[kudu-CR] KUDU-3586 [java] Add proxy user client support

["Zoltan Chovan (Code Review)" <ge...@cloudera.org>]

Zoltan Chovan has uploaded a new patch set (#5) to the change originally created by mintao. ( http://gerrit.cloudera.org:8080/24830 )

Change subject: KUDU-3586 [java] Add proxy user client support
......................................................................

KUDU-3586 [java] Add proxy user client support

Expose AsyncKuduClientBuilder.effectiveUser() and
KuduClientBuilder.effectiveUser(). The client still authenticates using
its real Kerberos identity. A null or empty name means the client acts
as the real user; as in the C++ client, the effective user is not
compared with the local OS user name. The effective user is
fixed for the lifetime of the client, since connections are not keyed
by user.

The Java negotiator reads the effective user once per negotiation, sends
it as the SASL authorization identity, and populates the (deprecated)
connection context user info consistently. Proxied connections use
neither authentication tokens nor JWTs: they carry no authorization
identity, so the impersonation would be silently dropped. When the
servers reject a proxy request, the client fails with NotAuthorized and
the reason from the server instead of retrying until it times out.

As in the C++ client, a proxied client exports the authentication token
issued for the effective user, so a client importing the credentials,
e.g. a Spark executor without Kerberos credentials, acts as the
effective user. Importing credentials never changes the effective user
of a client.

The credentials semantics are covered by the unit tests in
TestSecurityContextEffectiveUser. A new TestNegotiator case checks that
a proxied client with an authn token, a JWT and trusted certificates
only offers SASL, sends the effective user as the PLAIN authorization
identity, and puts it into the connection context.

Co-authored-by: hzmintao <mi...@gmail.com>
Change-Id: I77897a52cfa01e5b7af97703437cd45d2df9fb52
---
M java/kudu-client/src/main/java/org/apache/kudu/client/AsyncKuduClient.java
M java/kudu-client/src/main/java/org/apache/kudu/client/Connection.java
M java/kudu-client/src/main/java/org/apache/kudu/client/KuduClient.java
M java/kudu-client/src/main/java/org/apache/kudu/client/Negotiator.java
M java/kudu-client/src/main/java/org/apache/kudu/client/SecurityContext.java
M java/kudu-client/src/test/java/org/apache/kudu/client/TestNegotiator.java
A java/kudu-client/src/test/java/org/apache/kudu/client/TestSecurityContextEffectiveUser.java
7 files changed, 263 insertions(+), 12 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/30/24830/5
-- 
To view, visit http://gerrit.cloudera.org:8080/24830
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I77897a52cfa01e5b7af97703437cd45d2df9fb52
Gerrit-Change-Number: 24830
Gerrit-PatchSet: 5
Gerrit-Owner: mintao <mi...@gmail.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Chovan <zc...@cloudera.com>