[ZEPPELIN-1730] impersonate spark interpreter using --proxy-user

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.7.0
• Fix Version/s: 0.7.0
• Component/s: conf, Core, Interpreters, security, zeppelin-server
• Assignee: Khalid Huseynov
• Reporter: Ruslan Dautkhanov
• Created: 29/Nov/16 23:16
• Updated: 12/Jan/17 07:06
• Resolved: 12/Jan/17 07:03

Description

Cloudera's Hue is using proxy authentication quite successfully
in our organization. I.e. Hue does LDAP authentication, and then impersonates to that specific user and all requests are made on behalf of that user (although `hue` is actual OS user that runs Hue service). Other Hadoop services are just configured to trust user `hue` to impersonate to other users.

It might be easier to implement Spark's multitenancy support through spark-submit's --proxy-user parameter.

(this is applicable to kerberized and non-kerberized environments)
See comments in
https://github.com/apache/spark/pull/4405
and https://issues.apache.org/jira/browse/SPARK-5493 (resolved in Spark 1.3)

Issue Links

• is duplicated by: ZEPPELIN-1587 SparkInterpreter impersonation routine is absent
• relates to: ZEPPELIN-1340 Impersonation for interpreter
• relates to: ZEPPELIN-1320 Run zeppelin interpreter process as web front end user
• relates to: ZEPPELIN-1587 SparkInterpreter impersonation routine is absent
• relates to: ZEPPELIN-1701 User impersonation of front end user does not work with SPARK_HOME set.
• relates to: SPARK-14743 Improve delegation token handling in secure clusters
• relates to: SPARK-19143 API in Spark for distributing new delegation tokens (Improve delegation token handling in secure clusters)
• links to: GitHub Pull Request #1840