4b74129372
### _Why are the changes needed?_ to close #3839 . The session signing feature is introduced with asymmetric encryption to prevent manipulation of session user identity or other key session elements, which could cause privilege leaking in scripts. 1. Server: Server creates and holds the singleton `keypair` for session signing if feature enabled 2. Server -> Engine: Server passes the `public key` to Engine when launching 3. Server -> Engine: Server generates session signing on `session user` when opening Kyuubi Session to Engine 4. Session -> Statement: Kyuubi session create Statement with context bringing `publickey` and `session user signature` 5. Engine: Engine verify `session user signature` with signature wherever necessary, e.g. in Authz for session name authentication. ECDSA, with a shorter key length and better performance than RSA, is the supported asymmetric encryption in the initial implementation, which is widely supported on JDK7+ in HotSpot or OpenJDK. The session signature is generated with `SHA256withECDSA`. ### _How was this patch tested?_ - [x] Add some test cases that check the changes thoroughly including negative and positive cases if possible - [x] Add screenshots for manual tests if appropriate - [x] [Run test](https://kyuubi.apache.org/docs/latest/develop_tools/testing.html#running-tests) locally before make a pull request Closes #3838 from bowenliang123/check-sessionuser. Closes #3839 925eee47 [liangbowen] Revert "generalize setSparkLocalProperty" d726d661 [liangbowen] generalize setSparkLocalProperty 470176db [liangbowen] allow setSparkLocalProperty to set value null 8f2a6e38 [liangbowen] nit cb5891c9 [liangbowen] nit edbe3c9c [liangbowen] only set to opensession conf when true, since kyuubi.session.user.sign.enabled is default to false 60546c82 [liangbowen] remove setting setSessionSigningPublicKey in KyuubiSessionManager 9a2a60dd [liangbowen] fix asserts 2e2a51b4 [liangbowen] nit f37f4dd6 [Bowen Liang] Merge branch 'master' into check-sessionuser 9cd22003 [liangbowen] generalize illegalAccessWithUnverifiedUser in AuthZUtils c1f27afa [liangbowen] generalize setSessionUserSign and clearSessionUserSign in SparkOperation 3683150f [liangbowen] update error message with `Invalid user identifier` e143ea77 [liangbowen] fast fail for getting missing session configs 866fc821 [liangbowen] rename param name of base64 encoded pubkey with `Base64` suffix 280a95ef [liangbowen] refactor config key name to new class `ReservedKeys` in Authz 8592070e [liangbowen] nit bf227e35 [liangbowen] remove redundant ut case 9ed14feb [liangbowen] remove redundant ut case 33a723d0 [liangbowen] add AuthzSessionSigningSuite with session user sign enabled b77d53e3 [liangbowen] remove config setting in ut 2d56bd30 [liangbowen] remove config setting in ut a25c1c0b [liangbowen] fail w/ AccessControlException, when kyuubi.session.user.sign.enabled is true and kyuubi.session.user is absent c8a88fe9 [liangbowen] check not null of userPubKeyStr, userSign c8bc590a [liangbowen] rename param to publicKeyBase64 b55beb60 [liangbowen] revert to use EC secp256k1 for compatibility 8acfd41d [liangbowen] nit 842b3698 [liangbowen] nit 983585bc [liangbowen] nit d1003cd7 [liangbowen] nit f9d6cfb6 [liangbowen] make generateKeyPair return (PrivateKey, PublicKey) 52eaaddc [liangbowen] add ut for SignUtils b4a44687 [liangbowen] general keypair algorithm 7d40da49 [liangbowen] change to use secp192r1 curve for EC key pair for better performance 1ceed876 [liangbowen] sync settings.md with `false` default value 07d23602 [liangbowen] update ut eec9d44a [liangbowen] move to _confIgnoreList b7969446 [liangbowen] create SessionSigningSuite and add ut for 1. verifying user sign , 2. conf kyuubi.session.user.sign.enabled restriction a50c71a3 [liangbowen] set kyuubi.session.user.sign.enabled to openEngineSessionConf a2f1ed67 [liangbowen] set kyuubi.session.user.sign.enabled to _confRestrictList 5a12182e [liangbowen] make kyuubi.session.user.sign.enabled default to false, and removed from serverOnlyConfEntries 991a4569 [liangbowen] put SESSION_USER_SIGN_ENABLED in serverOnlyConfEntries 3e863af4 [liangbowen] nit b232e5c0 [liangbowen] npe 13a046be [liangbowen] nit 2d2a6659 [liangbowen] nit a0d4721d [liangbowen] move session signing keypair generation to KyuubiSessionImpl on server side. and rename config to KYUUBI_SESSION_SIGN_PUBLICKEY ab430c39 [liangbowen] make generateKeyPair return Key pair and accept algorithm param 42ee2fe0 [liangbowen] nit ce5f4af7 [liangbowen] refactoring session pubkey generation on server side (instead of engine side), and passing it to engine via OpenSession op c2b9d897 [liangbowen] nit: rename to verifySignWithECDSA d0b2cddb [liangbowen] nit 33a044d0 [liangbowen] add ut 2dc1f57b [liangbowen] change to use spark conf `kyuubi.session.user.sign.enabled` to decide whether verify kyuubi seesion user b11ba5a5 [liangbowen] clear local prop `kyuubi.session.user.public.key` and `kyuubi.session.user.sign` after execution 2c8b4bf6 [liangbowen] move throwing AccessControlException inside verifyKyuubiSessionUser method 82f5c265 [liangbowen] update conf doc 7cf0d481 [liangbowen] rename config name to `kyuubi.session.user.sign.enabled` cc2c3570 [liangbowen] typo: fix KYUUBI_SESSION_USER_PUBIC_KEY bdec509d [liangbowen] update settings.md for config doc 2d00163a [liangbowen] nit 102561a8 [liangbowen] update af99ea84 [liangbowen] move algorithmSpec to ecKeyPairGenerator 966a327e [liangbowen] update 41064712 [liangbowen] update 9d276799 [liangbowen] add config `kyuubi.session.user.verify.enabled` to control Whether to verify the integrity of session user name in Spark Authz 8a8840f6 [liangbowen] nit bafd85e9 [liangbowen] replace RSA with ECDSA 2f0c87a5 [liangbowen] KeyPairGenerator init with new SecureRandom instance 7cb31204 [liangbowen] shorten the key size to 1024 5011cf49 [liangbowen] remove unused imports 045fd822 [liangbowen] add to SparkOperation for scala ce6d394d [liangbowen] move generateRSAKeyPair and signWithRSA to SignUtils.scala 5f295792 [liangbowen] update 1d7f3191 [liangbowen] initial support for signing and verifying `kyuubi.session.user` Lead-authored-by: liangbowen <liangbowen@gf.com.cn> Co-authored-by: Bowen Liang <liangbowen@gf.com.cn> Signed-off-by: Cheng Pan <chengpan@apache.org> |
||
|---|---|---|
| .. | ||
| server/kyuubi-server-plugin | ||
| spark | ||
| README.md | ||
For developers
This folder contains plugins/extension for kyuubi server and different engine types.
- ext
- kyuubi-server
- spark
- flink
- trino
- hive
- others
- ...