[CALCITE-4152] Avoid SPNEGO re-negotiation for each request

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: avatica-1.20.0
• Component/s: avatica
• Assignee: Josh Elser
• Reporter: Istvan Toth
• Created: 03/Aug/20 07:34
• Updated: 14/Aug/24 12:25
• Resolved: 29/Oct/21 17:13

Description

When using SPNEGO authentication with Avatica, every HTTP request re-initiates the negotiation, doubling the number HTTP requests.

Consider switching to cookies after the initial SPNEGO authentication succeeds.

Jetty ticket that discusses the issue: https://github.com/eclipse/jetty.project/issues/2868

Description of the Knox implementation

https://cwiki.apache.org/confluence/display/KNOX/2017/02/24/Hadoop+Auth+%28SPNEGO+and+delegation+token+based+authentication%29+with+Apache+Knox

Issue Links

• causes: CALCITE-6530 HTTP Sessions are never expired in Avatica server
• causes: CALCITE-4935 Avatica standalone-server shades log4j without relocation
• relates to: CALCITE-5112 Upgrade Jetty version from 9.4.15.v20190215 to 9.4.46.v20220331
• relates to: HBASE-28489 Implement HTTP session support in REST server and client for default auth
• relates to: PHOENIX-6750 Bump Avatica version to 1.21.0 in queryserver
• supercedes: CALCITE-4651 Try to get the SPENGO specific Jetty fixes/overrides in Avatica into Jetty
• links to: Github Pull Request #132