Hello Zoltan Chovan, Alexey Serbin,
I'd like you to do a code review. Please visit
http://gerrit.cloudera.org:8080/24825
to review the following change.
Change subject: [security] Add proxy user authorization
......................................................................
[security] Add proxy user authorization
Kudu services cannot act on behalf of another user, which is required by
gateways such as Zeppelin or Kyuubi that serve multiple end users over a
single service account (KUDU-3586).
Add ProxyUserAuthorizer, which authorizes a strongly-authenticated real
user to act as an effective user. Rules are configured via three flags,
modeled after Hadoop's proxyuser settings:
* --proxy_user_acl: the effective users a real user may act as
* --proxy_user_groups: effective users matched via local group membership
* --proxy_user_hosts: the source addresses a real user may proxy from
A request is authorized only when both a matching target rule (ACL or
groups) and a matching host rule apply. An empty configuration disables
proxying entirely, and proxying requires Kerberos authentication: the
authorizer rejects unauthenticated requests, and host rules reject peers
without an IPv4 address rather than letting the check pass.
Change-Id: Id4f2efa2d853c00328cde49c076f6fb5d919471f
---
M src/kudu/security/CMakeLists.txt
A src/kudu/security/proxy_user_authorizer-test.cc
A src/kudu/security/proxy_user_authorizer.cc
A src/kudu/security/proxy_user_authorizer.h
4 files changed, 396 insertions(+), 6 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/25/24825/1
--
To view, visit http://gerrit.cloudera.org:8080/24825
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: Id4f2efa2d853c00328cde49c076f6fb5d919471f
Gerrit-Change-Number: 24825
Gerrit-PatchSet: 1
Gerrit-Owner: mintao <[email protected]>
Gerrit-Reviewer: Alexey Serbin <[email protected]>
Gerrit-Reviewer: Zoltan Chovan <[email protected]>
