This is an automated email from the ASF dual-hosted git repository.
nixonrodrigues pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/atlas.git
The following commit(s) were added to refs/heads/master by this push:
new d04a008d7 ATLAS-5431 Support Header based authentication /
SPIFFE-aware header pre-auth for Atlas rest-notification service. (#787)
d04a008d7 is described below
commit d04a008d714506650a01b5af43f3b3a30f177868
Author: Nixon Rodrigues <[email protected]>
AuthorDate: Mon Oct 19 13:04:14 2026 +0530
ATLAS-5431 Support Header based authentication / SPIFFE-aware header
pre-auth for Atlas rest-notification service. (#787)
Reuse AtlasHeaderPreAuthFilter from server-common, wire it into
rest-notification security for header based authentication and SPIFFE
verification.
---
.../rest/web/security/AtlasSecurityConfig.java | 18 +++++++++++++-----
.../common}/filters/AtlasAuthenticationToken.java | 2 +-
.../common}/filters/AtlasHeaderPreAuthFilter.java | 10 +++++-----
.../server/common/security/AtlasSecurityConfig.java | 8 ++++++--
.../apache/atlas/web/security/AtlasSecurityConfig.java | 2 +-
.../web/filters/AtlasHeaderPreAuthFilterTest.java | 2 ++
.../atlas/web/security/AtlasSecurityConfigTest.java | 2 +-
7 files changed, 29 insertions(+), 15 deletions(-)
diff --git
a/rest-notification-webapp/src/main/java/org/apache/atlas/notification/rest/web/security/AtlasSecurityConfig.java
b/rest-notification-webapp/src/main/java/org/apache/atlas/notification/rest/web/security/AtlasSecurityConfig.java
index 566699567..9319e183e 100644
---
a/rest-notification-webapp/src/main/java/org/apache/atlas/notification/rest/web/security/AtlasSecurityConfig.java
+++
b/rest-notification-webapp/src/main/java/org/apache/atlas/notification/rest/web/security/AtlasSecurityConfig.java
@@ -17,6 +17,10 @@
*/
package org.apache.atlas.notification.rest.web.security;
+import org.apache.atlas.server.common.filters.AtlasAuthenticationFilter;
+import org.apache.atlas.server.common.filters.AtlasCSRFPreventionFilter;
+import org.apache.atlas.server.common.filters.AtlasHeaderPreAuthFilter;
+import org.apache.atlas.server.common.filters.AtlasKnoxSSOAuthenticationFilter;
import
org.apache.atlas.server.common.security.AtlasAuthenticationFailureHandler;
import org.apache.atlas.server.common.security.AtlasAuthenticationProvider;
import
org.apache.atlas.server.common.security.AtlasAuthenticationSuccessHandler;
@@ -52,19 +56,23 @@ import javax.inject.Inject;
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class AtlasSecurityConfig extends
org.apache.atlas.server.common.security.AtlasSecurityConfig {
+ private final AtlasHeaderPreAuthFilter headerPreAuthFilter;
+
@Inject
- public
AtlasSecurityConfig(ObjectProvider<org.apache.atlas.server.common.filters.AtlasKnoxSSOAuthenticationFilter>
ssoAuthenticationFilterProvider,
-
ObjectProvider<org.apache.atlas.server.common.filters.AtlasCSRFPreventionFilter>
csrfPreventionFilterProvider,
-
ObjectProvider<org.apache.atlas.server.common.filters.AtlasAuthenticationFilter>
atlasAuthenticationFilterProvider,
+ public
AtlasSecurityConfig(ObjectProvider<AtlasKnoxSSOAuthenticationFilter>
ssoAuthenticationFilterProvider,
+ ObjectProvider<AtlasCSRFPreventionFilter>
csrfPreventionFilterProvider,
+ ObjectProvider<AtlasAuthenticationFilter>
atlasAuthenticationFilterProvider,
AtlasAuthenticationProvider
authenticationProvider,
AtlasAuthenticationSuccessHandler
successHandler,
AtlasAuthenticationFailureHandler
failureHandler,
org.apache.atlas.server.common.filters.AtlasAuthenticationEntryPoint
atlasAuthenticationEntryPoint,
Configuration configuration,
-
ObjectProvider<org.apache.atlas.server.common.filters.ActiveServerFilter>
activeServerFilterProvider) {
+
ObjectProvider<org.apache.atlas.server.common.filters.ActiveServerFilter>
activeServerFilterProvider,
+ AtlasHeaderPreAuthFilter headerPreAuthFilter) {
super(ssoAuthenticationFilterProvider, csrfPreventionFilterProvider,
atlasAuthenticationFilterProvider,
authenticationProvider, successHandler, failureHandler,
atlasAuthenticationEntryPoint, configuration,
activeServerFilterProvider);
+ this.headerPreAuthFilter = headerPreAuthFilter;
}
@Override
@@ -88,6 +96,6 @@ public class AtlasSecurityConfig extends
org.apache.atlas.server.common.security
protected void configure(HttpSecurity httpSecurity) throws Exception {
configureCommonHttpSecurity(httpSecurity);
addHaAndMigrationGuards(httpSecurity);
- addCommonAuthFilters(httpSecurity);
+ addNotificationRestAuthFilters(httpSecurity, headerPreAuthFilter);
}
}
diff --git
a/webapp/src/main/java/org/apache/atlas/web/filters/AtlasAuthenticationToken.java
b/server-common/src/main/java/org/apache/atlas/server/common/filters/AtlasAuthenticationToken.java
similarity index 97%
rename from
webapp/src/main/java/org/apache/atlas/web/filters/AtlasAuthenticationToken.java
rename to
server-common/src/main/java/org/apache/atlas/server/common/filters/AtlasAuthenticationToken.java
index 15cd70b9a..b4ef90b03 100644
---
a/webapp/src/main/java/org/apache/atlas/web/filters/AtlasAuthenticationToken.java
+++
b/server-common/src/main/java/org/apache/atlas/server/common/filters/AtlasAuthenticationToken.java
@@ -16,7 +16,7 @@
* specific language governing permissions and limitations
* under the License.
*/
-package org.apache.atlas.web.filters;
+package org.apache.atlas.server.common.filters;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
diff --git
a/webapp/src/main/java/org/apache/atlas/web/filters/AtlasHeaderPreAuthFilter.java
b/server-common/src/main/java/org/apache/atlas/server/common/filters/AtlasHeaderPreAuthFilter.java
similarity index 95%
rename from
webapp/src/main/java/org/apache/atlas/web/filters/AtlasHeaderPreAuthFilter.java
rename to
server-common/src/main/java/org/apache/atlas/server/common/filters/AtlasHeaderPreAuthFilter.java
index ebb0d7caa..6dcdaf65b 100644
---
a/webapp/src/main/java/org/apache/atlas/web/filters/AtlasHeaderPreAuthFilter.java
+++
b/server-common/src/main/java/org/apache/atlas/server/common/filters/AtlasHeaderPreAuthFilter.java
@@ -16,11 +16,9 @@
* specific language governing permissions and limitations
* under the License.
*/
-package org.apache.atlas.web.filters;
+package org.apache.atlas.server.common.filters;
import org.apache.atlas.ApplicationProperties;
-import org.apache.atlas.server.common.filters.AtlasResponseRequestWrapper;
-import org.apache.atlas.server.common.filters.HeadersUtil;
import org.apache.atlas.server.common.model.User;
import org.apache.atlas.utils.SpiffeIdUtil;
import org.apache.commons.configuration2.Configuration;
@@ -29,6 +27,7 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import
org.springframework.security.web.authentication.WebAuthenticationDetails;
@@ -137,7 +136,7 @@ public class AtlasHeaderPreAuthFilter implements Filter {
for (String role : rolesHeader.split(",")) {
String trimmed = StringUtils.trimToNull(role);
if (trimmed != null) {
- ret.add(new
org.springframework.security.core.authority.SimpleGrantedAuthority(trimmed));
+ ret.add(new SimpleGrantedAuthority(trimmed));
}
}
@@ -167,7 +166,8 @@ public class AtlasHeaderPreAuthFilter implements Filter {
if (username != null) {
List<GrantedAuthority> grantedAuths =
-
getAuthoritiesFromRolesHeader(httpRequest.getHeader(rolesHeaderName));
+ getAuthoritiesFromRolesHeader(
+ rolesHeaderName != null ?
httpRequest.getHeader(rolesHeaderName) : null);
UserDetails principal = new User(username, "",
grantedAuths);
diff --git
a/server-common/src/main/java/org/apache/atlas/server/common/security/AtlasSecurityConfig.java
b/server-common/src/main/java/org/apache/atlas/server/common/security/AtlasSecurityConfig.java
index 52739fb48..079064cf5 100644
---
a/server-common/src/main/java/org/apache/atlas/server/common/security/AtlasSecurityConfig.java
+++
b/server-common/src/main/java/org/apache/atlas/server/common/security/AtlasSecurityConfig.java
@@ -22,6 +22,7 @@ import
org.apache.atlas.server.common.filters.AtlasAuthenticationEntryPoint;
import org.apache.atlas.server.common.filters.AtlasAuthenticationFilter;
import org.apache.atlas.server.common.filters.AtlasCSRFPreventionFilter;
import
org.apache.atlas.server.common.filters.AtlasDelegatingAuthenticationEntryPoint;
+import org.apache.atlas.server.common.filters.AtlasHeaderPreAuthFilter;
import org.apache.atlas.server.common.filters.AtlasKnoxSSOAuthenticationFilter;
import org.apache.atlas.server.common.filters.HeadersUtil;
import org.apache.atlas.server.common.filters.spi.ActiveInstanceStateProvider;
@@ -178,10 +179,13 @@ public abstract class AtlasSecurityConfig extends
WebSecurityConfigurerAdapter {
}
}
- protected void addCommonAuthFilters(HttpSecurity httpSecurity) throws
Exception {
+ protected void addNotificationRestAuthFilters(HttpSecurity httpSecurity,
+ AtlasHeaderPreAuthFilter
headerPreAuthFilter) throws Exception {
+ httpSecurity.addFilterBefore(headerPreAuthFilter,
BasicAuthenticationFilter.class);
+
AtlasKnoxSSOAuthenticationFilter ssoAuthenticationFilter =
ssoAuthenticationFilterProvider.getIfAvailable();
if (ssoAuthenticationFilter != null) {
- httpSecurity.addFilterBefore(ssoAuthenticationFilter,
BasicAuthenticationFilter.class);
+ httpSecurity.addFilterAfter(ssoAuthenticationFilter,
AtlasHeaderPreAuthFilter.class);
}
AtlasAuthenticationFilter atlasAuthenticationFilter =
atlasAuthenticationFilterProvider.getIfAvailable();
diff --git
a/webapp/src/main/java/org/apache/atlas/web/security/AtlasSecurityConfig.java
b/webapp/src/main/java/org/apache/atlas/web/security/AtlasSecurityConfig.java
index 270323886..639ec4fa8 100644
---
a/webapp/src/main/java/org/apache/atlas/web/security/AtlasSecurityConfig.java
+++
b/webapp/src/main/java/org/apache/atlas/web/security/AtlasSecurityConfig.java
@@ -21,11 +21,11 @@ import
org.apache.atlas.server.common.filters.ActiveServerFilter;
import org.apache.atlas.server.common.filters.AtlasAuthenticationEntryPoint;
import org.apache.atlas.server.common.filters.AtlasAuthenticationFilter;
import org.apache.atlas.server.common.filters.AtlasCSRFPreventionFilter;
+import org.apache.atlas.server.common.filters.AtlasHeaderPreAuthFilter;
import org.apache.atlas.server.common.filters.AtlasKnoxSSOAuthenticationFilter;
import
org.apache.atlas.server.common.security.AtlasAuthenticationFailureHandler;
import org.apache.atlas.server.common.security.AtlasAuthenticationProvider;
import
org.apache.atlas.server.common.security.AtlasAuthenticationSuccessHandler;
-import org.apache.atlas.web.filters.AtlasHeaderPreAuthFilter;
import org.apache.atlas.web.filters.AtlasJwtAuthWrapper;
import org.apache.commons.configuration2.Configuration;
import org.keycloak.adapters.AdapterDeploymentContext;
diff --git
a/webapp/src/test/java/org/apache/atlas/web/filters/AtlasHeaderPreAuthFilterTest.java
b/webapp/src/test/java/org/apache/atlas/web/filters/AtlasHeaderPreAuthFilterTest.java
index bf58e0e97..dde37d1e0 100644
---
a/webapp/src/test/java/org/apache/atlas/web/filters/AtlasHeaderPreAuthFilterTest.java
+++
b/webapp/src/test/java/org/apache/atlas/web/filters/AtlasHeaderPreAuthFilterTest.java
@@ -19,6 +19,8 @@
package org.apache.atlas.web.filters;
import org.apache.atlas.ApplicationProperties;
+import org.apache.atlas.server.common.filters.AtlasAuthenticationToken;
+import org.apache.atlas.server.common.filters.AtlasHeaderPreAuthFilter;
import org.apache.commons.configuration2.Configuration;
import org.mockito.Mock;
import org.mockito.MockedStatic;
diff --git
a/webapp/src/test/java/org/apache/atlas/web/security/AtlasSecurityConfigTest.java
b/webapp/src/test/java/org/apache/atlas/web/security/AtlasSecurityConfigTest.java
index 3fbed332b..91b94b1eb 100644
---
a/webapp/src/test/java/org/apache/atlas/web/security/AtlasSecurityConfigTest.java
+++
b/webapp/src/test/java/org/apache/atlas/web/security/AtlasSecurityConfigTest.java
@@ -24,11 +24,11 @@ import
org.apache.atlas.server.common.filters.AtlasAuthenticationEntryPoint;
import org.apache.atlas.server.common.filters.AtlasAuthenticationFilter;
import org.apache.atlas.server.common.filters.AtlasCSRFPreventionFilter;
import
org.apache.atlas.server.common.filters.AtlasDelegatingAuthenticationEntryPoint;
+import org.apache.atlas.server.common.filters.AtlasHeaderPreAuthFilter;
import org.apache.atlas.server.common.filters.AtlasKnoxSSOAuthenticationFilter;
import
org.apache.atlas.server.common.security.AtlasAuthenticationFailureHandler;
import org.apache.atlas.server.common.security.AtlasAuthenticationProvider;
import
org.apache.atlas.server.common.security.AtlasAuthenticationSuccessHandler;
-import org.apache.atlas.web.filters.AtlasHeaderPreAuthFilter;
import org.apache.atlas.web.filters.AtlasJwtAuthWrapper;
import org.apache.atlas.web.filters.StaleTransactionCleanupFilter;
import org.apache.commons.configuration2.Configuration;
