[AURORA-809] Use Apache Shiro for HTTP authentication

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.8.0
• Component/s: Security
• Epic Link: Scheduler Security
• Sprint: Twitter Aurora Q1'15 Sprint 3, Twitter Aurora Q1'15 Sprint 4
• Story Points: 5
• Assignee: Kevin Sweeney
• Reporter: Chris Lambert
• Created: 08/Oct/14 03:17
• Updated: 20/Mar/15 04:34
• Resolved: 14/Mar/15 22:58

Description

• Wire in ShiroWebModule behind optional flag, add ability to use shiro.ini + HTTP Basic Authentication
• Create a ShiroAuthModule as an alternative to UnsecureAuthModule
• Add a ShiroCapabilityValidator that delegates to Shiro (keeping compatibility with the existing CapabilityValidator API)
• Expose flag for custom Realm implementation.

Issue Links

• blocks: AURORA-904 0.8.0 Release Candidate
• duplicates: AURORA-31 Support an authentication mechanism for client-scheduler communication