Forráskód Böngészése

HUE-7013 [backend] Provide Kerberos Mutual Authentication disable switch in "hue.ini"

For Hue Server when secure Kerberised setup is enabled some times we need to disable
"mutual authentication" to DISABLE. This code change provides that feature.

By default "mutual authentication" is set as "OPTIONAL"(there is no change in default setting)
One can set "REQUIRED" or "OPTIONAL" or "DISABLE" values.

To disable "mutual authentication" One can put following values in safety valve :
Hue Service Advanced Configuration Snippet (Safety Valve) for hue_safety_valve.ini
[desktop]
[[kerberos]]
mutual_authentication="DISABLED"

Testing Done:
- Manual testing
- Tested on cluster
Prakash Ranade 8 éve
szülő
commit
6ce125c

+ 2 - 0
desktop/conf.dist/hue.ini

@@ -634,6 +634,8 @@
     # Path to kinit
     ## kinit_path=/path/to/kinit
 
+    # Mutual authentication from the server, attaches HTTP GSSAPI/Kerberos Authentication to the given Request object
+    ## mutual_authentication="OPTIONAL" or "REQUIRED" or "DISABLED"
 
   # Configuration options for using OAuthBackend (Core) login
   # ------------------------------------------------------------------------

+ 2 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -636,6 +636,8 @@
     # Path to kinit
     ## kinit_path=/path/to/kinit
 
+    # Mutual authentication from the server, attaches HTTP GSSAPI/Kerberos Authentication to the given Request object
+    ## mutual_authentication="OPTIONAL" or "REQUIRED" or "DISABLED"
 
   # Configuration options for using OAuthBackend (Core) login
   # ------------------------------------------------------------------------

+ 7 - 1
desktop/core/src/desktop/conf.py

@@ -743,7 +743,13 @@ KERBEROS = ConfigSection(
       help=_("Path to Kerberos 'kinit' command."),
       type=str,
       default="kinit", # use PATH!
-    )
+    ),
+    MUTUAL_AUTHENTICATION=Config(
+      key='mutual_authentication',
+      help=_('Mutual authentication from the server, attaches HTTP GSSAPI/Kerberos Authentication to the given Request object'),
+      type=str,
+      default="OPTIONAL",
+    ),
   )
 )
 

+ 10 - 2
desktop/core/src/desktop/lib/rest/http_client.py

@@ -27,7 +27,7 @@ from desktop import conf
 
 from requests import exceptions
 from requests.auth import HTTPBasicAuth
-from requests_kerberos import HTTPKerberosAuth, OPTIONAL
+from requests_kerberos import HTTPKerberosAuth, REQUIRED, OPTIONAL, DISABLED
 from requests.packages.urllib3.contrib import pyopenssl
 
 pyopenssl.DEFAULT_SSL_CIPHER_LIST = conf.SSL_CIPHER_LIST.get()
@@ -108,7 +108,15 @@ class HttpClient(object):
 
   def set_kerberos_auth(self):
     """Set up kerberos auth for the client, based on the current ticket."""
-    self._session.auth = HTTPKerberosAuth(mutual_authentication=OPTIONAL)
+    mutual_auth = conf.KERBEROS.MUTUAL_AUTHENTICATION.get()
+    if mutual_auth == 'OPTIONAL':
+      self._session.auth = HTTPKerberosAuth(mutual_authentication=OPTIONAL)
+    elif mutual_auth == 'REQUIRED':
+      self._session.auth = HTTPKerberosAuth(mutual_authentication=REQUIRED)
+    elif mutual_auth == 'DISABLED':
+      self._session.auth = HTTPKerberosAuth(mutual_authentication=DISABLED)
+    else:
+      self._session.auth = HTTPKerberosAuth(mutual_authentication=OPTIONAL)
     return self
 
   def set_basic_auth(self, username, password):