[jira] [Updated] (AMBARI-24985) Handle requests from a configured trusted proxy to identify a proxied user using Kerberos

["ASF GitHub Bot (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/AMBARI-24985?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

ASF GitHub Bot updated AMBARI-24985:
------------------------------------
    Labels: pull-request-available tproxy  (was: tproxy)

> Handle requests from a configured trusted proxy to identify a proxied user using Kerberos
> -----------------------------------------------------------------------------------------
>
>                 Key: AMBARI-24985
>                 URL: https://issues.apache.org/jira/browse/AMBARI-24985
>             Project: Ambari
>          Issue Type: Task
>          Components: ambari-server
>    Affects Versions: 2.8.0
>            Reporter: Robert Levas
>            Assignee: Robert Levas
>            Priority: Major
>              Labels: pull-request-available, tproxy
>             Fix For: 2.8.0
>
>
> Handle requests from a configured trusted proxy to identify a proxied user using Kerberos.
> Upon receiving a request where that caller is identified using Kerberos, check to see of the request was from a (trusted) proxy.  If so, validate the trusted proxy and set the authenticated user to the proxied user specified in the "{{doAs}}" query parameter. 
> After receiving a request where the user is to be authenticated using Kerberos, perform the following steps:
> # Determine if a proxied user is specified using a "{{doAs}}" query parameter.  
> # Using the following Ambari configuration property, determine if a proxied user can be specified from the requesting host:
> ** {{ambari.tproxy.proxyuser.$username.hosts}}, where $username is the username of the authenticated user (not the user specified in the doAs query parameter)
> # Obtain the proxied username from the {{doAs}} query parameter
> # Using the following Ambari configuration property, determine if the proxied user can be specified based on the user's username:
> ** {{ambari.tproxy.proxyuser.$username.users}}, where $username is the username of the authenticated user 
> # Using the following Ambari configuration property, determine if the proxied user can be specified based on the groups the proxied user belong to:
> ** {{ambari.tproxy.proxyuser.$username.groups}}, where $username is the username of the authenticated user t



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)