[
https://issues.apache.org/jira/browse/THRIFT-6206?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sylwester Lachiewicz updated THRIFT-6206:
-----------------------------------------
Description:
Currently, Apache Thrift provides SASL transport support across major language
libraries including Java (TSaslClientTransport / TSaslServerTransport), C++,
and Python, which are standard for authenticating Thrift services against
Kerberos/GSSAPI (e.g., Apache Hive, Impala, HBase). However, the Go library
(lib/go/thrift) currently lacks SASL transport support, requiring Go consumers
to either maintain custom forks or implement ad-hoc transport wrappers.
Proposed Solution
Implement TSaslClientTransport in lib/go/thrift adhering to Thrift's standard
SASL negotiation framing:
1 Framing & Protocol:
- Status byte headers: START (1), OK (2), BAD (3), ERROR (4), COMPLETE (5),
followed by 4-byte big-endian payload length.
- Message payload negotiation loop handling challenge-response handshakes.
2. Pluggable Mechanism Interface:
- Define a zero-dependency interface (SaslClientMechanism) in lib/go/thrift
for negotiation (Start, Step, IsComplete, Dispose).
3. Pure-Go Built-in Mechanisms & Extensibility:
- Provide a built-in PLAIN mechanism with zero third-party dependencies.
- Allow external providers (such as GSSAPI / Kerberos via pure-Go libraries
like gokrb5) to be plugged in via the interface without adding heavy external
dependencies to Thrift's core go.mod.
was:
Currently, Apache Thrift provides SASL transport support across major language
libraries including Java (TSaslClientTransport / TSaslServerTransport), C++,
and Python, which are standard for authenticating Thrift services against
Kerberos/GSSAPI (e.g., Apache Hive, Impala, HBase). However, the Go library
(lib/go/thrift) currently lacks SASL transport support, requiring Go consumers
to either maintain custom forks or implement ad-hoc transport wrappers.
### Proposed Solution
Implement TSaslClientTransport in lib/go/thrift adhering to Thrift's standard
SASL negotiation framing:
1. Framing & Protocol:
- Status byte headers: START (1), OK (2), BAD (3), ERROR (4), COMPLETE (5),
followed by 4-byte big-endian payload length.
- Message payload negotiation loop handling challenge-response handshakes.
2. Pluggable Mechanism Interface:
- Define a zero-dependency interface (SaslClientMechanism) in lib/go/thrift
for negotiation (Start, Step, IsComplete, Dispose).
3. Pure-Go Built-in Mechanisms & Extensibility:
- Provide a built-in PLAIN mechanism with zero third-party dependencies.
- Allow external providers (such as GSSAPI / Kerberos via pure-Go libraries
like gokrb5) to be plugged in via the interface without adding heavy external
dependencies to Thrift's core go.mod.
> Go: Add SASL / Kerberos Authentication Transport support (TSaslTransport)
> -------------------------------------------------------------------------
>
> Key: THRIFT-6206
> URL: https://issues.apache.org/jira/browse/THRIFT-6206
> Project: Thrift
> Issue Type: New Feature
> Components: Go - Library
> Reporter: Sylwester Lachiewicz
> Priority: Major
>
> Currently, Apache Thrift provides SASL transport support across major
> language libraries including Java (TSaslClientTransport /
> TSaslServerTransport), C++, and Python, which are standard for authenticating
> Thrift services against Kerberos/GSSAPI (e.g., Apache Hive, Impala, HBase).
> However, the Go library (lib/go/thrift) currently lacks SASL transport
> support, requiring Go consumers to either maintain custom forks or implement
> ad-hoc transport wrappers.
> Proposed Solution
> Implement TSaslClientTransport in lib/go/thrift adhering to Thrift's standard
> SASL negotiation framing:
> 1 Framing & Protocol:
> - Status byte headers: START (1), OK (2), BAD (3), ERROR (4), COMPLETE (5),
> followed by 4-byte big-endian payload length.
> - Message payload negotiation loop handling challenge-response handshakes.
>
> 2. Pluggable Mechanism Interface:
> - Define a zero-dependency interface (SaslClientMechanism) in lib/go/thrift
> for negotiation (Start, Step, IsComplete, Dispose).
> 3. Pure-Go Built-in Mechanisms & Extensibility:
> - Provide a built-in PLAIN mechanism with zero third-party dependencies.
> - Allow external providers (such as GSSAPI / Kerberos via pure-Go libraries
> like gokrb5) to be plugged in via the interface without adding heavy external
> dependencies to Thrift's core go.mod.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
