[ACCUMULO-1300] Allow multiple, prioritized authentication systems

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.5.0
• Component/s: master, tserver
• Assignee: Christopher Tubbs
• Reporter: Christopher Tubbs
• Created: 17/Apr/13 22:22
• Updated: 11/Jun/19 04:28

Description

This continues the work started on ACCUMULO-1024, and proposed in detail on that ticket.

The basic idea is that authenticators should be configurable in a priority list, list the way it can be done on Linux, as in:

local > NIS > LDAP > AD

The priority for Accumulo would be:

SystemUserAuthenticator > BuiltInPasswordAuthenticator > UserConfiguredAuthenticator1 > UserConfiguredAuthenticator2 > ...

Issue Links

• contains: ACCUMULO-1929 Current auth/auth/perm API doesn't well support multiple authentication domains
• is duplicated by: ACCUMULO-1929 Current auth/auth/perm API doesn't well support multiple authentication domains
• is related to: ACCUMULO-1024 Deprecate built-in user management utilities
• is related to: ACCUMULO-1319 Remove root username prompt from init
• is related to: ACCUMULO-1165 Use a unique SystemToken (credentials) for each server instance (TServer, etc.)
• is related to: ACCUMULO-2907 Invalidate "this may not be applicable for your security setup" warning from initialize

Sub-Tasks

• Use a concrete implementation of AuthenticationToken for !SYSTEM user: Resolved
• Allow granting System.GRANT permission: Resolved