[
https://issues.apache.org/jira/browse/ATLAS-5385?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ramachandran Krishnan updated ATLAS-5385:
-----------------------------------------
Description:
Rename header authentication properties from {{atlas.authn.header.*}} to
{{atlas.authentication.method.header.*}} in the existing
{{{}AtlasHeaderPreAuthFilter{}}}. No behavior change; same filter logic as
master.
h2. Migration
#
Beforeatlas.authn.header.enabled=trueatlas.authn.header.username=<header-name>atlas.authn.header.roles=<header-name>atlas.authn.header.requestid=<header-name>#
Afteratlas.authentication.header.enabled=trueatlas.authentication.method.header.username=<header-name>atlas.authentication.method.header.roles=<header-name>atlas.authentication.method.header.request-id=<header-name>
was:
h3. Summary
Refactor Apache Atlas header-based authentication to use a generic,
Ranger-aligned configuration model. Replace legacy {{atlas.authn.header.*}}
properties with {{atlas.authentication.header.enabled}} and
{{atlas.authentication.method.header.<logical-key>}} mappings, where the
property value is the HTTP header name to read from the trusted reverse proxy.
h3. Background
Header authentication allows Atlas to trust identity headers injected by a
reverse proxy or gateway (SSO). The existing configuration used vendor-specific
examples and flat property names ({{{}atlas.authn.header.username{}}}, etc.).
This change standardizes the property namespace and makes header names fully
configurable at deploy time without hardcoding proxy-specific names in OSS code.
h3. Changes
Configuration
* {{atlas.authn.header.enabled}} → {{atlas.authentication.header.enabled}}
* {{atlas.authn.header.username}} →
{{atlas.authentication.method.header.username}}
* {{atlas.authn.header.roles}} → {{atlas.authentication.method.header.roles}}
* {{atlas.authn.header.requestid}} →
{{atlas.authentication.method.header.request-id}}
Property semantics
* Logical key (property suffix): {{{}username{}}}, {{{}roles{}}},
{{request-id}}
* Property value: HTTP header name sent by the proxy (e.g.
{{{}X-Forwarded-User{}}}, or any custom name in deployment config)
* Supports aliases: {{{}user{}}}, {{{}groups{}}}, {{{}role{}}},
{{{}requestid{}}}, {{request_id}}
Code
* Add {{AtlasHeaderAuthConfiguration}} to load and resolve header mappings
* Refactor {{AtlasHeaderPreAuthFilter}} to use the new configuration class
* Keep request-ID behavior aligned with master: read configured header only
when header-auth succeeds ({{{}TRUSTED_PROXY{}}}), store on request attribute
{{{}atlas.request.id{}}}, consumed by {{AuditFilter}}
* Remove vendor-specific header names from OSS examples and tests
Documentation
* Add {{HeaderBasedAuthentication.md}} under Security docs with configuration,
flow, migration guide, and examples
Tests
* Update {{AtlasHeaderPreAuthFilterTest}} for new config model
* Add {{AtlasHeaderAuthConfigurationTest}}
h3. Migration
Deployers should update {{{}atlas-application.properties{}}}:
# Before
atlas.authn.header.enabled=true
atlas.authn.header.username=<header-name>
atlas.authn.header.roles=<header-name>
atlas.authn.header.requestid=<header-name>
# After
atlas.authentication.header.enabled=true
atlas.authentication.method.header.username=<header-name>
atlas.authentication.method.header.roles=<header-name>
atlas.authentication.method.header.request-id=<header-name>
Header names in deployment config are unchanged; only property keys change.
h3. Acceptance Criteria
* Header auth login works when {{enabled=true}} and username header mapping is
configured
* Roles header is optional; comma-separated values are parsed into authorities
* Request ID is propagated to audit logs only when header-auth login succeeds
and request-id header is present
* No vendor-specific header names in OSS code, tests, or default property
examples
* Unit tests pass for {{AtlasHeaderAuthConfiguration}} and
{{AtlasHeaderPreAuthFilter}}
* Security documentation added for header-based authentication
h3. Test Plan
# Enable header auth with generic header mappings in
{{atlas-application.properties}}
# Verify API access with curl using configured username/roles/request-id
headers
# Verify unauthenticated request without username header does not get header
auth
# Verify request-id appears in audit/response only for successful header-auth
requests
# Run unit tests: {{{}AtlasHeaderAuthConfigurationTest{}}},
{{AtlasHeaderPreAuthFilterTest}}
> ATLAS: Align header authentication config with
> atlas.authentication.method.header.* property scheme
> ---------------------------------------------------------------------------------------------------
>
> Key: ATLAS-5385
> URL: https://issues.apache.org/jira/browse/ATLAS-5385
> Project: Atlas
> Issue Type: Improvement
> Components: atlas-core
> Reporter: Ramachandran Krishnan
> Priority: Major
> Fix For: 2.6.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Rename header authentication properties from {{atlas.authn.header.*}} to
> {{atlas.authentication.method.header.*}} in the existing
> {{{}AtlasHeaderPreAuthFilter{}}}. No behavior change; same filter logic as
> master.
> h2. Migration
> #
> Beforeatlas.authn.header.enabled=trueatlas.authn.header.username=<header-name>atlas.authn.header.roles=<header-name>atlas.authn.header.requestid=<header-name>#
>
> Afteratlas.authentication.header.enabled=trueatlas.authentication.method.header.username=<header-name>atlas.authentication.method.header.roles=<header-name>atlas.authentication.method.header.request-id=<header-name>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
