[HADOOP-9392] Token based authentication and Single Sign On

• Type: New Feature
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: security
• Tags: Project Rhino
• Assignee: Yi Liu
• Reporter: Kai Zheng
• Created: 11/Mar/13 11:58
• Updated: 25/Aug/17 17:04

Description

This is an umbrella entry for one of project Rhino’s topic, for details of project Rhino, please refer to https://github.com/intel-hadoop/project-rhino/. The major goal for this entry as described in project Rhino was

“Core, HDFS, ZooKeeper, and HBase currently support Kerberos authentication at the RPC layer, via SASL. However this does not provide valuable attributes such as group membership, classification level, organizational identity, or support for user defined attributes. Hadoop components must interrogate external resources for discovering these attributes and at scale this is problematic. There is also no consistent delegation model. HDFS has a simple delegation capability, and only Oozie can take limited advantage of it. We will implement a common token based authentication framework to decouple internal user and service authentication from external mechanisms used to support it (like Kerberos)”

We’d like to start our work from Hadoop-Common and try to provide common facilities by extending existing authentication framework which support:
1. Pluggable token provider interface
2. Pluggable token verification protocol and interface
3. Security mechanism to distribute secrets in cluster nodes
4. Delegation model of user authentication

Issue Links

• is related to: HADOOP-9479 Ability to plugin custom authentication mechanisms based on Jaas and Sasl
• is related to: HADOOP-8779 Use tokens regardless of authentication type
• is related to: HADOOP-9534 Credential Management Framework (CMF)
• is related to: HADOOP-9296 Authenticating users from different realm without a trust relationship
• is required by: HADOOP-9466 Unified authorization framework
• relates to: HADOOP-9533 Centralized Hadoop SSO/Token Server
• relates to: HADOOP-11766 Generic token authentication support for Hadoop
• relates to: HADOOP-14808 Hadoop keychain
• relates to: HADOOP-9671 Improve Hadoop security - Use cases, Threat Model and Problems
• relates to: HADOOP-9621 Document/analyze current Hadoop security model

Sub-Tasks

• Implementing TokenAuth framework and Simple authentication over TokenAuth: Open
• Token validation and transmission: Open
• Pluggable TokenAuth framework and core facilities: Open
• Pluggable and compatible UGI change: Open
• TokenAuth Implementation - HAS: Open
• TokenAuth Integration: Open
• Token definition and API: Patch Available
• Identity Token Service API: Open