[HBASE-4099] Authentication for ThriftServer clients

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Component/s: security
• Assignee: Unassigned
• Reporter: Gary Helmling
• Created: 14/Jul/11 17:56
• Updated: 12/Jun/22 19:04
• Resolved: 31/Aug/12 16:47

Description

The current implementation of HBase client authentication only works with the Java API. Alternate access gateways, like Thrift and REST are left out and will not work.

For the ThriftServer to be able to fully interoperate with the security implementation:

1. the ThriftServer should be able to login from a keytab file with it's own server principal on startup
2. thrift clients should be able to authenticate securely when connecting to the server
3. the ThriftServer should be able to act as a proxy for those clients so that the RPCs it issues will be correctly authorized as the original client identities

There is already some support for step 3 in UserGroupInformation and related classes.

For step #2, we really need to look at what thrift itself supports.

At a bare minimum, we need to implement step #1. If we do this, even without steps 2 & 3, this would at least allow deployments to use a ThriftServer per application user, and have the server login as that user on startup. Thrift clients may not be directly authenticated, but authorization checks for HBase could still be handled correctly this way.

Issue Links

• duplicates: HBASE-5062 Missing logons if security is enabled
• is related to: HBASE-4460 Support running an embedded ThriftServer within a RegionServer
• is related to: HBASE-4475 When running an embedded ThriftServer, use User.runAs() to allow it to run as a separate principal from the embedding region server