Skip to content

Commit e3aaa8a

Browse files
imbajinimbajin
committed
Refactor authentication and improve security docs
Enhanced internal authentication logic and documentation in Authentication.java, emphasizing production security best practices. Refactored TokenUtil for clarity and immutability. Improved code formatting in PDPulseTest and SampleRegister, and updated ServiceConstant with stricter external exposure warnings.
1 parent 891391f commit e3aaa8a

File tree

5 files changed

+53
-41
lines changed

5 files changed

+53
-41
lines changed

‎hugegraph-pd/hg-pd-service/src/main/java/org/apache/hugegraph/pd/service/interceptor/Authentication.java‎

Lines changed: 34 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -19,32 +19,52 @@
1919

2020
import java.nio.charset.StandardCharsets;
2121
import java.util.Base64;
22-
import java.util.HashSet;
2322
import java.util.Set;
2423
import java.util.function.Function;
2524
import java.util.function.Supplier;
2625

2726
import org.apache.commons.lang3.StringUtils;
28-
import org.apache.hugegraph.pd.KvService;
29-
import org.apache.hugegraph.pd.common.Cache;
30-
import org.apache.hugegraph.pd.config.PDConfig;
31-
import org.apache.hugegraph.pd.util.TokenUtil;
32-
import org.apache.hugegraph.util.StringEncoding;
33-
import org.springframework.beans.factory.annotation.Autowired;
3427
import org.springframework.security.access.AccessDeniedException;
3528
import org.springframework.security.authentication.BadCredentialsException;
3629
import org.springframework.stereotype.Component;
3730

31+
/**
32+
* Simple internal authentication component for PD service.
33+
* <p>
34+
* <b>WARNING:</b> This class currently implements only basic internal authentication
35+
* validation for internal modules (hg, store, hubble, vermeer). The authentication mechanism
36+
* is designed for internal service-to-service communication only.
37+
* </p>
38+
*
39+
* <p><b>Important SEC Considerations:</b></p>
40+
* <ul>
41+
* <li><b>DO NOT expose RPC interfaces to external networks</b> - This authentication is NOT
42+
* designed for public-facing services and should only be used in trusted internal networks.</li>
43+
* <li><b>Production Environment Best Practices:</b> It is STRONGLY RECOMMENDED to configure
44+
* IP whitelisting and network-level access control policies (e.g., firewall rules,
45+
* security groups) to restrict access to trusted sources only.</li>
46+
* <li><b>Future Improvements:</b> This authentication mechanism will be enhanced in future
47+
* versions with more robust security features. Do not rely on this as the sole security
48+
* measure for production deployments.</li>
49+
* </ul>
50+
*
51+
* <p>
52+
* For production deployments, ensure proper network isolation and implement defense-in-depth
53+
* strategies including but not limited to:
54+
* - VPC isolation
55+
* - IP whitelisting
56+
* - TLS/mTLS encryption,
57+
* and regular security audits.
58+
* </p>
59+
*/
3860
@Component
3961
public class Authentication {
40-
private static volatile TokenUtil util;
41-
42-
private static final Set<String> innerUsers = Set.of("hg", "store", "hubble", "vermeer");
43-
private static String invalidBasicInfo = "invalid basic authentication info";
62+
private static final Set<String> innerModules = Set.of("hg", "store", "hubble", "vermeer");
4463

4564
protected <T> T authenticate(String authority, String token, Function<String, T> tokenCall,
4665
Supplier<T> call) {
4766
try {
67+
String invalidBasicInfo = "invalid basic authentication info";
4868
if (StringUtils.isEmpty(authority)) {
4969
throw new BadCredentialsException(invalidBasicInfo);
5070
}
@@ -55,9 +75,10 @@ protected <T> T authenticate(String authority, String token, Function<String, T>
5575
if (delim == -1) {
5676
throw new BadCredentialsException(invalidBasicInfo);
5777
}
78+
5879
String name = info.substring(0, delim);
59-
String pwd = info.substring(delim + 1);
60-
if (innerUsers.contains(name)) {
80+
//String pwd = info.substring(delim + 1);
81+
if (innerModules.contains(name)) {
6182
return call.get();
6283
} else {
6384
throw new AccessDeniedException("invalid service name");

‎hugegraph-pd/hg-pd-service/src/main/java/org/apache/hugegraph/pd/util/TokenUtil.java‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -19,19 +19,17 @@
1919

2020
import java.nio.charset.StandardCharsets;
2121
import java.util.Base64;
22-
import java.util.HashMap;
2322
import java.util.Map;
2423

2524
import org.apache.hugegraph.auth.AuthConstant;
2625
import org.apache.hugegraph.auth.TokenGenerator;
27-
import org.apache.hugegraph.util.StringEncoding;
2826

2927
import com.google.common.base.Charsets;
3028
import com.google.common.collect.ImmutableMap;
3129

3230
public class TokenUtil {
3331

34-
private TokenGenerator generator;
32+
private final TokenGenerator generator;
3533
public static final long AUTH_TOKEN_EXPIRE = 3600 * 24L * 1000;
3634

3735
public TokenUtil(String secretKey) {
@@ -47,20 +45,16 @@ public TokenUtil(String secretKey) {
4745
// return generator.create(payload, AUTH_TOKEN_EXPIRE);
4846
// }
4947
public String getToken(String[] info) {
50-
Map<String, ?> payload = ImmutableMap.of(AuthConstant.TOKEN_USER_NAME,
51-
info[0]);
52-
byte[] bytes =
53-
generator.create(payload, AUTH_TOKEN_EXPIRE).getBytes(StandardCharsets.UTF_8);
48+
Map<String, ?> payload = ImmutableMap.of(AuthConstant.TOKEN_USER_NAME, info[0]);
49+
byte[] bytes = generator.create(payload, AUTH_TOKEN_EXPIRE).
50+
getBytes(StandardCharsets.UTF_8);
5451
byte[] encode = Base64.getEncoder().encode(bytes);
5552
return new String(encode, Charsets.UTF_8);
5653
}
5754

5855
public boolean verify(String token, String[] info) {
5956
byte[] decode = Base64.getDecoder().decode(token);
6057
String d = new String(decode, StandardCharsets.UTF_8);
61-
if (d.equals(info[1])) {
62-
return true;
63-
}
64-
return false;
58+
return d.equals(info[1]);
6559
}
6660
}

‎hugegraph-pd/hg-pd-test/src/main/java/org/apache/hugegraph/pd/client/PDPulseTest.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,7 @@ public class PDPulseTest {
4545

4646
@BeforeClass
4747
public static void beforeClass() throws Exception {
48-
pdConfig = PDConfig.of("localhost:8686").setAuthority(SERVICE_NAME,
49-
AUTHORITY);
48+
pdConfig = PDConfig.of("localhost:8686").setAuthority(SERVICE_NAME, AUTHORITY);
5049
// pdConfig.setEnableCache(true);
5150
// pdClient = PDClient.create(pdConfig);
5251
// pdClient.getLeader();

‎hugegraph-server/hugegraph-core/src/main/java/org/apache/hugegraph/constant/ServiceConstant.java‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,13 @@
1717

1818
package org.apache.hugegraph.constant;
1919

20+
/**
21+
* TODO:
22+
* Strictly prohibited from external exposure; network IP whitelisting must be
23+
* configured in production environments.
24+
* refer: src/main/java/org/apache/hugegraph/pd/service/interceptor/Authentication.java
25+
*/
2026
public class ServiceConstant {
21-
22-
// FIXME: Strictly prohibited from external exposure; network IP whitelisting must be
23-
// configured in production environments.
2427
public static final String SERVICE_NAME = "hg";
2528
public static final String AUTHORITY = "";
2629
}

‎hugegraph-server/hugegraph-core/src/main/java/org/apache/hugegraph/space/register/registerImpl/SampleRegister.java‎

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,7 @@ private RegisterConfig decodeConfigMap(String configMap) {
4242
RegisterConfig config = new RegisterConfig();
4343
Gson gson = new Gson();
4444
ServiceDTO serviceDTO = gson.fromJson(configMap, ServiceDTO.class);
45-
config.setNodePort(
46-
serviceDTO.getSpec().getPorts().get(0).getNodePort().toString());
45+
config.setNodePort(serviceDTO.getSpec().getPorts().get(0).getNodePort().toString());
4746
config.setNodeName(serviceDTO.getSpec().getClusterIP());
4847
config.setPodIp("127.0.0.1");
4948
config.setPodPort("8080");
@@ -52,23 +51,19 @@ private RegisterConfig decodeConfigMap(String configMap) {
5251

5352
public String init(String appName) throws Exception {
5453
File file = new File("/home/scorpiour/HugeGraph/hugegraph-plugin/example/k8s-service.json");
55-
FileInputStream input = new FileInputStream(file);
56-
System.out.printf("load file: %s%n", file.toPath());
5754

58-
try {
59-
Long fileLength = file.length();
60-
byte[] bytes = new byte[fileLength.intValue()];
55+
try (FileInputStream input = new FileInputStream(file)) {
56+
System.out.printf("load file: %s%n", file.toPath());
57+
long fileLength = file.length();
58+
byte[] bytes = new byte[(int) fileLength];
6159
input.read(bytes);
6260
String configMap = new String(bytes);
6361
RegisterConfig config = this.decodeConfigMap(configMap);
6462
config.setGrpcAddress("127.0.0.1:8686");
6563
config.setAppName(appName);
6664
System.out.printf("load file: %s%n", file.toPath());
67-
String var8 = this.registerService(config);
68-
return var8;
69-
} catch (IOException var12) {
70-
} finally {
71-
input.close();
65+
return this.registerService(config);
66+
} catch (IOException ignored) {
7267
}
7368

7469
return "";

0 commit comments

Comments
 (0)