[HADOOP-11766] Generic token authentication support for Hadoop

• Type: New Feature
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: security
• Assignee: Kai Zheng
• Reporter: Kai Zheng
• Created: 28/Mar/15 02:52
• Updated: 23/Apr/18 11:07

Description

As a major goal of Rhino project, we proposed TokenAuth effort in HADOOP-9392, where it's to provide a common token authentication framework to integrate multiple authentication mechanisms, by adding a new AuthenticationMethod in lieu of KERBEROS and SIMPLE. To minimize the required changes and risk, we thought of another approach to achieve the general goals based on Kerberos as Kerberos itself supports a pre-authentication framework in both spec and implementation, which was discussed in HADOOP-10959 as TokenPreauth. In both approaches, we had performed workable prototypes covering both command line console and Hadoop web UI.

As HADOOP-9392 is rather lengthy and heavy, HADOOP-10959 is mostly focused on the concrete implementation approach based on Kerberos, we open this for more general and updated discussions about requirement, use cases, and concerns for the generic token authentication support for Hadoop. We distinguish this token from existing Hadoop tokens as the token in this discussion is majorly for the initial and primary authentication. We will refine our existing codes in HADOOP-9392 and HADOOP-10959, break them down into smaller patches based on latest trunk.

Issue Links

• is related to: HADOOP-9392 Token based authentication and Single Sign On
• is related to: HADOOP-10959 A Kerberos based token authentication approach
• is related to: HADOOP-11744 Support OAuth2 in Hadoop
• is related to: HADOOP-11717 Add Redirecting WebSSO behavior with JWT Token in Hadoop Auth

Sub-Tasks

• Genefic token API and representation: Open
• A JWT token implementation of AuthToken API: Open
• Pluggable token encoder, decoder and validator: Open
• A token authentication handler for Hadoop Web in generic token API: Open
• Externalize AuthToken interface: Patch Available