[HBASE-24252] Implement proxyuser/doAs mechanism for hbase-http

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0-alpha-1, 2.3.0, 2.2.5
• Component/s: security, UI
• Hadoop Flags: Reviewed

Release Note

This feature enables the HBase Web UI's to accept a 'proxyuser' via the HTTP Request's query string. When the parameter `hbase.security.authentication.spnego.kerberos.proxyuser.enable` is set to `true` in hbase-site.xml (default is `false`), the HBase UI will attempt to impersonate the user specified by the query parameter "doAs". This query parameter is checked case-insensitively. When this option is not provided, the user who executed the request is the "real" user and there is no ability to execute impersonation against the WebUI.

For example, if the user "bob" with Kerberos credentials executes a request against the WebUI with this feature enabled and a query string which includes `doAs=alice`, the HBase UI will treat this request as executed as `alice`, not `bob`.

The standard Hadoop proxyuser configuration properties to limit users who may impersonate others apply to this change (e.g. to enable `bob` to impersonate `alice`). See the Hadoop documentation for more information on how to configure these proxyuser rules.

• Assignee: Istvan Toth
• Reporter: Istvan Toth
• Created: 24/Apr/20 06:47
• Updated: 14/Jul/20 21:31
• Resolved: 27/Apr/20 19:14

Description

The REST and Thrift interfaces for HBase already implement the standard hadoop ProxyUser mechanism for SPNEGO, but it is not implemented in hbase-httpserver.

Implement it.

Issue Links

• relates to: HBASE-24268 REST and Thrift server do not handle the "doAs" parameter case insensitively
• links to: GitHub PR

Sub-Tasks

• Backport "Implement proxyuser/doAs mechanism for hbase-http" to 2.1.x: Resolved