[HADOOP-11717] Add Redirecting WebSSO behavior with JWT Token in Hadoop Auth

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.8.0, 3.0.0-alpha1
• Component/s: security
• Hadoop Flags: Reviewed
• Assignee: Larry McCay
• Reporter: Larry McCay
• Created: 14/Mar/15 16:22
• Updated: 03/Dec/19 22:01
• Resolved: 07/Apr/15 15:15

Description

Extend AltKerberosAuthenticationHandler to provide WebSSO flow for UIs.

The actual authentication is done by some external service that the handler will redirect to when there is no hadoop.auth cookie and no JWT token found in the incoming request.

Using JWT provides a number of benefits:

• It is not tied to any specific authentication mechanism - so buys us many SSO integrations
• It is cryptographically verifiable for determining whether it can be trusted
• Checking for expiration allows for a limited lifetime and window for compromised use

This will introduce the use of nimbus-jose-jwt library for processing, validating and parsing JWT tokens.

Issue Links

• breaks: HADOOP-11846 TestCertificateUtil.testCorruptPEM failing on Jenkins JDK8
• breaks: HADOOP-11864 JWTRedirectAuthenticationHandler breaks java8 javadocs
• is related to: HADOOP-11817 A token authentication handler for Hadoop Web in generic token API
• is related to: HADOOP-12481 JWTRedirectAuthenticationHandler doesn't Retain Original Query String
• relates to: HADOOP-10959 A Kerberos based token authentication approach
• relates to: HADOOP-11766 Generic token authentication support for Hadoop
• relates to: HADOOP-15075 Implement KnoxSSO for hadoop web UIs (hdfs, yarn, history server etc.)
• mentioned in: Page Loading...