[
https://issues.apache.org/jira/browse/HBASE-24252?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Josh Elser updated HBASE-24252:
-------------------------------
Release Note:
This feature enables the HBase Web UI's to accept a 'proxyuser' via the HTTP
Request's query string. When the parameter
`hbase.security.authentication.spnego.kerberos.proxyuser.enable` is set to
`true` in hbase-site.xml (default is `false`), the HBase UI will attempt to
impersonate the user specified by the query parameter "doAs". This query
parameter is checked case-insensitively. When this option is not provided, the
user who executed the request is the "real" user and there is no ability to
execute impersonation against the WebUI.
For example, if the user "bob" with Kerberos credentials executes a request
against the WebUI with this feature enabled and a query string which includes
`doAs=alice`, the HBase UI will treat this request as executed as `alice`, not
`bob`.
The standard Hadoop proxyuser configuration properties to limit users who may
impersonate others apply to this change (e.g. to enable `bob` to impersonate
`alice`). See the Hadoop documentation for more information on how to configure
these proxyuser rules.
> Implement proxyuser/doAs mechanism for hbase-http
> -------------------------------------------------
>
> Key: HBASE-24252
> URL: https://issues.apache.org/jira/browse/HBASE-24252
> Project: HBase
> Issue Type: Improvement
> Reporter: Istvan Toth
> Assignee: Istvan Toth
> Priority: Major
>
> The REST and Thrift interfaces for HBase already implement the standard
> hadoop ProxyUser mechanism for SPNEGO, but it is not implemented in
> hbase-httpserver.
> Implement it.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
