- 
                Notifications
    You must be signed in to change notification settings 
- Fork 9.1k
HADOOP-19612 Add RPC header for access token #7803
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
4cba696    to
    a6e2b97      
    Compare
  
    | 💔 -1 overall 
 
 This message was automatically generated. | 
| 💔 -1 overall 
 
 This message was automatically generated. | 
| 🎊 +1 overall 
 
 This message was automatically generated. | 
| 🎊 +1 overall 
 
 This message was automatically generated. | 
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
left some comments
        
          
                hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java
          
            Show resolved
            Hide resolved
        
              
          
                ...mon-project/hadoop-common/src/main/java/org/apache/hadoop/security/AuthorizationContext.java
          
            Show resolved
            Hide resolved
        
              
          
                hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java
              
                Outdated
          
            Show resolved
            Hide resolved
        
      There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, apart from a single comment (which is not a blocker)
        
          
                hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java
              
                Outdated
          
            Show resolved
            Hide resolved
        
      110a462    to
    8d304ff      
    Compare
  
    | 💔 -1 overall 
 
 This message was automatically generated. | 
| 🎊 +1 overall 
 
 This message was automatically generated. | 
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm
| 🎊 +1 overall 
 
 This message was automatically generated. | 
| This patch looks good to me. +1. I will commit to trunk. I think this is low risk of affecting folks that don't use the new AuthorizationContext. Adding AuthorizationContext allows more flexibility for token-based authorization implementations. Thank you for the contribution @mccormickt12 ! | 
| @mccormickt12 before I merge can you ensure that there is a JIRA filed for this issue and the JIRA is in the title of the PR? | 
Add a new auth header to the rpc header proto for access token support. This should support different access tokens within the same connection. Contributed-by: Tom McCormick <[email protected]>
* HADOOP-19612 Add RPC header for access token (#7803) Add a new auth header to the rpc header proto for access token support. This should support different access tokens within the same connection. (backport) Contributed-by: Tom McCormick <[email protected]>
Description of PR
Add a new auth header to the rpc header proto for access token support. This should support different access tokens within the same connection.
Yes, the core of the change is a adding a new proto field (inherently backwards compatible) and then setting the new auth context in a thread local (same pattern as caller context).
This doesn't degrade any security posture. It is questionable to send an access token in a header without the header being encrypted, but given this auth header is not required, theres no risk to existing use cases.
Existing clients won't send it. Clients that use it will increase the header of each rpc by the header size.
How was this patch tested?
New unit tests + existing unit test coverage for backwards compat
For code changes:
LICENSE,LICENSE-binary,NOTICE-binaryfiles?