Larry McCay commented on HADOOP-11717:

[~brahmareddy] - Thanks - why hasn't HADOOP-14799 beenĀ backported to branch-2 
and branch-2.8?

Seems odd to have to bring it up on a 2 yr old JIRA. :)

Can we reopen or clone HADOOP-14799 to address this?

> Add Redirecting WebSSO behavior with JWT Token in Hadoop Auth
> -------------------------------------------------------------
>                 Key: HADOOP-11717
>                 URL: https://issues.apache.org/jira/browse/HADOOP-11717
>             Project: Hadoop Common
>          Issue Type: Improvement
>          Components: security
>            Reporter: Larry McCay
>            Assignee: Larry McCay
>            Priority: Major
>             Fix For: 2.8.0, 3.0.0-alpha1
>         Attachments: HADOOP-11717-1.patch, HADOOP-11717-2.patch, 
> HADOOP-11717-3.patch, HADOOP-11717-4.patch, HADOOP-11717-5.patch, 
> HADOOP-11717-6.patch, HADOOP-11717-7.patch, HADOOP-11717-8.patch, 
> RedirectingWebSSOwithJWTforHadoopWebUIs.pdf
> Extend AltKerberosAuthenticationHandler to provide WebSSO flow for UIs.
> The actual authentication is done by some external service that the handler 
> will redirect to when there is no hadoop.auth cookie and no JWT token found 
> in the incoming request.
> Using JWT provides a number of benefits:
> * It is not tied to any specific authentication mechanism - so buys us many 
> SSO integrations
> * It is cryptographically verifiable for determining whether it can be trusted
> * Checking for expiration allows for a limited lifetime and window for 
> compromised use
> This will introduce the use of nimbus-jose-jwt library for processing, 
> validating and parsing JWT tokens.

This message was sent by Atlassian JIRA

To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org

Reply via email to