[
https://issues.apache.org/jira/browse/HADOOP-9535?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13648122#comment-13648122
]
Larry McCay commented on HADOOP-9535:
-------------------------------------
Hi Daryn - This subtask is primarily about being able to compose and expose
token endpoints for authentication or federation of users' credentials or
tokens from IDPs. The resulting hadoop common token could then be used as an
AuthenticationToken in the hadoop.auth cookie. If that were to be the case then
- yes - it would eliminate the need for a shared secret there. The BASIC->LDAP
Authentication Provider is just an example of one such endpoint. I hope that
answers your question.
> HSSO Server - IDP/SP Authentication Endpoint Deployment
> -------------------------------------------------------
>
> Key: HADOOP-9535
> URL: https://issues.apache.org/jira/browse/HADOOP-9535
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: security
> Reporter: Larry McCay
> Original Estimate: 504h
> Remaining Estimate: 504h
>
> This effort will result in an embedded Jetty based server that deploys
> endpoints for the authentication or federation of entities.
> It will leverage common facilities for authentication and federation
> providers within servlet filters which allow composability of various
> provider types to satisfy various token and authentication processing
> requirements.
> For instance:
> In order for a client application to authenticate using BASIC credentials and
> receive a token that will allow access to HDFS we may need to provide a
> couple an endpoint comprised of an authentication provider and a token
> generation provider:
> 1. BASIC->LDAP Authentication Provider
> 2. Access Token Generation Provider
> This allows a user to authenticate to the HSSO service endpoint with simple
> username/password using HTTP BASIC and leverage a simple username bind to an
> LDAP server for authentication. It then uses the resulting normalized
> java.security.Subject to generate an access token for the user to pass along
> with subsequent requests to other Hadoop services.
> Hadoop services only need to verify the token validity and trust of the
> issuer - HSSO service - in order to authenticate access to its protected
> resources.
> This task is dependent on common authentication provider frameworks and will
> need to insure compatibility and the composability described in this task.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
