[jira] [Commented] (ATLAS-5422) Support no-auth REST notification mode in trino-atlas for header-based authentication environments

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/ATLAS-5422?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18123672#comment-18123672 ] 

ASF subversion and git services commented on ATLAS-5422:
--------------------------------------------------------

Commit dba84066732830ae5cf58d2a113baef50cea6a2c in atlas's branch refs/heads/ATLAS-4796_u from bhor-sanket
[ https://gitbox.apache.org/repos/asf?p=atlas.git;h=dba840667 ]

ATLAS-5422:Support no-auth REST notification mode for header-based authentication environments (#775)


Co-authored-by: sanket.bhor <sa...@cloudera.com>

> Support no-auth REST notification mode in trino-atlas for header-based authentication environments
> --------------------------------------------------------------------------------------------------
>
>                 Key: ATLAS-5422
>                 URL: https://issues.apache.org/jira/browse/ATLAS-5422
>             Project: Atlas
>          Issue Type: Task
>            Reporter: sanket bhor
>            Assignee: sanket bhor
>            Priority: Major
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> h3. Background
> The trino-atlas plugin currently sends Atlas hook notifications via the Kafka channel with Kerberos SASL/SSL authentication. The Atlas client library (atlas-apache) also supports a REST notification channel with Kerberos SPNEGO, Basic Auth, or JWT Bearer token authentication.
> In UDF environments, Kerberos and other traditional authentication mechanisms are not used. Instead, these environments rely on header-based authentication where an external gateway/proxy intercepts requests and injects auth headers (x-awc-username, x-awc-roles, x-awc-requestid) before forwarding to the Atlas server. The Atlas server is configured to trust these headers via atlas.authn.header.enabled=true.
> h3. Problem
> When REST notification is enabled (atlas.hook.rest.notification.enabled=true), the RestNotification class (RestNotification.java:L86-96) forces one of two auth modes:
>  * Kerberos enabled → creates AtlasClientV2 with SPNEGO
>  * Kerberos disabled → creates AtlasClientV2 with Basic Auth (defaults to admin/admin123)
> There is no option to create the client without any authentication, which is required when the external gateway handles auth. Additionally, if Basic Auth username/password resolves to null, the client calls
> System.console() which triggers System.exit(1) in daemon mode — crashing the Trino JVM.
> h3. Requirement
> Provide a flag-based configuration to enable no-auth REST notification mode where:
>  * The trino-atlas hook sends notifications via the REST channel without attaching any client-side authentication (no Kerberos, no Basic Auth, no JWT)
>  * The external gateway/proxy is responsible for injecting the required auth headers before the request reaches the Atlas server
>  * This mode should be opt-in via a configuration property to avoid accidental misconfiguration
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)