private void handleAuthorizeCallback(AuthorizeCallback ac) {
    String authenticationID = ac.getAuthenticationID();
    String authorizationID = ac.getAuthorizationID();

    LOG.info("Successfully authenticated client: authenticationID=" + authenticationID
            + ";  authorizationID=" + authorizationID + ".");
    ac.setAuthorized(true);

    KerberosName kerberosName = new KerberosName(authenticationID);
    try {
        StringBuilder userNameBuilder = new StringBuilder(kerberosName.getShortName());
        userNameBuilder.append("/").append(kerberosName.getHostName());
        userNameBuilder.append("@").append(kerberosName.getRealm());
        LOG.info("Setting authorizedID: " + userNameBuilder);
        ac.setAuthorizedID(userNameBuilder.toString());
    } catch (IOException e) {
        LOG.severe("Failed to set name based on Kerberos authentication rules.");
    }
}
 

private void handleAuthorizeCallback(AuthorizeCallback ac) {
    String authenticationID = ac.getAuthenticationID();
    String authorizationID = ac.getAuthorizationID();

    LOG.severe("Successfully authenticated client: authenticationID=" + authenticationID
        + ";  authorizationID=" + authorizationID + ".");
    ac.setAuthorized(true);

    KerberosName kerberosName = new KerberosName(authenticationID);
    try {
        StringBuilder userNameBuilder = new StringBuilder(kerberosName.getShortName());
        userNameBuilder.append("/").append(kerberosName.getHostName());
        userNameBuilder.append("@").append(kerberosName.getRealm());
        LOG.severe("Setting authorizedID: " + userNameBuilder);
        ac.setAuthorizedID(userNameBuilder.toString());
    } catch (IOException e) {
        LOG.severe("Failed to set name based on Kerberos authentication rules.");
    }
}
 

public TTransportFactory getServerTransportFactory() throws IOException {
    // create an authentication callback handler
    CallbackHandler server_callback_handler = new ServerCallbackHandler(login_conf, storm_conf);

    // login our principal
    Subject subject = null;
    try {
        // specify a configuration object to be used
        Configuration.setConfiguration(login_conf);
        // now login
        Login login = new Login(AuthUtils.LOGIN_CONTEXT_SERVER, server_callback_handler);
        subject = login.getSubject();
    } catch (LoginException ex) {
        LOG.error("Server failed to login in principal:" + ex, ex);
        throw new RuntimeException(ex);
    }

    // check the credential of our principal
    if (subject.getPrivateCredentials(KerberosTicket.class).isEmpty()) {
        throw new RuntimeException("Fail to verify user principal with section \"" + AuthUtils.LOGIN_CONTEXT_SERVER + "\" in login configuration file "
                + login_conf);
    }

    String principal = AuthUtils.get(login_conf, AuthUtils.LOGIN_CONTEXT_SERVER, "principal");
    LOG.debug("principal:" + principal);
    KerberosName serviceKerberosName = new KerberosName(principal);
    String serviceName = serviceKerberosName.getServiceName();
    String hostName = serviceKerberosName.getHostName();
    Map<String, String> props = new TreeMap<String, String>();
    props.put(Sasl.QOP, "auth");
    props.put(Sasl.SERVER_AUTH, "false");

    // create a transport factory that will invoke our auth callback for digest
    TSaslServerTransport.Factory factory = new TSaslServerTransport.Factory();
    factory.addServerDefinition(KERBEROS, serviceName, hostName, props, server_callback_handler);

    // create a wrap transport factory so that we could apply user credential during connections
    TUGIAssumingTransportFactory wrapFactory = new TUGIAssumingTransportFactory(factory, subject);

    LOG.info("SASL GSSAPI transport factory will be used");
    return wrapFactory;
}