drill-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From arina-ielchiieva <...@git.apache.org>
Subject [GitHub] drill pull request #910: DRILL-5726: Support Impersonation without authentic...
Date Mon, 28 Aug 2017 16:48:09 GMT
Github user arina-ielchiieva commented on a diff in the pull request:

    https://github.com/apache/drill/pull/910#discussion_r135571777
  
    --- Diff: exec/java-exec/src/main/java/org/apache/drill/exec/server/rest/DrillRestServer.java
---
    @@ -230,6 +230,27 @@ public WebUserConnection provide() {
         public void dispose(WebUserConnection instance) {
     
         }
    +
    +    /**
    +     * Creates session user principal. If impersonation is enabled without authentication
and User-Name header is present and valid,
    +     * will create session user principal with provided user name, otherwise anonymous
user name will be used.
    +     * In both cases session user principal will have admin rights.
    +     *
    +     * @param config drill config
    +     * @param request client request
    +     * @return session user principal
    +     */
    +    private Principal createSessionUserPrincipal(DrillConfig config, HttpServletRequest
request) {
    +      final boolean checkForUserName = !config.getBoolean(ExecConstants.USER_AUTHENTICATION_ENABLED)
&& config.getBoolean(ExecConstants.IMPERSONATION_ENABLED);
    +      if (checkForUserName) {
    --- End diff --
    
    We should not require `User-Name` for each request since it is needed only when we need
to query the data. I will leave this method but also add `UserNameFilter` that would be applied
to all `/query` and `/query.json` requests and check if header is provided, i.e. we would
allow using `anonymous` user if `User-Name` is not provided since we'll know that `UserNameFilter`
will filter out request where `User-Name` is required but not set.


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---

Mime
View raw message