[jira] [Comment Edited] (HADOOP-11717) Add Redirecting WebSSO behavior with JWT Token in Hadoop Auth
[ https://issues.apache.org/jira/browse/HADOOP-11717?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16362347#comment-16362347 ] Brahma Reddy Battula edited comment on HADOOP-11717 at 2/14/18 6:10 PM: Nice work Guys!! We should upgrade nimbus-jose-jwt, as there [CVE|https://nvd.nist.gov/vuln/detail/CVE-2017-12973#vulnDescriptionTitle] present before 4.39 version. HADOOP-14799 raised to upgrade but it's not committed to branch-2 and branch-2.8 versions. was (Author: brahmareddy): Nice work Guys!! We should upgrade nimbus-jose-jwt, as there [CVE|https://nvd.nist.gov/vuln/detail/CVE-2017-12973#vulnDescriptionTitle] present before 4.39 version. HADOOP-14799 raised to upgrade but it's committed to branch-2 and branch-2.8 versions. > Add Redirecting WebSSO behavior with JWT Token in Hadoop Auth > - > > Key: HADOOP-11717 > URL: https://issues.apache.org/jira/browse/HADOOP-11717 > Project: Hadoop Common > Issue Type: Improvement > Components: security >Reporter: Larry McCay >Assignee: Larry McCay >Priority: Major > Fix For: 2.8.0, 3.0.0-alpha1 > > Attachments: HADOOP-11717-1.patch, HADOOP-11717-2.patch, > HADOOP-11717-3.patch, HADOOP-11717-4.patch, HADOOP-11717-5.patch, > HADOOP-11717-6.patch, HADOOP-11717-7.patch, HADOOP-11717-8.patch, > RedirectingWebSSOwithJWTforHadoopWebUIs.pdf > > > Extend AltKerberosAuthenticationHandler to provide WebSSO flow for UIs. > The actual authentication is done by some external service that the handler > will redirect to when there is no hadoop.auth cookie and no JWT token found > in the incoming request. > Using JWT provides a number of benefits: > * It is not tied to any specific authentication mechanism - so buys us many > SSO integrations > * It is cryptographically verifiable for determining whether it can be trusted > * Checking for expiration allows for a limited lifetime and window for > compromised use > This will introduce the use of nimbus-jose-jwt library for processing, > validating and parsing JWT tokens. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Comment Edited] (HADOOP-11717) Add Redirecting WebSSO behavior with JWT Token in Hadoop Auth
[ https://issues.apache.org/jira/browse/HADOOP-11717?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16362594#comment-16362594 ] Larry McCay edited comment on HADOOP-11717 at 2/13/18 4:31 PM: --- [~brahmareddy] - Thanks - why hasn't HADOOP-14799 been backported to branch-2 and branch-2.8? Seems odd to have to bring it up on a 3 yr old JIRA. :) Can we reopen or clone HADOOP-14799 to address this? was (Author: lmccay): [~brahmareddy] - Thanks - why hasn't HADOOP-14799 been backported to branch-2 and branch-2.8? Seems odd to have to bring it up on a 2 yr old JIRA. :) Can we reopen or clone HADOOP-14799 to address this? > Add Redirecting WebSSO behavior with JWT Token in Hadoop Auth > - > > Key: HADOOP-11717 > URL: https://issues.apache.org/jira/browse/HADOOP-11717 > Project: Hadoop Common > Issue Type: Improvement > Components: security >Reporter: Larry McCay >Assignee: Larry McCay >Priority: Major > Fix For: 2.8.0, 3.0.0-alpha1 > > Attachments: HADOOP-11717-1.patch, HADOOP-11717-2.patch, > HADOOP-11717-3.patch, HADOOP-11717-4.patch, HADOOP-11717-5.patch, > HADOOP-11717-6.patch, HADOOP-11717-7.patch, HADOOP-11717-8.patch, > RedirectingWebSSOwithJWTforHadoopWebUIs.pdf > > > Extend AltKerberosAuthenticationHandler to provide WebSSO flow for UIs. > The actual authentication is done by some external service that the handler > will redirect to when there is no hadoop.auth cookie and no JWT token found > in the incoming request. > Using JWT provides a number of benefits: > * It is not tied to any specific authentication mechanism - so buys us many > SSO integrations > * It is cryptographically verifiable for determining whether it can be trusted > * Checking for expiration allows for a limited lifetime and window for > compromised use > This will introduce the use of nimbus-jose-jwt library for processing, > validating and parsing JWT tokens. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
