1e23e7a93c
### _Why are the changes needed?_ to close #1978 Support both NEGOTIATE and BASIC authentication for restful frontend service. At first, I involve two auth schemes, FYI [hadoop/HttpConstants.java](https://github.com/apache/hadoop/blob/trunk/hadoop-common-project%2Fhadoop-auth%2Fsrc%2Fmain%2Fjava%2Forg%2Fapache%2Fhadoop%2Fsecurity%2Fauthentication%2Fserver%2FHttpConstants.java) - BASIC: mapping to NOSASL, NONE, LDAP, CUSTOM authentication - NEGOTIATE: mapping to KERBEROS authentication BTW, hadoop also supports `Digest` auth scheme. Two authentication handlers: - BasicAuthenticationHandler(reuse existing passwdAuthenticationProvider(LDAP/CUSTOM)) - KerberosAuthenticationHandler(refer [hadoop/KerberosAuthenticationHandler.java](https://github.com/apache/hadoop/blob/trunk/hadoop-common-project%2Fhadoop-auth%2Fsrc%2Fmain%2Fjava%2Forg%2Fapache%2Fhadoop%2Fsecurity%2Fauthentication%2Fserver%2FKerberosAuthenticationHandler.java) and [hadoop/KerberosUtil.java](https://github.com/apache/hadoop/blob/trunk/hadoop-common-project%2Fhadoop-auth%2Fsrc%2Fmain%2Fjava%2Forg%2Fapache%2Fhadoop%2Fsecurity%2Fauthentication%2Futil%2FKerberosUtil.java)) #### AuthenticationFilter - redirect the http request according to the authentication scheme specified in `Authorization` header. For basic authentication The value of Authorization header is `BASIC ${encodeBase64(user + ":" + password)}`. Then using the passwdAuthenticationProvider to authenticate `user` and `password`. For SPNEGO(kerberos) authentication. The value of Authorization header is `NEGOTIATE ${encodeBase64(clientToken)}`. Then checking whether the clientToken is valid. And currently, the AuthenticationFilter take affect for all the requests with pathSpec `/api/*`. ### _How was this patch tested?_ - [x] Add some test cases that check the changes thoroughly including negative and positive cases if possible - [ ] Add screenshots for manual tests if appropriate - [ ] [Run test](https://kyuubi.apache.org/docs/latest/develop_tools/testing.html#running-tests) locally before make a pull request Closes #2049 from turboFei/kyuubi_1978_kerberos. Closes #1978 c8b6362b [Fei Wang] refactor cedec70f [Fei Wang] add spnego unit test c1d45cde [Fei Wang] rename package to http.authentication 3d0b220b [Fei Wang] address comments 296f181e [Fei Wang] fix ut f9371e14 [Fei Wang] spnego and basic auth Authored-by: Fei Wang <fwang12@ebay.com> Signed-off-by: Fei Wang <fwang12@ebay.com> |
||
|---|---|---|
| .. | ||
| spark | ||
| engine_lifecycle.md | ||
| engine_on_kubernetes.md | ||
| engine_on_yarn.md | ||
| engine_share_level.md | ||
| high_availability_guide.md | ||
| hive_metastore.md | ||
| index.rst | ||
| kyuubi_on_kubernetes.md | ||
| settings.md | ||