• Type: Sub-task Sub-task
    • Status: Resolved
    • Priority: Major Major
    • Resolution: Duplicate
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: security
    • Labels:


      Like Thrift, the REST gateway is not currently integrated into the authentication used for HBase RPC. Currently this means the REST gateway cannot even be used when HBase security is active.

      For the REST gateway to be able to interoperate with HBase security:

      1. the REST server needs to be able to login from a keytab on startup with its own server principal
      2. REST clients need to be able to authenticate security with the REST server
      3. the REST server needs to be able to act as a trusted proxy for the original client identities, so that the HBase authorization checks can be performed against the original client request

      Like Thrift, implementing step #1 as a bare minimum would at least allow deploying a REST server configured to login as the application user on startup. Even without authenticating REST clients, this would allow the gateway to work when HBase security is active.

      For step #2, we can make use of SPNEGO to provide Kerberos/GSSAPI authentication of clients over HTTP. The Alfredo library from Cloudera would hopefully make this relatively easy to do:

      1. HBASE-4100.patch
        3 kB
        Gary Helmling

        Issue Links


          Gary Helmling made changes -
          Link This issue duplicates HBASE-5062 [ HBASE-5062 ]
          Gary Helmling made changes -
          Status Open [ 1 ] Resolved [ 5 ]
          Assignee stack [ stack ]
          Resolution Duplicate [ 3 ]
          Gary Helmling made changes -
          Field Original Value New Value
          Attachment HBASE-4100.patch [ 12495445 ]
          Gary Helmling created issue -


            • Assignee:
              Gary Helmling
            • Votes:
              0 Vote for this issue
              4 Start watching this issue


              • Created: