Token

Usually when the third-party system calls the linkis service, it usually authenticates through token

Control through unified authentication processing filter: org.apache.linkis.server.security.SecurityFilter

Implemented pseudocode

  2. val TOKEN_KEY = "Token-Code"
  3. val TOKEN_USER_KEY = "Token-User"
  5. /* TokenAuthentication.isTokenRequest by judging the request request:
  6.       1. Whether the request header contains TOKEN_KEY and TOKEN_USER_KEY: getHeaders.containsKey(TOKEN_KEY) && getHeaders.containsKey(TOKEN_USER_KEY)
  7.       2. Or request whether TOKEN_KEY and TOKEN_USER_KEY are included in the cookies: getCookies.containsKey(TOKEN_KEY) &&getCookies.containsKey(TOKEN_USER_KEY)
  8. */
  10. if (TokenAuthentication.isTokenRequest(gatewayContext)) {
  11.        /* Perform token authentication
  12.          1. Confirm whether to enable the token authentication configuration item `wds.linkis.gateway.conf.enable.token.auth`
  13.          2. Extract the token tokenUser host information for authentication and verify the validity
  14.        */
  15.        TokenAuthentication. tokenAuth(gatewayContext)
  16.      } else {
  17.      //Common username and password authentication
  18. }

Available tokens and corresponding ip-related information data are stored in the table linkis_mg_gateway_auth_token, see [table analysis description] (../development/table/all#16-linkis_mg_gateway_auth_token) for details, non-real-time update, Periodically wds.linkis.token.cache.expire.hour (default interval 12 hours) is refreshed into the service memory

Management console Basic Data Management > Token Management to add

  1. Name: token name corresponds to Token-Code, such as: TEST-AUTH
  2. User: The username corresponding to the token, that is, the perceived requesting user, will be used for log auditing. If there is no limit, it can be configured as *
  3. Host: The host that can be accessed will perform the IP verification and filtering of the requester. If there is no limit, it can be configured as *
  4. Valid days: If it is permanently valid, configure it as -1

The constructed http request method needs to add Token-Code, Token-User parameters in the request header,

Request address: http://127.0.0.1:9001/api/rest_j/v1/entrance/submit

body parameter:

  1. {
  2.      "executionContent": {"code": "sleep 5s;echo pwd", "runType": "shell"},
  3.      "params": {"variable": {}, "configuration": {}},
  4.      "source": {"scriptPath": "file:///mnt/bdp/hadoop/1.hql"},
  5.      "labels": {
  6.          "engineType": "shell-1",
  7.          "userCreator": "hadoop-IDE",
  8.          "executeOnce": "false"
  9.      }
  10. }

Request header header:

  1. Content-Type: application/json
  2. Token-Code: BML-AUTH
  3. Token-User: hadoop

The client authentication methods provided by linkis all support the Token strategy mode new TokenAuthenticationStrategy()

For details, please refer to SDK method

  1. // 1. build config: linkis gateway url
  2.   DWSClientConfig clientConfig = ((DWSClientConfigBuilder) (DWSClientConfigBuilder.newBuilder()
  3.          .addServerUrl("http://127.0.0.1:9001/") //set linkis-mg-gateway url: http://{ip}:{port}
  4.          .connectionTimeout(30000) //connectionTimeOut
  5.          .discoveryEnabled(false) //disable discovery
  6.          .discoveryFrequency(1, TimeUnit.MINUTES) // discovery frequency
  7.          .loadbalancerEnabled(true) // enable loadbalance
  8.          .maxConnectionSize(5) // set max Connection
  9.          .retryEnabled(false) // set retry
  10.          .readTimeout(30000) //set read timeout
  11.          .setAuthenticationStrategy(new TokenAuthenticationStrategy()) // AuthenticationStrategy Linkis auth Token
  12.          .setAuthTokenKey("Token-Code") // set token key
  13.          .setAuthTokenValue("DSM-AUTH") // set token value
  14.          .setDWSVersion("v1") //linkis rest version v1
  15.          .build();

Supported tokens, the corresponding available users/applicable requester ip are controlled by the table linkis_mg_gateway_auth_token, the loading is not updated in real time, and the caching mechanism is used

For the restriction of high-risk operations, the token of the administrator role is required to operate, and the format of the administrator token is admin-xxx