[
https://issues.apache.org/jira/browse/AMBARI-24985?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Robert Levas updated AMBARI-24985:
----------------------------------
Status: Patch Available (was: Open)
> Handle requests from a configured trusted proxy to identify a proxied user
> using Kerberos
> -----------------------------------------------------------------------------------------
>
> Key: AMBARI-24985
> URL: https://issues.apache.org/jira/browse/AMBARI-24985
> Project: Ambari
> Issue Type: Task
> Components: ambari-server
> Affects Versions: 2.8.0
> Reporter: Robert Levas
> Assignee: Robert Levas
> Priority: Major
> Labels: pull-request-available, tproxy
> Fix For: 2.8.0
>
> Time Spent: 2h
> Remaining Estimate: 0h
>
> Handle requests from a configured trusted proxy to identify a proxied user
> using Kerberos.
> Upon receiving a request where that caller is identified using Kerberos,
> check to see of the request was from a (trusted) proxy. If so, validate the
> trusted proxy and set the authenticated user to the proxied user specified in
> the "{{doAs}}" query parameter.
> After receiving a request where the user is to be authenticated using
> Kerberos, perform the following steps:
> # Determine if a proxied user is specified using a "{{doAs}}" query
> parameter.
> # Using the following Ambari configuration property, determine if a proxied
> user can be specified from the requesting host:
> ** {{ambari.tproxy.proxyuser.$username.hosts}}, where $username is the
> username of the authenticated user (not the user specified in the doAs query
> parameter)
> # Obtain the proxied username from the {{doAs}} query parameter
> # Using the following Ambari configuration property, determine if the proxied
> user can be specified based on the user's username:
> ** {{ambari.tproxy.proxyuser.$username.users}}, where $username is the
> username of the authenticated user
> # Using the following Ambari configuration property, determine if the proxied
> user can be specified based on the groups the proxied user belong to:
> ** {{ambari.tproxy.proxyuser.$username.groups}}, where $username is the
> username of the authenticated user t
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
