nixonrodrigues opened a new pull request, #787: URL: https://github.com/apache/atlas/pull/787
## Summary Extends **ATLAS-5430** (SPIFFE / trusted-proxy header pre-auth on the main Atlas webapp) to the **rest-notification** service. Shared filter types live in `server-common` so both apps use the same header/SPIFFE behavior. Rest-notification registers the filter chain via **`addNotificationRestAuthFilters`** (header pre-auth → Knox SSO → Atlas authentication → CSRF). ## Changes - Refactor code -> Move **`AtlasHeaderPreAuthFilter`** and **`AtlasAuthenticationToken`** from `webapp` to **`server-common`** (rest-notification can reuse them). - **`AtlasSecurityConfig` (server-common):** add **`addNotificationRestAuthFilters`** for headless REST services. - **`rest-notification-webapp`:** wire header/SPIFFE pre-auth before Basic auth and Knox SSO. - **`webapp`:** update imports and security config/tests for the shared filter location (no change to main webapp filter order intent from ATLAS-5430). Docker/dev-support overlays for rest SPIFFE are **not** included in this PR (operators enable `atlas.authentication.method.header.*` in rest `atlas-application.properties` for local testing). ## Test plan ### Manual — rest-notification (HTTP, port 41000) **Prerequisites:** rest-notification running with Kafka/ZK; header auth enabled, e.g.: ```properties atlas.authentication.method.header.enabled=true atlas.authentication.method.header.spiffe=X-Spiffe-Id,x-awc-source-workload-id atlas.authentication.method.header.roles=X-Forwarded-Groups ``` Set `REST_BASE=http://localhost:41000/rest` (adjust host/port as needed). | # | Test case | Steps | Expected | |---|-----------|--------|----------| | 1 | Unauthenticated POST rejected | `POST .../notification/topic/ATLAS_HOOK` with `Content-Type: application/json`, body `[]`, **no** auth headers | **401** | | 2 | Basic auth hook post | Same URL with `-u admin:<password>`, body `[]` | **204** | | 3 | SPIFFE + admin role hook post | Same URL, no Basic; headers `X-Spiffe-Id: spiffe://my-cluster/ns/atlas/sa/hook-sa`, `X-Forwarded-Groups: ROLE_ADMIN`, body `[]` | **204** | | 4 | Invalid SPIFFE rejected | Same as #3 but `X-Spiffe-Id: not-a-spiffe-id` | **401** | | 5 | SPIFFE without roles (authz) | Valid SPIFFE, **omit** `X-Forwarded-Groups` | **403** (authenticated, not authorized for `SERVICE_NOTIFICATION_POST`) | | 6 | Trusted-proxy username (optional) | `X-Forwarded-User: admin`, `X-Forwarded-Groups: ROLE_ADMIN`, no Basic | **204** (if `header.username` configured) | **Example (test cases 3–4):** ```bash curl -s -o /dev/null -w '%{http_code}\n' -X POST "${REST_BASE}/api/atlas/v2/notification/topic/ATLAS_HOOK" \ -H 'Content-Type: application/json' \ -H 'X-Spiffe-Id: spiffe://my-cluster/ns/atlas/sa/hook-sa' \ -H 'X-Forwarded-Groups: ROLE_ADMIN' \ -d '[]' ``` ### Manual — main Atlas webapp (regression, ATLAS-5430 behavior) | # | Test case | Expected | |---|-----------|----------| | 7 | Header auth still works when enabled in `atlas-application.properties` | Authenticated entity/API calls with `X-Forwarded-User` + groups (not **401**) | | 8 | SPIFFE principal on webapp (if configured) | Valid SPIFFE header resolves to service-account principal; authorized calls succeed per policy | | 9 | Form login / Basic still work when file/LDAP auth enabled | UI login and `-u admin:...` API calls succeed as before | ## Dependencies - Builds on **ATLAS-5430** (#786): `SpiffeIdUtil`, header properties, webapp header filter behavior. ## Related - **JIRA:** ATLAS-5431 - **Depends on / follows:** ATLAS-5430 (SPIFFE header authentication for service-to-service calls) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
