Hello Zoltan Chovan, Alexey Serbin,
I'd like you to do a code review. Please visit
http://gerrit.cloudera.org:8080/24830
to review the following change.
Change subject: [java] Add proxy user client support
......................................................................
[java] Add proxy user client support
Expose AsyncKuduClientBuilder.effectiveUser() and
KuduClientBuilder.effectiveUser(). The client still authenticates using
its real Kerberos identity.
SecurityContext carries the effective user and exports and imports it
as part of AuthenticationCredentialsPB, so a proxied identity survives
driver-to-executor credential propagation. The real user is unchanged
and continues to drive SASL PLAIN negotiation.
The Java negotiator sends the effective user as the SASL authorization
identity, populates the (deprecated) connection context user info
consistently, and disables authentication tokens for proxied
connections: tokens are bound to their original user and cannot be used
to impersonate another user.
The credentials round trip is covered by a test in
TestSecurityContextRealUser.
Change-Id: I77897a52cfa01e5b7af97703437cd45d2df9fb52
---
M java/kudu-client/src/main/java/org/apache/kudu/client/AsyncKuduClient.java
M java/kudu-client/src/main/java/org/apache/kudu/client/KuduClient.java
M java/kudu-client/src/main/java/org/apache/kudu/client/Negotiator.java
M java/kudu-client/src/main/java/org/apache/kudu/client/SecurityContext.java
M java/kudu-client/src/test/java/org/apache/kudu/client/TestNegotiator.java
M
java/kudu-client/src/test/java/org/apache/kudu/client/TestSecurityContextRealUser.java
6 files changed, 70 insertions(+), 5 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/30/24830/1
--
To view, visit http://gerrit.cloudera.org:8080/24830
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I77897a52cfa01e5b7af97703437cd45d2df9fb52
Gerrit-Change-Number: 24830
Gerrit-PatchSet: 1
Gerrit-Owner: mintao <[email protected]>
Gerrit-Reviewer: Alexey Serbin <[email protected]>
Gerrit-Reviewer: Zoltan Chovan <[email protected]>
