[HBASE-26667] Integrate user-experience for hbase-client

• Type: Sub-task
• Status: Reopened
• Priority: Major
• Resolution: Unresolved
• Fix Version/s: HBASE-26553
• Hadoop Flags: Reviewed
• Assignee: Andor Molnar
• Reporter: Josh Elser
• Created: 13/Jan/22 22:22
• Updated: 31/Aug/22 08:28

Description

Today, we have two mechanism in order to get the tokens needed to authenticate:

1. Kerberos, we rely on a Kerberos ticket being present in a well-known location (defined by JVM properties) or via programmatic invocation of UserGroupInformation
2. Delegation tokens, we rely on special API to be called (our mapreduce API) which loads the token into the current UserGroupInformation "context" (the JAAS PrivilegedAction).

The JWT bearer token approach is very similar to the delegation token mechanism, but HBase does not generate this JWT (as we do with delegation tokens). How does a client provide this token to the hbase-client (i.e. ConnectionFactory.getConnection() or a UserGroupInformation call)? We should be mindful of all of the different "entrypoints" to HBase (hbase ... commands, java -cp commands, Phoenix commands, Spark comands, etc). Our solution should be effective for all of these approaches and not require downstream changes.

Update

The environment variable approach is done, but I have a new idea which will support token renewal as well:

Implement a generic JwtTokenProvider interface with a default file-based provider.

Read the token from a specific file similar to what happens in Kerberos. Token renewal is not part of this ticket.

Issue Links

• is depended upon by: HBASE-26668 Define user experience for JWT renewal
• links to: GitHub Pull Request #4064