[PHOENIX-4533] Phoenix Query Server should not use SPNEGO principal to proxy user requests

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 5.0.0-alpha, 4.14.0
• Flags: Patch
• Assignee: Lev Bronshtein
• Reporter: Lev Bronshtein
• Created: 18/Jan/18 03:50
• Updated: 26/Jul/18 01:14
• Resolved: 13/Feb/18 16:49

Description

Currently the HTTP/ principal is used by various components in the HADOOP ecosystem to perform SPNEGO authentication.  Since there can only be one HTTP/ per host, even outside of the Hadoop ecosystem, the keytab containing key material for local HTTP/ principal is shared among a few applications.  With so many applications having access to the HTTP/ credentials, this increases the chances of an attack on the proxy user capabilities of Hadoop.  This JIRA proposes that two different key tabs can be used to

1. Authenticate kerberized web requests
2. Communicate with the phoenix back end