Uploaded image for project: 'Hadoop Common'
  1. Hadoop Common
  2. HADOOP-16095

Support impersonation for AuthenticationFilter

    XMLWordPrintableJSON

    Details

    • Type: New Feature
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 3.3.0
    • Component/s: security
    • Labels:
      None

      Description

      External services or YARN service may need to call into WebHDFS or YARN REST API on behave of the user using web protocols. It would be good to support impersonation mechanism in AuthenticationFilter or similar extensions. The general design is similar to UserGroupInformation.doAs in RPC layer.

      The calling service credential is verified as a proxy user coming from a trusted host verifying Hadoop proxy user ACL on the server side. If proxy user ACL allows proxy user to become doAs user. HttpRequest object will report REMOTE_USER as doAs user. This feature enables web application logic to be written with minimal changes to call Hadoop API with UserGroupInformation.doAs() wrapper.

      HTTP Request

      A few possible options:

      1. Using query parameter to pass doAs user:

      POST /service?doAs=foobar
      Authorization: [proxy user Kerberos token]
      

      2. Use HTTP Header to pass doAs user:

      POST /service
      Authorization: [proxy user Kerberos token]
      x-hadoop-doas: foobar
      

      HTTP Response

      403 - Forbidden (Including impersonation is not allowed)

      Proxy User ACL requirement

      Proxy user kerberos token maps to a service principal, such as yarn/host1.example.com. The host part of the credential and HTTP request origin are both validated with hadoop.proxyuser.yarn.hosts ACL. doAs user group membership or identity is checked with either hadoop.proxyuser.yarn.groups or hadoop.proxyuser.yarn.users. This governs the caller is coming from authorized host and belong to authorized group.

        Attachments

        1. HADOOP-16095.004.patch
          39 kB
          Eric Yang

          Issue Links

            Activity

              People

              • Assignee:
                eyang Eric Yang
                Reporter:
                eyang Eric Yang
              • Votes:
                0 Vote for this issue
                Watchers:
                20 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: