Accessing Peer certificates in Access Control - Githubissues

apache / pinot

Apache Pinot - A realtime distributed OLAP datastore

https://pinot.apache.org/

Apache License 2.0

5.35k stars 1.25k forks source link

Accessing Peer certificates in Access Control #13556

Open mgranderath opened 1 month ago

mgranderath commented 1 month ago

Why

In our organization we use a custom Certificate Authority (CA) with Subject Alternative Names (SANs) for authentication and authorization. This is combined with mutual TLS (2-way).
In the AccessControl implementation we need to have access to the certificate of the peer so that we can assign a role.
Currently the AccessControl interface only provides a couple properties of the request metadata (depending on the node).

Possible Implementation

In our fork we have modified the AccessControl interface to permit passing an optional Request object in a backwards compatible manner. This allows for accessing more properties than just the peer certificate and can also be used for a variety of other authentication strategies.

I can open a draft PR with the required changes for further discussion.

Jackie-Jiang commented 1 month ago

cc @zhtaoxiang @soumitra-st

mgranderath commented 1 month ago

Added a draft of our solution here. I am also very open to entirely changing the approach if there are better ideas!