[AMBARI-8426] Provide access to session from resource handler/provider

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0
• Fix Version/s: 2.0.0
• Component/s: ambari-server
• Labels: encryption kerberos security session
• Epic Link: Ambari Automated Kerberization
• Assignee: Tom Beerbower
• Reporter: Robert Levas
• Created: 24/Nov/14 14:18
• Updated: 09/Dec/14 01:00
• Resolved: 09/Dec/14 01:00

Description

There should be a way to get access to the web server's session data from a (REST API) resource handler.

This will allow a resource handler to access information such as a session encryption key that may be used to encrypt data during that session. An example of this would be when performing Kerberos-related activities, the following flow can occur:

1. Session encryption key is created
2. User uploads KDC administrator credentials
3. administrator credential are encrypted using the session encryption key and persisted - maybe on disk, maybe in the Ambari database
4. For every Kerberos administration action that needs to occur during that session, the administrative credentials may be loaded into memory, decrypted, used, and removed from memory
5. When the session terminates, the encryption key is lost and the persisted administrator credentials become lost

Issue Links

• is required by: AMBARI-8447 Update ConfigurationResourceProvider to handle Kerberos Administrative Credentials as a special case
• links to: Code review and patch.