[jira] [Updated] (AMBARI-8426) Provide access to session from resource handler/provider

["Robert Levas (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/AMBARI-8426?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Robert Levas updated AMBARI-8426:
---------------------------------
    Summary: Provide access to session from resource handler/provider  (was: Provide access to session from resource handler)

> Provide access to session from resource handler/provider
> --------------------------------------------------------
>
>                 Key: AMBARI-8426
>                 URL: https://issues.apache.org/jira/browse/AMBARI-8426
>             Project: Ambari
>          Issue Type: New Feature
>          Components: ambari-server
>    Affects Versions: 2.0.0
>            Reporter: Robert Levas
>              Labels: encryption, kerberos, security, session
>             Fix For: 2.0.0
>
>
> There should be a way to get access to the web server's session data from a (REST API) resource handler.  
> This will allow a resource handler to access information such as a session encryption key that may be used to encrypt data during that session.  An example of this would be when performing Kerberos-related activities, the following flow can occur:
> # Session encryption key is created
> # User uploads KDC administrator credentials 
> # administrator credential are encrypted using the session encryption key and persisted - maybe on disk, maybe in the Ambari database
> # For every Kerberos administration action that needs to occur during that session, the administrative credentials may be loaded into memory, decrypted, used, and removed from memory 
> # When the session terminates, the encryption key is lost and the persisted administrator credentials become lost
>  



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)