravatar_id":"","url":"https://api.github.com/users/zhenyuy-fb","html_url":"https://github.com/zhenyuy-fb","followers_url":"https://api.github.com/users/zhenyuy-fb/followers","following_url":"https://api.github.com/users/zhenyuy-fb/following{/other_user}","gists_url":"https://api.github.com/users/zhenyuy-fb/gists{/gist_id}","starred_url":"https://api.github.com/users/zhenyuy-fb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zhenyuy-fb/subscriptions","organizations_url":"https://api.github.com/users/zhenyuy-fb/orgs","repos_url":"https://api.github.com/users/zhenyuy-fb/repos","events_url":"https://api.github.com/users/zhenyuy-fb/events{/privacy}","received_events_url":"https://api.github.com/users/zhenyuy-fb/received_events","type":"User","site_admin":false},"body":"Add support for client authentication.","created_at":"2015-03-17T19:47:04Z","updated_at":"2015-05-12T06:17:19Z","closed_at":null,"merged_at":null,"merge_commit_sha":"a0c0dfaab2ace1c1d6e8a3f319ab4ac3140cd8f6","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/airlift/airlift/pulls/291/commits","review_comments_url":"https://api.github.com/repos/airlift/airlift/pulls/291/comments","review_comment_url":"https://api.github.com/repos/airlift/airlift/pulls/comments{/number}","comments_url":"https://api.github.com/repos/airlift/airlift/issues/291/comments","statuses_url":"https://api.github.com/repos/airlift/airlift/statuses/0e3be58a4552ade8c1ad6815f37670a71756719e","head":{"label":"zhenyuy-fb:master","ref":"master","sha":"0e3be58a4552ade8c1ad6815f37670a71756719e","user":{"login":"zhenyuy-fb","id":9911545,"avatar_url":"https://avatars.githubusercontent.com/u/9911545?v=3","gravatar_id":"","url":"https://api.github.com/users/zhenyuy-fb","html_url":"https://github.com/zhenyuy-fb","followers_url":"https://api.github.com/users/zhenyuy-fb/followers","following_url":"https://api.github.com/users/zhenyuy-fb/following{/other_user}","gists_url":"https://api.github.com/users/zhenyuy-fb/gists{/gist_id}","starred_url":"https://api.github.com/users/zhenyuy-fb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zhenyuy-fb/subscriptions","organizations_url":"https://api.github.com/users/zhenyuy-fb/orgs","repos_url":"https://api.github.com/users/zhenyuy-fb/repos","events_url":"https://api.github.com/users/zhenyuy-fb/events{/privacy}","received_events_url":"https://api.github.com/users/zhenyuy-fb/received_events","type":"User","site_admin":false},"repo":{"id":30994348,"name":"airlift","full_name":"zhenyuy-fb/airlift","owner":{"login":"zhenyuy-fb","id":9911545,"avatar_url":"https://avatars.githubusercontent.com/u/9911545?v=3","gravatar_id":"","url":"https://api.github.com/users/zhenyuy-fb","html_url":"https://github.com/zhenyuy-fb","followers_url":"https://api.github.com/users/zhenyuy-fb/followers","following_url":"https://api.github.com/users/zhenyuy-fb/following{/other_user}","gists_url":"https://api.github.com/users/zhenyuy-fb/gists{/gist_id}","starred_url":"https://api.github.com/users/zhenyuy-fb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zhenyuy-fb/subscriptions","organizations_url":"https://api.github.com/users/zhenyuy-fb/orgs","repos_url":"https://api.github.com/users/zhenyuy-fb/repos","events_url":"https://api.github.com/users/zhenyuy-fb/events{/privacy}","received_events_url":"https://api.github.com/users/zhenyuy-fb/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/zhenyuy-fb/airlift","description":"Airlift framework for building REST services","fork":true,"url":"https://api.github.com/repos/zhenyuy-fb/airlift","forks_url":"https://api.github.com/repos/zhenyuy-fb/airlift/forks","keys_url":"https://api.github.com/repos/zhenyuy-fb/airlift/keys{/key_id}","collaborators_url":"https://api.github.com/repos/zhenyuy-fb/airlift/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/zhenyuy-fb/airlift/teams","hooks_url":"https://api.github.com/repos/zhenyuy-fb/airlift/hooks","issue_events_url":"https://api.github.com/repos/zhenyuy-fb/airlift/issues/events{/number}","events_url":"https://api.github.com/repos/zhenyuy-fb/airlift/events","assignees_url":"https://api.github.com/repos/zhenyuy-fb/airlift/assignees{/user}","branches_url":"https://api.github.com/repos/zhenyuy-fb/airlift/branches{/branch}","tags_url":"https://api.github.com/repos/zhenyuy-fb/airlift/tags","blobs_url":"https://api.github.com/repos/zhenyuy-fb/airlift/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/zhenyuy-fb/airlift/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/zhenyuy-fb/airlift/git/refs{/sha}","trees_url":"https://api.github.com/repos/zhenyuy-fb/airlift/git/trees{/sha}","statuses_url":"https://api.github.com/repos/zhenyuy-fb/airlift/statuses/{sha}","languages_url":"https://api.github.com/repos/zhenyuy-fb/airlift/languages","stargazers_url":"https://api.github.com/repos/zhenyuy-fb/airlift/stargazers","contributors_url":"https://api.github.com/repos/zhenyuy-fb/airlift/contributors","subscribers_url":"https://api.github.com/repos/zhenyuy-fb/airlift/subscribers","subscription_url":"https://api.github.com/repos/zhenyuy-fb/airlift/subscription","commits_url":"https://api.github.com/repos/zhenyuy-fb/airlift/commits{/sha}","git_commits_url":"https://api.github.com/repos/zhenyuy-fb/airlift/git/commits{/sha}","comments_url":"https://api.github.com/repos/zhenyuy-fb/airlift/comments{/number}","issue_comment_url":"https://api.github.com/repos/zhenyuy-fb/airlift/issues/comments{/number}","contents_url":"https://api.github.com/repos/zhenyuy-fb/airlift/contents/{+path}","compare_url":"https://api.github.com/repos/zhenyuy-fb/airlift/compare/{base}...{head}","merges_url":"https://api.github.com/repos/zhenyuy-fb/airlift/merges","archive_url":"https://api.github.com/repos/zhenyuy-fb/airlift/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/zhenyuy-fb/airlift/downloads","issues_url":"https://api.github.com/repos/zhenyuy-fb/airlift/issues{/number}","pulls_url":"https://api.github.com/repos/zhenyuy-fb/airlift/pulls{/number}","milestones_url":"https://api.github.com/repos/zhenyuy-fb/airlift/milestones{/number}","notifications_url":"https://api.github.com/repos/zhenyuy-fb/airlift/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/zhenyuy-fb/airlift/labels{/name}","releases_url":"https://api.github.com/repos/zhenyuy-fb/airlift/releases{/id}","created_at":"2015-02-19T00:18:23Z","updated_at":"2015-04-17T06:42:34Z","pushed_at":"2015-04-17T06:42:34Z","git_url":"git://github.com/zhenyuy-fb/airlift.git","ssh_url":"git@github.com:zhenyuy-fb/airlift.git","clone_url":"https://github.com/zhenyuy-fb/airlift.git","svn_url":"https://github.com/zhenyuy-fb/airlift","homepage":"","size":7871,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"airlift:master","ref":"master","sha":"2494848c939861c2ecd36b65af9f4ae4842c5391","user":{"login":"airlift","id":1855389,"avatar_url":"https://avatars.githubusercontent.com/u/1855389?v=3","gravatar_id":"","url":"https://api.github.com/users/airlift","html_url":"https://github.com/airlift","followers_url":"https://api.github.com/users/airlift/followers","following_url":"https://api.github.com/users/airlift/following{/other_user}","gists_url":"https://api.github.com/users/airlift/gists{/gist_id}","starred_url":"https://api.github.com/users/airlift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/airlift/subscriptions","organizations_url":"https://api.github.com/users/airlift/orgs","repos_url":"https://api.github.com/users/airlift/repos","events_url":"https://api.github.com/users/airlift/events{/privacy}","received_events_url":"https://api.github.com/users/airlift/received_events","type":"Organization","site_admin":false},"repo":{"id":4681328,"name":"airlift","full_name":"airlift/airlift","owner":{"login":"airlift","id":1855389,"avatar_url":"https://avatars.githubusercontent.com/u/1855389?v=3","gravatar_id":"","url":"https://api.github.com/users/airlift","html_url":"https://github.com/airlift","followers_url":"https://api.github.com/users/airlift/followers","following_url":"https://api.github.com/users/airlift/following{/other_user}","gists_url":"https://api.github.com/users/airlift/gists{/gist_id}","starred_url":"https://api.github.com/users/airlift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/airlift/subscriptions","organizations_url":"https://api.github.com/users/airlift/orgs","repos_url":"https://api.github.com/users/airlift/repos","events_url":"https://api.github.com/users/airlift/events{/privacy}","received_events_url":"https://api.github.com/users/airlift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/airlift/airlift","description":"Airlift framework for building REST services","fork":false,"url":"https://api.github.com/repos/airlift/airlift","forks_url":"https://api.github.com/repos/airlift/airlift/forks","keys_url":"https://api.github.com/repos/airlift/airlift/keys{/key_id}","collaborators_url":"https://api.github.com/repos/airlift/airlift/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/airlift/airlift/teams","hooks_url":"https://api.github.com/repos/airlift/airlift/hooks","issue_events_url":"https://api.github.com/repos/airlift/airlift/issues/events{/number}","events_url":"https://api.github.com/repos/airlift/airlift/events","assignees_url":"https://api.github.com/repos/airlift/airlift/assignees{/user}","branches_url":"https://api.github.com/repos/airlift/airlift/branches{/branch}","tags_url":"https://api.github.com/repos/airlift/airlift/tags","blobs_url":"https://api.github.com/repos/airlift/airlift/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/airlift/airlift/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/airlift/airlift/git/refs{/sha}","trees_url":"https://api.github.com/repos/airlift/airlift/git/trees{/sha}","statuses_url":"https://api.github.com/repos/airlift/airlift/statuses/{sha}","languages_url":"https://api.github.com/repos/airlift/airlift/languages","stargazers_url":"https://api.github.com/repos/airlift/airlift/stargazers","contributors_url":"https://api.github.com/repos/airlift/airlift/contributors","subscribers_url":"https://api.github.com/repos/airlift/airlift/subscribers","subscription_url":"https://api.github.com/repos/airlift/airlift/subscription","commits_url":"https://api.github.com/repos/airlift/airlift/commits{/sha}","git_commits_url":"https://api.github.com/repos/airlift/airlift/git/commits{/sha}","comments_url":"https://api.github.com/repos/airlift/airlift/comments{/number}","issue_comment_url":"https://api.github.com/repos/airlift/airlift/issues/comments{/number}","contents_url":"https://api.github.com/repos/airlift/airlift/contents/{+path}","compare_url":"https://api.github.com/repos/airlift/airlift/compare/{base}...{head}","merges_url":"https://api.github.com/repos/airlift/airlift/merges","archive_url":"https://api.github.com/repos/airlift/airlift/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/airlift/airlift/downloads","issues_url":"https://api.github.com/repos/airlift/airlift/issues{/number}","pulls_url":"https://api.github.com/repos/airlift/airlift/pulls{/number}","milestones_url":"https://api.github.com/repos/airlift/airlift/milestones{/number}","notifications_url":"https://api.github.com/repos/airlift/airlift/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/airlift/airlift/labels{/name}","releases_url":"https://api.github.com/repos/airlift/airlift/releases{/id}","created_at":"2012-06-16T00:33:13Z","updated_at":"2015-05-08T22:52:17Z","pushed_at":"2015-05-08T20:33:31Z","git_url":"git://github.com/airlift/airlift.git","ssh_url":"git@github.com:airlift/airlift.git","clone_url":"https://github.com/airlift/airlift.git","svn_url":"https://github.com/airlift/airlift","homepage":"","size":15172,"stargazers_count":92,"watchers_count":92,"language":"Java","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":40,"mirror_url":null,"open_issues_count":21,"forks":40,"open_issues":21,"watchers":92,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/airlift/airlift/pulls/291"},"html":{"href":"https://github.com/airlift/airlift/pull/291"},"issue":{"href":"https://api.github.com/repos/airlift/airlift/issues/291"},"comments":{"href":"https://api.github.com/repos/airlift/airlift/issues/291/comments"},"review_comments":{"href":"https://api.github.com/repos/airlift/airlift/pulls/291/comments"},"review_comment":{"href":"https://api.github.com/repos/airlift/airlift/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/airlift/airlift/pulls/291/commits"},"statuses":{"href":"https://api.github.com/repos/airlift/airlift/statuses/0e3be58a4552ade8c1ad6815f37670a71756719e"}}}}