[HADOOP-13930] Azure: Add Authorization support to WASB

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.8.0
• Fix Version/s: 2.9.0, 3.0.0-alpha4
• Component/s: fs/azure
• Target Version/s: 2.9.0
• Hadoop Flags: Reviewed
• Assignee: Sivaguru Sankaridurg
• Reporter: Dushyanth
• Created: 21/Dec/16 19:38
• Updated: 24/Apr/18 20:46
• Resolved: 04/Mar/17 01:10

Description

As highlighted in HADOOP-13863, current implementation of WASB does not support authorization to any File System operations. This jira is created to add authorization support for WASB. The current approach is to enforce authorization via an external REST service (One approach could be to use component like Ranger to enforce authorization). The support for authorization would be hiding behind a configuration flag : "fs.azure.enable.authorization" and the remote service is expected to be provided via config : "fs.azure.remote.auth.service.url".

The remote service is expected to provide support for the following REST call:

{URL}/CHECK_AUTHORIZATION```

An example request:{URL}

/CHECK_AUTHORIZATION?wasb_absolute_path=<absolute_path>&operation_type=<operation type>&delegation_token=<delegation token>

Issue Links

• is cloned by: HADOOP-14565 Azure: Add Authorization support to ADLS
• relates to: HADOOP-13945 Azure: Add Kerberos and Delegation token support to WASB client.