pentaho/pentaho-mongodb-plugin — pull request #41 by jganoff (2013-09-10 05:59:28+00:00)
Title: Implemented support for Kerberos when authenticated via kinit

In order to authenticate with MongoDB via Kerberos you must execute operations within a privileged action. This is the first stab at allowing a user previously authenticated with Kerberos to communicate with a secure MongoDB instance. All MongoDB Input and Output step operations are supported in addition to the XUL Input dialog used in Reporting. This does not add Kerberos support to the XUL dialog; however, it is tested and continues to function with the changes. Most of the code change is refactoring existing logic to be executed within `PrivilegedExceptionAction`s. I tried to change as little as possible.

This change also introduces `org.pentaho.mongo.AuthContext`. This is loosely modeled after Hadoop's `UserGroupInformation` and allows a developer to easily execute code on behalf of an authenticated `LoginContext`. `MongoUtils.createAuthContext(..)` can be used to obtain one from a MongoDB Input or Output meta.

These changes need to be elaborated on to support keytab usage for headless environments. See `org.pentaho.mongo.KerberosUtil` for how I've wired up the LoginContext/Configuration programmatically so no additional work is required by the user to set up PDI or Reporting to work with Kerberos.

Note: There is an unfortunate amount of code duplication due to the separate classes for input and output metadata. It would be best to consolidate these - at least behind a common interface so a lot of the code duplication can be avoided in the future.