[
https://issues.apache.org/jira/browse/ATLAS-5430?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Nixon Rodrigues updated ATLAS-5430:
-----------------------------------
Fix Version/s: 3.0.0
> Add SPIFFE-based service-to-service authentication to Atlas header
> pre-authentication
> -------------------------------------------------------------------------------------
>
> Key: ATLAS-5430
> URL: https://issues.apache.org/jira/browse/ATLAS-5430
> Project: Atlas
> Issue Type: Bug
> Components: atlas-webui
> Reporter: Nixon Rodrigues
> Assignee: Nixon Rodrigues
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> Add SPIFFE-based service-to-service authentication to Atlas header
> pre-authentication, aligned with Apache Ranger (RANGER-5700), so workloads
> can authenticate using HTTP headers such as {{x-awc-source-workload-id}} when
> a trusted proxy or service mesh forwards workload identity.
> Atlas supports header-based pre-authentication via
> {{AtlasHeaderPreAuthFilter}} (username and optional roles headers). It did
> not previously accept SPIFFE workload headers for service identity when no
> human username is present.
> h2. Problem
> Service-to-service calls to Atlas cannot use the same SPIFFE header pattern
> as Ranger and the platform gateway, forcing reliance on basic auth or other
> mechanisms that do not match mesh/gateway identity propagation.
> h2. Proposed solution
> # Add {{SpiffeIdUtil}} to validate SPIFFE IDs in the form
> {{spiffe://<trust-domain>/ns/<namespace>/sa/<service-account>}}
> and extract the service-account segment as the principal.
> # Extend {{AtlasHeaderPreAuthFilter}} to resolve the principal from:
> *
> ** Username header (if configured and present) — takes precedence, or
> ** Configured SPIFFE header(s) (comma-separated) — first header with a
> well-formed SPIFFE ID wins.
> # Add configuration property {{atlas.authentication.method.header.spiffe}}
> and document it in {{{}atlas-application.properties{}}}.
> # Reuse existing trusted-proxy auth type ({{{}AUTH_TYPE_TRUSTED_PROXY{}}})
> and optional {{atlas.authentication.method.header.roles}} for authorization
> (e.g. {{{}ROLE_ADMIN{}}}).
> h2. Configuration example
> {code:java}
> atlas.authentication.method.header.enabled=true
> atlas.authentication.method.header.spiffe=workload-id
> atlas.authentication.method.header.roles=roles
> atlas.authentication.method.header.username=username
> {code}
> Example request:
> {{GET /api/atlas/v2/types/typedefs/headers HTTP/1.1
> workload-id: spiffe://my-cluster/ns/service-namespace/sa/my-service-sa
> roles: ROLE_ADMIN}}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
