Uploaded image for project: 'Apache Knox'
  1. Apache Knox
  2. KNOX-2401

Extend ClientCert Authentication Provider for CN as PrimaryPrincipal

    XMLWordPrintableJSON

    Details

    • Type: Improvement
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: 1.5.0
    • Component/s: Server
    • Labels:
      None

      Description

      Currently, the ClientCert authentication provider extracts only the DN from the certificate as the user principal resulting from the authentication event.

      This works fine with the added use of the RegEx identity assertion provider that can transform that principal into an expected username as along as authorization is not required within the gateway at all. Authorization requires group lookup in order to scale the management of authorization policies in Ranger or ACLs for the AuthzAcl provider in Knox.

      This change will add additional configuration to designate a specific attribute to pull from the cert such as CN. This would then allow for the use of the HadoopGroupProvider identity assertion provider to lookup groups for authorization via Knox or Ranger.

        Attachments

          Activity

            People

            • Assignee:
              lmccay Larry McCay
              Reporter:
              lmccay Larry McCay
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated: