RANGER-5533:Verify JWT Issuer Claims if present

ranger-authn/src/main/java/org/apache/ranger/authz/handler/jwt/RangerJwtAuthHandler.java

@@ -52,11 +52,13 @@ public abstract class RangerJwtAuthHandler implements RangerAuthHandler {
     public static final String      KEY_JWT_PUBLIC_KEY  = "jwt.public-key";    // JWT token provider public key
     public static final String      KEY_JWT_COOKIE_NAME = "jwt.cookie-name";   // JWT cookie name
     public static final String      KEY_JWT_AUDIENCES   = "jwt.audiences";
+    public static final String      KEY_JWT_ISS         = "jwt.issuers";
     public static final String      JWT_AUTHZ_PREFIX    = "Bearer ";
 
     protected static String cookieName = "hadoop-jwt";
 
     protected List<String>               audiences;
+    protected List<String>               issuers;
     protected JWKSource<SecurityContext> keySource;
     private   JWSVerifier                 verifier;
     private   String               jwksProviderUrl;
@@ -99,6 +101,12 @@ public void initialize(final Properties config) throws Exception {
             audiences = Arrays.asList(audiencesStr.split(","));
         }
 
+        // setup issuers if configured
+        String issuersStr = config.getProperty(KEY_JWT_ISS);
+        if (StringUtils.isNotBlank(issuersStr)) {
+            issuers = Arrays.asList(issuersStr.split(","));
+        }
+
         if (LOG.isDebugEnabled()) {
             LOG.debug("<<<=== RangerJwtAuthHandler.initialize()");
         }
@@ -182,20 +190,25 @@ protected boolean validateToken(final SignedJWT jwtToken) {
         boolean expValid = validateExpiration(jwtToken);
         boolean sigValid = false;
         boolean audValid = false;
+        boolean issValid = false;
 
         if (expValid) {
             sigValid = validateSignature(jwtToken);
 
             if (sigValid) {
                 audValid = validateAudiences(jwtToken);
+
+                if (audValid) {
+                    issValid = validateIssuer(jwtToken);
+                }
             }
         }
 
         if (LOG.isDebugEnabled()) {
-            LOG.debug("expValid={}, sigValid={}, audValid={}", expValid, sigValid, audValid);
+            LOG.debug("expValid={}, sigValid={}, audValid={}, issValid={}", expValid, sigValid, audValid, issValid);
         }
 
-        return sigValid && audValid && expValid;
+        return sigValid && audValid && expValid && issValid;
     }
 
     /**
@@ -290,6 +303,38 @@ protected boolean validateAudiences(final SignedJWT jwtToken) {
         return valid;
     }
 
+    /**
+     * Validate whether any of the accepted issuer claims is present in the issued
+     * token claims list for issuer. Override this method in subclasses in order
+     * to customize the audience validation behavior.
+     *
+     * @param jwtToken the JWT token from which the JWT issuer will be obtained
+     * @return true if an expected issuer is present, otherwise false
+     */
+    protected boolean validateIssuer(final SignedJWT jwtToken) {
+        boolean valid = false;
+        try {
+            String tokenIssuer = jwtToken.getJWTClaimsSet().getIssuer();
+            // if there were no expected issuers configured then just consider any issuer acceptable
+            if (issuers == null) {
+                valid = true;
+            } else {
+                // if any of the configured issuers is found then consider it acceptable
+                if (issuers.contains(tokenIssuer)) {
+                    if (LOG.isDebugEnabled()) {
+                        LOG.debug("JWT token issuer has been successfully validated.");
+                    }
+                    valid = true;
+                } else {
+                    LOG.warn("JWT issuer validation failed.");
+                }
+            }
+        } catch (ParseException pe) {
+            LOG.warn("Unable to parse the JWT token.", pe);
+        }
+        return valid;
+    }
+
     /**
      * Validate that the expiration time of the JWT has not been violated. If
      * it has, then throw an AuthenticationException. Override this method in

security-admin/src/main/java/org/apache/ranger/security/web/filter/RangerJwtAuthFilter.java

@@ -73,6 +73,7 @@ public void initialize() {
             config.setProperty(RangerJwtAuthHandler.KEY_JWT_PUBLIC_KEY, PropertiesUtil.getProperty(RangerSSOAuthenticationFilter.JWT_PUBLIC_KEY, ""));
             config.setProperty(RangerJwtAuthHandler.KEY_JWT_COOKIE_NAME, PropertiesUtil.getProperty(RangerSSOAuthenticationFilter.JWT_COOKIE_NAME, RangerSSOAuthenticationFilter.JWT_COOKIE_NAME_DEFAULT));
             config.setProperty(RangerJwtAuthHandler.KEY_JWT_AUDIENCES, PropertiesUtil.getProperty(RangerSSOAuthenticationFilter.JWT_AUDIENCES, ""));
+            config.setProperty(RangerJwtAuthHandler.KEY_JWT_ISS, PropertiesUtil.getProperty(RangerSSOAuthenticationFilter.JWT_ISSUERS, ""));
 
             super.initialize(config);
         } catch (Exception e) {

security-admin/src/main/java/org/apache/ranger/security/web/filter/RangerSSOAuthenticationFilter.java

@@ -80,6 +80,7 @@ public class RangerSSOAuthenticationFilter implements Filter {
     public static final String JWT_PUBLIC_KEY                       = "ranger.sso.publicKey";
     public static final String JWT_COOKIE_NAME                      = "ranger.sso.cookiename";
     public static final String JWT_AUDIENCES                        = "ranger.sso.audiences";
+    public static final String JWT_ISSUERS                          = "ranger.sso.issuers";
     public static final String JWT_ORIGINAL_URL_QUERY_PARAM         = "ranger.sso.query.param.originalurl";
     public static final String JWT_COOKIE_NAME_DEFAULT              = "hadoop-jwt";
     public static final String JWT_ORIGINAL_URL_QUERY_PARAM_DEFAULT = "originalUrl";

security-admin/src/test/java/org/apache/ranger/security/web/filter/TestRangerSSOAuthenticationFilter.java

@@ -498,4 +498,9 @@ public void testDoFilter_ssoDisabled_locallogin_redirectsToLoginJsp() throws Exc
         verify(res, times(1)).sendRedirect("/login.jsp");
         verify(chain, times(0)).doFilter(any(ServletRequest.class), any(ServletResponse.class));
     }
+
+    @Test
+    void testJwtIssuersConstant() {
+        assertEquals("ranger.sso.issuers", RangerSSOAuthenticationFilter.JWT_ISSUERS);
+    }
 }