[KNOX-2839] Refactor impersonation from KnoxToken service

• Type: Task
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 2.0.0
• Component/s: Server
• Assignee: Sandor Molnar
• Reporter: Sandor Molnar
• Created: 11/Nov/22 08:43
• Updated: 23/Dec/22 10:54
• Resolved: 22/Dec/22 20:00

Description

With KNOX-2714, end-users can create tokens on behalf of other users using Hadoop's impersonation mechanism.

The problem with the current implementation is that the proxyuser authorization happens to be on service level, but it should be executed sooner.

As discussed offline with lmccay and pzampino we agreed on the following:

• impersonation support should be done in Knox's identity assertion layer and not in the services
• the proxuyser authorization in HadoopAuth filter should be left as-is. When someone configures them in two places (HadoopAuth authentication and in identity-assertion), a WARN-level message should indicate that one on the identity-assertion level will be ignored.

Issue Links

• relates to: KNOX-2856 Document changes in KNOX-2839
• links to: GitHub Pull Request #681