nixonrodrigues opened a new pull request, #786: URL: https://github.com/apache/atlas/pull/786
### Summary Adds SPIFFE-based service-to-service authentication to Atlas header pre-authentication, aligned with Apache Ranger ([RANGER-5700](https://github.com/apache/ranger/commit/22fbc813d576b2d386f7baaf51a1895c96b1bece)). Workloads can authenticate using HTTP headers such as x-awc-source-workload-id when a trusted proxy or service mesh forwards workload identity. Introduces SpiffeIdUtil to validate SPIFFE IDs and extract the Kubernetes service-account segment as the principal. Extends AtlasHeaderPreAuthFilter to resolve identity from username headers or configured SPIFFE headers (username takes precedence). Documents the new property atlas.authentication.method.header.spiffe and adds Docker dev config plus a verification script. ### Configuration ``` atlas.authentication.method.header.enabled=true atlas.authentication.method.header.username=x-awc-username atlas.authentication.method.header.roles=x-awc-roles atlas.authentication.method.header.request-id=x-awc-request-id # Service-to-service SPIFFE (comma-separated header names supported) atlas.authentication.method.header.spiffe=x-awc-source-workload-id ``` ### Example request ``` curl -s -o /dev/null -w '%{http_code}\n' \ -H 'x-awc-source-workload-id: spiffe://my-cluster/ns/service-namespace/sa/atlas-spiffe-test' \ -H 'x-awc-roles: ROLE_ADMIN' \ http://127.0.0.1:21000/api/atlas/v2/types/typedefs/headers ``` GET /api/atlas/v2/types/typedefs/headers HTTP/1.1 x-awc-source-workload-id: spiffe://my-cluster/ns/service-namespace/sa/atlas-spiffe-test x-awc-roles: ROLE_ADMIN Principal: my-service-sa. Authorization uses the roles header and existing Atlas authz policy. ### Security note Header authentication must only be enabled when Atlas is reachable only through a trusted proxy/gateway. Direct client access would allow identity spoofing via headers. ### Test plan SpiffeIdUtilTest / AtlasHeaderPreAuthFilterTest Confirm basic auth still works (no regression) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
