[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI

["Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>]

Mihaly Szjatinya has uploaded a new patch set (#21). ( http://gerrit.cloudera.org:8080/23237 )

Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................

IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI

This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header

The initial resource URI is preserved as RelayState and restored after
successful authentication.

Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver

Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing

Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- tests/custom_cluster/test_webserver_auth_combined.py for LDAP+SAML2
and SPNEGO+SAML2 intelligent fallthrough (skips auth attempt when no
Authorization header present)
- CTEST for ParseSamlSpUrl, ParseParams

Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
A tests/custom_cluster/test_webserver_auth_combined.py
34 files changed, 2,681 insertions(+), 693 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/21
-- 
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 21
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>