LuciferYang opened a new pull request, #14539: URL: https://github.com/apache/gravitino/pull/14539
### What changes were proposed in this pull request? Add `design-docs/gravitino-trusted-proxy.md`. It lets an authenticated service act for an end user through `X-Gravitino-Proxy-User`, checked against server-side proxy rules and modeled on Hadoop proxy users: - Rules match the authenticator and the verified identity (full Kerberos principal, OAuth `sub` bound to an issuer, Basic user) and limit the users, groups and client addresses a proxy may act for. - Authorization, ownership and audit use the proxied user; audit and events also record the proxy as `realUser`. - The Java client gets `withProxyUser`, which fails at `build()` when the server does not apply the header. - The Trino connector and the standalone Lance REST server use it, so `forwardUser` works under `basic` and `kerberos` (#13472) and Lance REST owns and audits tables as the caller (#13090). - Catalogs that impersonate pass proxied names to HMS and HDFS without a realm and refuse names that could map to a service or superuser identity. I'd like to hear views on one open point before implementation: whether a rule's `hosts` should match the TCP peer address, as proposed, or the client address that `ClientAddressResolver` derives for `trustedProxies` (#14024). Related work: #8877 (Knox `doAs`, where a configurable allow list was requested) and #10564 (also changes `JwksTokenValidator`). ### Why are the changes needed? Behind Trino or Lance REST, Gravitino sees only the service identity or an unverified user name, so per-user authorization, ownership and audit do not work. Fix: #14537 ### Does this PR introduce _any_ user-facing change? No. Documentation only. ### How was this patch tested? No tests needed; documentation only. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
