[HBASE-28317] RpcCallContext should expose client's TLS certificate

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 2.6.0, 3.0.0-beta-2
• Release Note: Adds RpcCallContext.getClientCertificateChain() for accessing the SSL cert when TLS is enabled and a cert is available.
• Assignee: Charles Connell
• Reporter: Charles Connell
• Created: 17/Jan/24 16:02
• Updated: 30/Jan/24 20:31
• Resolved: 29/Jan/24 13:45

Description

At my employer we plan on using a coprocessor to log information about some requests to HBase. For this to be useful to us, we need to know who each request is coming from. We use HBase's TLS support with mutual authentication to authenticate clients. I'd like a way to expose the client certificate used on a request to coprocessors. For setups using Kerberos authentication, RpcCall exposes the Kerberos principal shortname via getRequestUser(), so this would be the TLS equivalent to that.

Issue Links

• causes: HBASE-28336 Fix casting bug in NettyRpcServer introduced in HBASE-28317
• links to: GitHub Pull Request #5644