[
https://issues.apache.org/jira/browse/ATLAS-5430?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18128397#comment-18128397
]
ASF subversion and git services commented on ATLAS-5430:
--------------------------------------------------------
Commit 238f7e9a8844a1582819bb2b00087ecbf230528f in atlas's branch
refs/heads/master from Nixon Rodrigues
[ https://gitbox.apache.org/repos/asf?p=atlas.git;h=238f7e9a8 ]
ATLAS-5430: Add SPIFFE header authentication for service-to-service calls.
(#786)
* ATLAS-5430: Add SPIFFE header authentication for service-to-service calls.
Align Atlas header pre-auth with Ranger by accepting configured SPIFFE ID
headers (e.g. X-Spiffe-Id) and using the service-account segment
as the trusted-proxy principal when no username header is present.
Co-authored-by: Cursor <[email protected]>
* ATLAS-5430: Load SPIFFE header names with getStringArray for list config.
Comma-separated atlas.authentication.method.header.spiffe values were truncated
when read via getString; use getStringArray and extend tests. Document
properties
and enable header-auth Docker settings for local E2E verification.
Co-authored-by: Cursor <[email protected]>
* ATLAS-5430 - Address review comments in PR #786
---------
Co-authored-by: Cursor <[email protected]>
> Add SPIFFE-based service-to-service authentication to Atlas header
> pre-authentication
> -------------------------------------------------------------------------------------
>
> Key: ATLAS-5430
> URL: https://issues.apache.org/jira/browse/ATLAS-5430
> Project: Atlas
> Issue Type: Bug
> Components: atlas-webui
> Reporter: Nixon Rodrigues
> Assignee: Nixon Rodrigues
> Priority: Major
> Time Spent: 50m
> Remaining Estimate: 0h
>
> Add SPIFFE-based service-to-service authentication to Atlas header
> pre-authentication, aligned with Apache Ranger (RANGER-5700), so workloads
> can authenticate using HTTP headers such as {{x-awc-source-workload-id}} when
> a trusted proxy or service mesh forwards workload identity.
> Atlas supports header-based pre-authentication via
> {{AtlasHeaderPreAuthFilter}} (username and optional roles headers). It did
> not previously accept SPIFFE workload headers for service identity when no
> human username is present.
> h2. Problem
> Service-to-service calls to Atlas cannot use the same SPIFFE header pattern
> as Ranger and the platform gateway, forcing reliance on basic auth or other
> mechanisms that do not match mesh/gateway identity propagation.
> h2. Proposed solution
> # Add {{SpiffeIdUtil}} to validate SPIFFE IDs in the form
> {{spiffe://<trust-domain>/ns/<namespace>/sa/<service-account>}}
> and extract the service-account segment as the principal.
> # Extend {{AtlasHeaderPreAuthFilter}} to resolve the principal from:
> *
> ** Username header (if configured and present) — takes precedence, or
> ** Configured SPIFFE header(s) (comma-separated) — first header with a
> well-formed SPIFFE ID wins.
> # Add configuration property {{atlas.authentication.method.header.spiffe}}
> and document it in {{{}atlas-application.properties{}}}.
> # Reuse existing trusted-proxy auth type ({{{}AUTH_TYPE_TRUSTED_PROXY{}}})
> and optional {{atlas.authentication.method.header.roles}} for authorization
> (e.g. {{{}ROLE_ADMIN{}}}).
> h2. Configuration example
> {code:java}
> atlas.authentication.method.header.enabled=true
> atlas.authentication.method.header.spiffe=workload-id
> atlas.authentication.method.header.roles=roles
> atlas.authentication.method.header.username=username
> {code}
> Example request:
> {{GET /api/atlas/v2/types/typedefs/headers HTTP/1.1
> workload-id: spiffe://my-cluster/ns/service-namespace/sa/my-service-sa
> roles: ROLE_ADMIN}}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
