[
https://issues.apache.org/jira/browse/IMPALA-10437?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18115722#comment-18115722
]
ASF subversion and git services commented on IMPALA-10437:
----------------------------------------------------------
Commit e901d6f2c44a4a0e7ea4525466cd2a9c8ab10615 in impala's branch
refs/heads/master from Mihaly Szjatinya
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=e901d6f2c ]
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- tests/custom_cluster/test_webserver_auth_combined.py for LDAP+SAML2
and SPNEGO+SAML2 intelligent fallthrough (skips auth attempt when no
Authorization header present)
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Reviewed-on: http://gerrit.cloudera.org:8080/23237
Reviewed-by: Csaba Ringhofer <[email protected]>
Tested-by: Impala Public Jenkins <[email protected]>
> Support SAML 2 browser profile authentication
> ---------------------------------------------
>
> Key: IMPALA-10437
> URL: https://issues.apache.org/jira/browse/IMPALA-10437
> Project: IMPALA
> Issue Type: New Feature
> Components: Backend, Frontend
> Reporter: Csaba Ringhofer
> Assignee: Csaba Ringhofer
> Priority: Major
> Fix For: Impala 4.0.0
>
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
