[HBASE-9866] Support the mode where REST server authorizes proxy users

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.98.0, 0.99.0
• Component/s: REST

Release Note

hbase.rest.support.proxyuser when set to true would enable enable proxy-user support in the REST server. Like any other server, e.g., NameNode, which supports proxy user mode, appropriate proxy-user configuration needs to be set as well in the REST server (hadoop.proxyuser.$user.hosts, hadoop.proxyuser.$user.groups). Requests can then be made to the REST server with a 'doAs' in the query string url and if proxy user authorization check passes, the query will be executed as the 'doAs' user.

• Assignee: Devaraj Das
• Reporter: Devaraj Das
• Created: 31/Oct/13 00:15
• Updated: 21/Feb/15 23:33
• Resolved: 19/Dec/13 18:17

Description

In one use case, someone was trying to authorize with the REST server as a proxy user. That mode is not supported today.
The curl request would be something like (assuming SPNEGO auth) -

curl -i --negotiate -u : http://<HOST>:<PORT>/version/cluster?doas=<USER>