[
https://issues.apache.org/jira/browse/HBASE-24252?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17093936#comment-17093936
]
Josh Elser commented on HBASE-24252:
------------------------------------
Thanks Nick!
{quote}After reading the release note, isn't this type of authentication
juggling usually done as an HTTP header. Adding to the query string is
monkeying with the in-band API. How about a custom header, something like
{{X-Hadoop-doAs}} ?
{quote}
In a previous life, yeah, I remember a custom header being used to proxy along
some auth'n information through a load balancer. This change is primarily
targeted to enabling Apache Knox's gateway as I've worked with it today.
The same approach would work if we had header-based "real user" passing. We
could build that prettily easily given what Istvan has done here (should we
have something that can use that header).
> Implement proxyuser/doAs mechanism for hbase-http
> -------------------------------------------------
>
> Key: HBASE-24252
> URL: https://issues.apache.org/jira/browse/HBASE-24252
> Project: HBase
> Issue Type: Improvement
> Components: security, UI
> Reporter: Istvan Toth
> Assignee: Istvan Toth
> Priority: Major
> Fix For: 3.0.0, 2.3.0, 2.4.0, 2.2.5
>
>
> The REST and Thrift interfaces for HBase already implement the standard
> hadoop ProxyUser mechanism for SPNEGO, but it is not implemented in
> hbase-httpserver.
> Implement it.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
