-
Notifications
You must be signed in to change notification settings - Fork 9.1k
Add RPC header for access token #7803
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: trunk
Are you sure you want to change the base?
Conversation
4cba696
to
a6e2b97
Compare
💔 -1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
🎊 +1 overall
This message was automatically generated. |
🎊 +1 overall
This message was automatically generated. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
left some comments
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java
Outdated
Show resolved
Hide resolved
...mon-project/hadoop-common/src/main/java/org/apache/hadoop/security/AuthorizationContext.java
Show resolved
Hide resolved
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, apart from a single comment (which is not a blocker)
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ipc/Server.java
Outdated
Show resolved
Hide resolved
110a462
to
8d304ff
Compare
💔 -1 overall
This message was automatically generated. |
🎊 +1 overall
This message was automatically generated. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm
🎊 +1 overall
This message was automatically generated. |
Description of PR
Add a new auth header to the rpc header proto for access token support. This should support different access tokens within the same connection.
Yes, the core of the change is a adding a new proto field (inherently backwards compatible) and then setting the new auth context in a thread local (same pattern as caller context).
This doesn't degrade any security posture. It is questionable to send an access token in a header without the header being encrypted, but given this auth header is not required, theres no risk to existing use cases.
Existing clients won't send it. Clients that use it will increase the header of each rpc by the header size.
How was this patch tested?
New unit tests + existing unit test coverage for backwards compat
For code changes:
LICENSE
,LICENSE-binary
,NOTICE-binary
files?