This is an automated email from the ASF dual-hosted git repository. zhangyifan pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/kudu.git
commit f94ff25d42822cd82be859bdfc585f873536660e Author: Alexey Serbin <[email protected]> AuthorDate: Fri Dec 17 22:28:15 2021 -0800 [docs] add a note on Token Authentication Added a note about the token authentication in KRPC, clarifying on the information needed on the client side for token-based authentication with the server. Change-Id: If3fdf3c9fb1b881e0ae3f02bb1de1ca6eefc3df0 Reviewed-on: http://gerrit.cloudera.org:8080/18107 Tested-by: Kudu Jenkins Reviewed-by: Andrew Wong <[email protected]> --- docs/design-docs/rpc.md | 33 +++++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-) diff --git a/docs/design-docs/rpc.md b/docs/design-docs/rpc.md index 988b065..a95f2ef 100644 --- a/docs/design-docs/rpc.md +++ b/docs/design-docs/rpc.md @@ -608,17 +608,30 @@ The client sends its authentication token to the server in a `TOKEN_EXCHANGE` response step negotiation message, and the server responds with an empty `TOKEN_EXCHANGE` message on success. +An important detail here is that the client sends the token to the server only +after verifying the server's authenticity. So in addition to the authentication +token, the client also needs to be provided with the certificate of the trusted +CA to be able to verify the server's certificate as a part of the TLS handshake. +Also, before sending its authentication token to the server, the client makes +sure the connection to the server is confidential (i.e. encrypted) in accordance +with the policy defined by the `--rpc_encrypt_loopback_connections` flag. + ``` -Client Server - | | - | +----NegotiatePB---------------------+ | - | | step = TOKEN_EXCHANGE | | - | | authn_token = <client token> | ------------------------------> | - | +------------------------------------+ | - | | - | +----NegotiatePB--------+ | - | <------------------------------------------- | step = TOKEN_EXCHANGE | | - | +-----------------------+ | + Client Server +with a trusted CA's with a TLS certificate + certificate signed by the CA + trusted by the client + | | + | < ........ successfully negotiated TLS connection ........ > | + | | + | +----NegotiatePB---------------+ | + | | step = TOKEN_EXCHANGE | | + | | authn_token = <client token> | --------------------------> | + | +------------------------------+ | + | | + | +----NegotiatePB--------+ | + | <--------------------------------- | step = TOKEN_EXCHANGE | | + | +-----------------------+ | ``` ## Connection Context
