Status

Current State: Proposal

Discussion Thread: 

JIRA: KNOX-3048

Motivation

Apache Knox supports the ability to permit specific users to impersonate other users for access to proxied services or Knox APIs. This is good when a small number of users is permitted to impersonate other users, but as that number increases, so does the associated administration burden; Topologies can quickly become quite large and difficult to read and maintain.

This KIP is a proposal to support group-level impersonation configuration, such that users belonging to the configured group would be permitted to impersonate other users according to the contents of that configuration.

Impersonation Configuration Addition

The current user-specific identity assertion provider impersonation configuration looks something like the following:

<param>
  <name>hadoop.proxyuser.impersonation.enabled</name>
  <value>true</value>
</param>
<param>
  <name>hadoop.proxyuser.admin.users</name>
  <value>*</value>
</param>
<param>
  <name>hadoop.proxyuser.admin.groups</name>
  <value>*</value>
</param>
<param>
  <name>hadoop.proxyuser.admin.hosts</name>
  <value>*</value>
</param> 

In this example, the admin user is permitted to impersonate any user in any group from any host.

The proposed addition involves defining a prefix to qualify the username element (e.g., hadoop.proxyuser.USERNAME.users) of the param name as a group rather than a user. This qualifying prefix must not result in accidentally matching a valid username.

In the following example, users belonging to the admin group would be permitted to impersonate any user in any group from any host.

<param>
  <name>hadoop.proxyuser.impersonation.enabled</name>
  <value>true</value>
</param>
<param>
  <name>hadoop.proxyuser.GRP__admin.users</name>
  <value>*</value>
</param>
<param>
  <name>hadoop.proxyuser.GRP__admin.groups</name>
  <value>*</value>
</param>
<param>
  <name>hadoop.proxyuser.GRP__admin.hosts</name>
  <value>*</value>
</param>

Implementation

Knox implements the existing support for impersonation by using the default Hadoop provider (org.apache.hadoop.security.authorize.DefaultImpersonationProvider). This provider could be extended to override the following method:

                public void authorize(UserGroupInformation user, String remoteAddress) throws AuthorizationException

The overridden implementation of this method could catch the AuthorizationException resulting from the lack of any user-specific ACL, and check for ACLs associated with the impersonating user's groups. Unfortunately, this will require a change to the base class, since access to two necessary members of the DefaultImpersonationProvider class are private with no accessor methods defined. This class needs to either make the configPrefix and proxyUserAcl members protected or provide protected accessor methods for these.

In the meantime, an implementation is possible using reflection to access these members, but this is not ideal for a number of reasons.

Because the existing user-specific configuration will still be evaluated and honored first, the addition of group-specific impersonation configuration should not change the existing behavior, though in practice, I would expect one or the other to be employed for a given topology.

Related Links

Apache Knox Default Identity Assertion Provider documentation