[
https://issues.apache.org/jira/browse/ATLAS-5430?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Nixon Rodrigues updated ATLAS-5430:
-----------------------------------
Description:
Add SPIFFE-based service-to-service authentication to Atlas header
pre-authentication, aligned with Apache Ranger (RANGER-5700), so workloads can
authenticate using HTTP headers such as {{x-awc-source-workload-id}} when a
trusted proxy or service mesh forwards workload identity.
Atlas supports header-based pre-authentication via {{AtlasHeaderPreAuthFilter}}
(username and optional roles headers). It did not previously accept SPIFFE
workload headers for service identity when no human username is present.
h2. Problem
Service-to-service calls to Atlas cannot use the same SPIFFE header pattern as
Ranger and the platform gateway, forcing reliance on basic auth or other
mechanisms that do not match mesh/gateway identity propagation.
h2. Proposed solution
# Add {{SpiffeIdUtil}} to validate SPIFFE IDs in the form
{{spiffe://<trust-domain>/ns/<namespace>/sa/<service-account>}}
and extract the service-account segment as the principal.
# Extend {{AtlasHeaderPreAuthFilter}} to resolve the principal from:
*
** Username header (if configured and present) — takes precedence, or
** Configured SPIFFE header(s) (comma-separated) — first header with a
well-formed SPIFFE ID wins.
# Add configuration property {{atlas.authentication.method.header.spiffe}} and
document it in {{{}atlas-application.properties{}}}.
# Reuse existing trusted-proxy auth type ({{{}AUTH_TYPE_TRUSTED_PROXY{}}}) and
optional {{atlas.authentication.method.header.roles}} for authorization (e.g.
{{{}ROLE_ADMIN{}}}).
h2. Configuration example
{code:java}
atlas.authentication.method.header.enabled=true
atlas.authentication.method.header.spiffe=workload-id
atlas.authentication.method.header.roles=roles
atlas.authentication.method.header.username=username
{code}
Example request:
{{GET /api/atlas/v2/types/typedefs/headers HTTP/1.1
workload-id: spiffe://my-cluster/ns/service-namespace/sa/my-service-sa
roles: ROLE_ADMIN}}
was:
Add SPIFFE-based service-to-service authentication to Atlas header
pre-authentication, aligned with Apache Ranger (RANGER-5700), so workloads can
authenticate using HTTP headers such as {{x-awc-source-workload-id}} when a
trusted proxy or service mesh forwards workload identity.
Atlas supports header-based pre-authentication via {{AtlasHeaderPreAuthFilter}}
(username and optional roles headers). It did not previously accept SPIFFE
workload headers for service identity when no human username is present.
h2. Problem
Service-to-service calls to Atlas cannot use the same SPIFFE header pattern as
Ranger and the platform gateway, forcing reliance on basic auth or other
mechanisms that do not match mesh/gateway identity propagation.
h2. Proposed solution
# Add {{SpiffeIdUtil}} to validate SPIFFE IDs in the form
{{spiffe://<trust-domain>/ns/<namespace>/sa/<service-account>}}
and extract the service-account segment as the principal.
# Extend {{AtlasHeaderPreAuthFilter}} to resolve the principal from:
*
** Username header (if configured and present) — takes precedence, or
** Configured SPIFFE header(s) (comma-separated) — first header with a
well-formed SPIFFE ID wins.
# Add configuration property {{atlas.authentication.method.header.spiffe}} and
document it in {{{}atlas-application.properties{}}}.
# Reuse existing trusted-proxy auth type ({{{}AUTH_TYPE_TRUSTED_PROXY{}}}) and
optional {{atlas.authentication.method.header.roles}} for authorization (e.g.
{{{}ROLE_ADMIN{}}}).
h2. Configuration example
{code:java}
atlas.authentication.method.header.enabled=true
atlas.authentication.method.header.spiffe=x-awc-source-workload-id
atlas.authentication.method.header.roles=x-awc-roles
atlas.authentication.method.header.username=x-awc-username
{code}
Example request:
{{GET /api/atlas/v2/types/typedefs/headers HTTP/1.1
x-awc-source-workload-id:
spiffe://my-cluster/ns/service-namespace/sa/my-service-sa
x-awc-roles: ROLE_ADMIN}}
> Add SPIFFE-based service-to-service authentication to Atlas header
> pre-authentication
> -------------------------------------------------------------------------------------
>
> Key: ATLAS-5430
> URL: https://issues.apache.org/jira/browse/ATLAS-5430
> Project: Atlas
> Issue Type: Bug
> Components: atlas-webui
> Reporter: Nixon Rodrigues
> Assignee: Nixon Rodrigues
> Priority: Major
>
> Add SPIFFE-based service-to-service authentication to Atlas header
> pre-authentication, aligned with Apache Ranger (RANGER-5700), so workloads
> can authenticate using HTTP headers such as {{x-awc-source-workload-id}} when
> a trusted proxy or service mesh forwards workload identity.
> Atlas supports header-based pre-authentication via
> {{AtlasHeaderPreAuthFilter}} (username and optional roles headers). It did
> not previously accept SPIFFE workload headers for service identity when no
> human username is present.
> h2. Problem
> Service-to-service calls to Atlas cannot use the same SPIFFE header pattern
> as Ranger and the platform gateway, forcing reliance on basic auth or other
> mechanisms that do not match mesh/gateway identity propagation.
> h2. Proposed solution
> # Add {{SpiffeIdUtil}} to validate SPIFFE IDs in the form
> {{spiffe://<trust-domain>/ns/<namespace>/sa/<service-account>}}
> and extract the service-account segment as the principal.
> # Extend {{AtlasHeaderPreAuthFilter}} to resolve the principal from:
> *
> ** Username header (if configured and present) — takes precedence, or
> ** Configured SPIFFE header(s) (comma-separated) — first header with a
> well-formed SPIFFE ID wins.
> # Add configuration property {{atlas.authentication.method.header.spiffe}}
> and document it in {{{}atlas-application.properties{}}}.
> # Reuse existing trusted-proxy auth type ({{{}AUTH_TYPE_TRUSTED_PROXY{}}})
> and optional {{atlas.authentication.method.header.roles}} for authorization
> (e.g. {{{}ROLE_ADMIN{}}}).
> h2. Configuration example
> {code:java}
> atlas.authentication.method.header.enabled=true
> atlas.authentication.method.header.spiffe=workload-id
> atlas.authentication.method.header.roles=roles
> atlas.authentication.method.header.username=username
> {code}
> Example request:
> {{GET /api/atlas/v2/types/typedefs/headers HTTP/1.1
> workload-id: spiffe://my-cluster/ns/service-namespace/sa/my-service-sa
> roles: ROLE_ADMIN}}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
