Nixon Rodrigues created ATLAS-5430:
--------------------------------------
Summary: Add SPIFFE-based service-to-service authentication to
Atlas header pre-authentication
Key: ATLAS-5430
URL: https://issues.apache.org/jira/browse/ATLAS-5430
Project: Atlas
Issue Type: Bug
Components: atlas-webui
Reporter: Nixon Rodrigues
Add SPIFFE-based service-to-service authentication to Atlas header
pre-authentication, aligned with Apache Ranger (RANGER-5700), so workloads can
authenticate using HTTP headers such as {{x-awc-source-workload-id}} when a
trusted proxy or service mesh forwards workload identity.
Atlas supports header-based pre-authentication via {{AtlasHeaderPreAuthFilter}}
(username and optional roles headers). It did not previously accept SPIFFE
workload headers for service identity when no human username is present.
h2. Problem
Service-to-service calls to Atlas cannot use the same SPIFFE header pattern as
Ranger and the platform gateway, forcing reliance on basic auth or other
mechanisms that do not match mesh/gateway identity propagation.
h2. Proposed solution
# Add {{SpiffeIdUtil}} to validate SPIFFE IDs in the form
{{spiffe://<trust-domain>/ns/<namespace>/sa/<service-account>}}
and extract the service-account segment as the principal.
# Extend {{AtlasHeaderPreAuthFilter}} to resolve the principal from:
** Username header (if configured and present) — takes precedence, or
** Configured SPIFFE header(s) (comma-separated) — first header with a
well-formed SPIFFE ID wins.
# Add configuration property {{atlas.authentication.method.header.spiffe}} and
document it in {{{}atlas-application.properties{}}}.
# Reuse existing trusted-proxy auth type ({{{}AUTH_TYPE_TRUSTED_PROXY{}}}) and
optional {{atlas.authentication.method.header.roles}} for authorization (e.g.
{{{}ROLE_ADMIN{}}}).
h2. Configuration example
{{atlas.authentication.method.header.enabled=true
atlas.authentication.method.header.spiffe=x-awc-source-workload-id
atlas.authentication.method.header.roles=x-awc-roles
# Optional user identity (wins over SPIFFE when present):
#atlas.authentication.method.header.username=x-awc-username}}
Example request:
{{GET /api/atlas/v2/types/typedefs/headers HTTP/1.1
x-awc-source-workload-id:
spiffe://my-cluster/ns/service-namespace/sa/my-service-sa
x-awc-roles: ROLE_ADMIN}}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
