Abhishek Kumar created RANGER-5700:
--------------------------------------
Summary: Support SPIFFE-based authn via HTTP Headers
Key: RANGER-5700
URL: https://issues.apache.org/jira/browse/RANGER-5700
Project: Ranger
Issue Type: Improvement
Components: pdp, Ranger
Reporter: Abhishek Kumar
Assignee: Abhishek Kumar
Header based authentication was added in RANGER-5499.
Extend it to add support for SPIFFE-based authentication using HTTP headers,
enabling service-to-service authentication for workload service accounts in
Kubernetes-based trusted environments.
SPIFFE: [https://spiffe.io/docs/latest/spiffe-about/overview/]
In Kubernetes deployments with a service mesh (e.g., Istio), the sidecar proxy
establishes and verifies workload identity via mutual TLS and represents it as
a SPIFFE ID
({{{}spiffe://<trust-domain>/ns/<namespace>/sa/<service-account>{}}}). Because
the mesh has already attested and verified this identity, the receiving service
only needs to read and trust the SPIFFE ID forwarded to it as an HTTP header.
The Jira tracks support in following servers: ranger-admin, ranger-pdp
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
