mirror of
https://github.com/datahub-project/datahub.git
synced 2025-07-06 08:38:41 +00:00
143 lines
68 KiB
HTML
143 lines
68 KiB
HTML
|
<!doctype html>
|
|||
|
|
<html lang="en" dir="ltr" class="docs-wrapper docs-doc-page docs-version-current plugin-docs plugin-id-default docs-doc-id-docs/authentication/introducing-metadata-service-authentication" data-has-hydrated="false">
|
|||
|
|
<head>
|
|||
|
|
<meta charset="UTF-8">
|
|||
|
|
<meta name="generator" content="Docusaurus v2.4.3">
|
|||
|
|
<title data-rh="true">Metadata Service Authentication | DataHub</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="https://docs.datahub.com/docs/authentication/introducing-metadata-service-authentication"><meta data-rh="true" name="docusaurus_locale" content="en"><meta data-rh="true" name="docsearch:language" content="en"><meta data-rh="true" name="docusaurus_version" content="current"><meta data-rh="true" name="docusaurus_tag" content="docs-default-current"><meta data-rh="true" name="docsearch:version" content="current"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-current"><meta data-rh="true" property="og:title" content="Metadata Service Authentication | DataHub"><meta data-rh="true" name="description" content="Introduction"><meta data-rh="true" property="og:description" content="Introduction"><link data-rh="true" rel="icon" href="/img/favicon.ico"><link data-rh="true" rel="canonical" href="https://docs.datahub.com/docs/authentication/introducing-metadata-service-authentication"><link data-rh="true" rel="alternate" href="https://docs.datahub.com/docs/authentication/introducing-metadata-service-authentication" hreflang="en"><link data-rh="true" rel="alternate" href="https://docs.datahub.com/docs/authentication/introducing-metadata-service-authentication" hreflang="x-default"><link data-rh="true" rel="preconnect" href="https://RK0UG797F3-dsn.algolia.net" crossorigin="anonymous"><link rel="alternate" type="application/rss+xml" href="/learn/rss.xml" title="DataHub RSS Feed">
|
|||
|
|
<link rel="alternate" type="application/atom+xml" href="/learn/atom.xml" title="DataHub Atom Feed">
|
|||
|
|
|
|||
|
|
<link rel="preconnect" href="https://www.google-analytics.com">
|
|||
|
|
<link rel="preconnect" href="https://www.googletagmanager.com">
|
|||
|
|
<script async src="https://www.googletagmanager.com/gtag/js?id=G-PKGVLETT4C"></script>
|
|||
|
|
<script>function gtag(){dataLayer.push(arguments)}window.dataLayer=window.dataLayer||[],gtag("js",new Date),gtag("config","G-PKGVLETT4C",{})</script>
|
|||
|
|
<link rel="preconnect" href="https://www.googletagmanager.com">
|
|||
|
|
<script>window.dataLayer=window.dataLayer||[]</script>
|
|||
|
|
<script>!function(e,t,a,n,g){e[n]=e[n]||[],e[n].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var m=t.getElementsByTagName(a)[0],r=t.createElement(a);r.async=!0,r.src="https://www.googletagmanager.com/gtm.js?id=GTM-5M8T9HNN",m.parentNode.insertBefore(r,m)}(window,document,"script","dataLayer")</script>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<link rel="search" type="application/opensearchdescription+xml" title="DataHub" href="/opensearch.xml">
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<meta httpequiv="Content-Security-Policy" content="frame-ancestors 'self' https://*.acryl.io https://acryldata.io http://localhost:*">
|
|||
|
|
<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Manrope:wght@400;500;700&display=swap">
|
|||
|
|
<script src="https://tools.luckyorange.com/core/lo.js?site-id=28ea8a38" async defer="defer"></script>
|
|||
|
|
<script src="/scripts/rb2b.js" async defer="defer"></script>
|
|||
|
|
<script src="https://app.revenuehero.io/scheduler.min.js"></script>
|
|||
|
|
<script src="https://tag.clearbitscripts.com/v1/pk_2e321cabe30432a5c44c0424781aa35f/tags.js" referrerpolicy="strict-origin-when-cross-origin"></script>
|
|||
|
|
<script src="/scripts/reo.js"></script>
|
|||
|
|
<script id="runllm-widget-script" type="module" src="https://widget.runllm.com" crossorigin="true" runllm-name="DataHub" runllm-assistant-id="81" runllm-position="BOTTOM_RIGHT" runllm-keyboard-shortcut="Mod+j" runllm-preset="docusaurus" runllm-theme-color="#1890FF" runllm-brand-logo="https://docs.datahub.com/img/datahub-logo-color-mark.svg" runllm-community-url="https://datahub.com/slack" runllm-community-type="slack" runllm-disable-ask-a-person="true" async></script><link rel="stylesheet" href="/assets/css/styles.d8fe2eb8.css">
|
|||
|
|
<link rel="preload" href="/assets/js/runtime~main.50e13f51.js" as="script">
|
|||
|
|
<link rel="preload" href="/assets/js/main.edc0853c.js" as="script">
|
|||
|
|
</head>
|
|||
|
|
<body class="navigation-with-keyboard">
|
|||
|
|
<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-5M8T9HNN" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
|
|||
|
|
|
|||
|
|
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=new URLSearchParams(window.location.search).get("docusaurus-theme")}catch(t){}return t}()||function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}(),document.documentElement.setAttribute("data-announcement-bar-initially-dismissed",function(){try{return"true"===localStorage.getItem("docusaurus.announcement.dismiss")}catch(t){}return!1}())</script><div id="__docusaurus">
|
|||
|
|
<div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#__docusaurus_skipToContent_fallback">Skip to main content</a></div><div class="announcementBar_mb4j" style="background-color:transparent;color:#ffffff" role="banner"><div class="content_knG7 announcementBarContent_xLdY"><div class="shimmer-banner"><p>DataHub Secures $35 Million Series B</p><a href="https://datahub.com/news/series-b-announcement/" target="_blank" class="button"><div>Read the announcement<span> →</span></div></a></div></div></div><nav aria-label="Main" class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a href="https://datahub.com" target="_blank" rel="noopener noreferrer" class="navbar__brand"><div class="navbar__logo"><img src="/img/datahub-logo-color-light-horizontal.svg" alt="DataHub Logo" class="themedImage_ToTc themedImage--light_HNdA"><img src="/img/datahub-logo-color-dark-horizontal.svg" alt="DataHub Logo" class="themedImage_ToTc themedImage--dark_i4oU"></div></a><div class="navbar__item dropdown dropdown--hoverable"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link versionNavItem_cbn8">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/docs/authentication/introducing-metadata-service-authentication">Next</a></li><li><a class="dropdown__link" href="/docs/1.1.0/authentication/introducing-metadata-service-authentication">1.1.0</a></li><li><hr class="dropdown-separator" style="margin: 0.4rem;"></li><li><div class="dropdown__link"><b>Archived versions</b></div></li><li>
|
|||
|
|
<a class="dropdown__link" href="https://docs-website-t9sv4w3gr-acryldata.vercel.app/docs/features">1.0.0
|
|||
|
|
<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg>
|
|||
|
|
</a>
|
|||
|
|
</li><li>
|
|||
|
|
<a class="dropdown__link" href="https://docs-website-t9sv4w3gr-acryldata.vercel.app/docs/0.15.0/features">0.15.0
|
|||
|
|
<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg>
|
|||
|
|
</a>
|
|||
|
|
</li><li>
|
|||
|
|
<a class="dropdown__link" href="https://docs-website-8jkm4uler-acryldata.vercel.app/docs/0.14.1/features">0.14.1
|
|||
|
|
<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg>
|
|||
|
|
</a>
|
|||
|
|
</li><li>
|
|||
|
|
<a class="dropdown__link" href="https://docs-website-eue2qafvn-acryldata.vercel.app/docs/features">0.14.0
|
|||
|
|
<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg>
|
|||
|
|
</a>
|
|||
|
|
</li><li>
|
|||
|
|
<a class="dropdown__link" href="https://docs-website-psat3nzgi-acryldata.vercel.app/docs/features">0.13.1
|
|||
|
|
<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg>
|
|||
|
|
</a>
|
|||
|
|
</li><li>
|
|||
|
|
<a class="dropdown__link" href="https://docs-website-lzxh86531-acryldata.vercel.app/docs/features">0.13.0
|
|||
|
|
<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg>
|
|||
|
|
</a>
|
|||
|
|
</li><li>
|
|||
|
|
<a class="dropdown__link" href="https://docs-website-2uuxmgza2-acryldata.vercel.app/docs/features">0.12.1
|
|||
|
|
<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg>
|
|||
|
|
</a>
|
|||
|
|
</li><li>
|
|||
|
|
<a class="dropdown__link" href="https://docs-website-irpoe2osc-acryldata.vercel.app/docs/features">0.11.0
|
|||
|
|
<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg>
|
|||
|
|
</a>
|
|||
|
|
</li><li>
|
|||
|
|
<a class="dropdown__link" href="https://docs-website-1gv2yzn9d-acryldata.vercel.app/docs/features">0.10.5
|
|||
|
|
<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg>
|
|||
|
|
</a>
|
|||
|
|
</li></ul></div></div><div class="navbar__items navbar__items--right"><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/docs">Docs</a><a class="navbar__item navbar__link" href="/integrations">Integrations</a><div class="navbar__item dropdown dropdown--hoverable"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link">Learn</a><ul class="dropdown__menu dropdown__menu_Z8FC"><div class="wrapper_kp81"><div><a href="https://datahub.com/weekly-demo" target="_blank" rel="noopener noreferrer" class="card_BUD7"><div class="icon_BgHd"><img src="/img/icon-join-slack.png" alt="Weekly Demo"></div><div class="title_c7DP">Weekly Demo</div></a></div><div><a href="https://datahub.com/use-cases" target="_blank" rel="noopener noreferrer" class="card_BUD7"><div class="icon_BgHd"><img src="/img/icon-forum.png" alt="Use Cases"></div><div class="title_c7DP">Use Cases</div></a></div><div><a href="httpps://datahub.com/adoption-stories" target="_blank" rel="noopener noreferrer" class="card_BUD7"><div class="icon_BgHd"><img src="/img/icon-events.png" alt="Adoption Stories"></div><div class="title_c7DP">Adoption Stories</div></a></div><div><a href="https://medium.com/datahub-project" target="_blank" rel="noopener noreferrer" class="card_BUD7"><div class="icon_BgHd"><img src="/img/icon-champions.png" alt="Blog"></div><div class="title_c7DP">Blog</div></a></div><div><a href="https://www.youtube.com/channel/UC3qFQC5IiwR5fvWEqi_tJ5w" target="_blank" rel="noopener noreferrer" class="card_BUD7"><div class="icon_BgHd"><img src="/img/icon-share-your-journey.png" alt="Youtube"></div><div class="title_c7DP">Youtube</div></a></div></div></ul></div><div class="navbar__item dropdown dropdown--hoverable"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link">Community</a><ul class="dropdown__menu dropdown__menu_Z8FC"><div class="wrapper_kp81"><div><a href="https://datahub.com/slack/" target="_blank" rel="noopener noreferrer" class="card_BUD7"><div class="icon_BgHd"><img src="/img/icon-join-slack.png" alt="Join Slack"></div><div class="title_c7DP">Join Slack</div></a></div><div><a href="https://datahub.com/events" target="_blank" rel="noopener noreferrer" class="card_BUD7"><div class="icon_BgHd"><img src="/img/icon-events.png" alt="Events"></div><div class="title_c7DP">Events</div></a></div><div><a href="https://datahub.com/champions/" target="_blank" rel="noopener noreferrer" class="card_BUD7"><div class="icon_BgHd"><img src="/img/icon-champions.png" alt="Champions"></div><div class="title_c7DP">Champions</div></a></div><div><a href="https://datahub.com/share-your-journey/" target="_blank" rel="noopener noreferrer" class="card_BUD7"><div class="icon_BgHd"><img src="/img/icon-share-your-journey.png" alt="Share Your Journey"></div><div class="title_c7DP">Share Your Journey</div></a></div></div></ul></div><a href="https://datahub.com/products/why-datahub-cloud/" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">
|
|||
|
|
<style>
|
|||
|
|
.cloud-cta {
|
|||
|
|
color: var(--ifm-menu-color-active);
|
|||
|
|
font-weight: 600;
|
|||
|
|
background: linear-gradient(40deg, var(--ifm-menu-color-active), var(--ifm-menu-color-active));
|
|||
|
|
background-size: 200% 100%;
|
|||
|
|
-webkit-background-clip: text;
|
|||
|
|
background-clip: text;
|
|||
|
|
transition: background-image 0.3s ease;
|
|||
|
|
}
|
|||
|
|
.cloud-cta:hover {
|
|||
|
|
color: transparent;
|
|||
|
|
background: linear-gradient(40deg, var(--ifm-menu-color-active), #ff1493);
|
|||
|
|
background-size: 200% 100%;
|
|||
|
|
-webkit-background-clip: text;
|
|||
|
|
background-clip: text;
|
|||
|
|
animation: gradientShift 3s ease infinite;
|
|||
|
|
}
|
|||
|
|
@keyframes gradientShift {
|
|||
|
|
0%, 100% { background-position: 0% 50%; }
|
|||
|
|
50% { background-position: 100% 50%; }
|
|||
|
|
}
|
|||
|
|
</style>
|
|||
|
|
<div class="cloud-cta">Get Cloud</div>
|
|||
|
|
</a><a href="https://datahub.com/slack?utm_source=docs&utm_medium=header&utm_campaign=docs_header" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">
|
|||
|
|
<style>
|
|||
|
|
.slack-logo:hover {
|
|||
|
|
opacity: 0.8;
|
|||
|
|
}
|
|||
|
|
</style>
|
|||
|
|
<img class="slack-logo" src="https://upload.wikimedia.org/wikipedia/commons/d/d5/Slack_icon_2019.svg" , alt="slack" , height="20px" style="margin: 10px 0 0 0;">
|
|||
|
|
</a><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="Search"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20" aria-hidden="true"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">Search</span></span><span class="DocSearch-Button-Keys"></span></button></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="__docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0 docsWrapper_BCFX"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebarViewport_Xe31"><div class="sidebar_njMd"><nav aria-label="Docs sidebar" class="menu thin-scrollbar menu_SIkG menuWithAnnouncementBar_GW3s"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menuHtmlItem_M9Kj menu__list-item"><div>Getting Started</div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/docs/features">What Is DataHub?</a><button aria-label="Toggle the collapsible sidebar category 'What Is DataHub?'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/docs/category/features">Features</a><button aria-label="Toggle the collapsible sidebar category 'Features'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menuHtmlItem_M9Kj menu__list-item"><div>DataHub Cloud</div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/docs/managed-datahub/managed-datahub-overview">DataHub Cloud Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/docs/managed-datahub/welcome-acryl">Getting Started with DataHub Cloud</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/docs/authentication/guides/sso/initialize-oidc">Configure Single Sign-On</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/docs/managed-datahub/remote-executor/about">Remote Executor</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/docs/managed-datahub/datahub-api/entity-events-api">DataHub API</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--subli
|
|||
|
|
It includes a characterization of the motivations for the feature, the key components in its design, the new capabilities it provides, & configuration instructions.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="background">Background<a href="#background" class="hash-link" aria-label="Direct link to Background" title="Direct link to Background"></a></h2><p>Let's recall 2 critical components of DataHub's architecture:</p><ul><li><strong>DataHub Frontend Proxy</strong> (datahub-frontend) - Resource server that routes requests to downstream Metadata Service</li><li><strong>DataHub Metadata Service</strong> (datahub-gms) - Source of truth for storing and serving DataHub Metadata Graph.</li></ul><p>Previously, Authentication was exclusively handled by the Frontend Proxy. This service would perform the following steps
|
|||
|
|
when a user navigated to <code>http://localhost:9002/</code>:</p><p>a. Check for the presence of a special <code>PLAY_SESSION</code> cookie.</p><p>b. If cookie was present + valid, redirect to the home page</p><p>c. If cookie was invalid, redirect to either a) the DataHub login screen (for <a href="/docs/authentication/guides/jaas">JAAS authentication</a> or b) a <a href="/docs/authentication/guides/sso/configure-oidc-react">configured OIDC Identity Provider</a> to perform authentication.</p><p>Once authentication had succeeded at the frontend proxy layer, a stateless (token-based) session cookie (PLAY_SESSION) would be set in the users browser.
|
|||
|
|
All subsequent requests, including the GraphQL requests issued by the React UI, would be authenticated using this session cookie. Once a request had made it beyond
|
|||
|
|
the frontend service layer, it was assumed to have been already authenticated. Hence, there was <strong>no native authentication inside of the Metadata Service</strong>.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="problems-with-this-approach">Problems with this approach<a href="#problems-with-this-approach" class="hash-link" aria-label="Direct link to Problems with this approach" title="Direct link to Problems with this approach"></a></h3><p>The major challenge with this situation is that requests to the backend Metadata Service were completely unauthenticated. There were 2 options for folks who required authentication at the Metadata Service layer:</p><ol><li>Set up a proxy in front of Metadata Service that performed authentication</li><li>[A more recent possibility]<!-- --> Route requests to Metadata Service through DataHub Frontend Proxy, including the PLAY_SESSION
|
|||
|
|
Cookie with every request.</li></ol><p>Neither of which are ideal. Setting up a proxy to do authentication takes time & expertise. Extracting and setting a session cookie from the browser for programmatic is
|
|||
|
|
clunky & unscalable. On top of that, extending the authentication system was difficult, requiring implementing a new <a href="https://www.playframework.com/documentation/2.8.8/api/java/play/mvc/Security.Authenticator.html" target="_blank" rel="noopener noreferrer">Play module</a> within DataHub Frontend.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="introducing-authentication-in-datahub-metadata-service">Introducing Authentication in DataHub Metadata Service<a href="#introducing-authentication-in-datahub-metadata-service" class="hash-link" aria-label="Direct link to Introducing Authentication in DataHub Metadata Service" title="Direct link to Introducing Authentication in DataHub Metadata Service"></a></h2><p>To address these problems, we introduced configurable Authentication inside the <strong>Metadata Service</strong> itself,
|
|||
|
|
meaning that requests are no longer considered trusted until they are authenticated by the Metadata Service.</p><p>Why push Authentication down? In addition to the problems described above, we wanted to plan for a future
|
|||
|
|
where Authentication of Kafka-based-writes could be performed in the same manner as Rest writes.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="configuring-metadata-service-authentication">Configuring Metadata Service Authentication<a href="#configuring-metadata-service-authentication" class="hash-link" aria-label="Direct link to Configuring Metadata Service Authentication" title="Direct link to Configuring Metadata Service Authentication"></a></h2><p>Metadata Service Authentication is currently <strong>opt-in</strong>. This means that you may continue to use DataHub without Metadata Service Authentication without interruption.
|
|||
|
|
To enable Metadata Service Authentication:</p><ul><li>set the <code>METADATA_SERVICE_AUTH_ENABLED</code> environment variable to "true" for the <code>datahub-gms</code> AND <code>datahub-frontend</code> containers / pods.</li></ul><p>OR</p><ul><li>change the Metadata Service <code>application.yaml</code> configuration file to set <code>authentication.enabled</code> to "true" AND</li><li>change the Frontend Proxy Service <code>application.config</code> configuration file to set <code>metadataService.auth.enabled</code> to "true"</li></ul><p>After setting the configuration flag, simply restart the Metadata Service to start enforcing Authentication.</p><p>Once enabled, all requests to the Metadata Service will need to be authenticated; if you're using the default Authenticators
|
|||
|
|
that ship with DataHub, this means that all requests will need to present an Access Token in the Authorization Header as follows:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">Authorization: Bearer <access-token></span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>For users logging into the UI, this process will be handled for you. When logging in, a cookie will be set in your browser that internally
|
|||
|
|
contains a valid Access Token for the Metadata Service. When browsing the UI, this token will be extracted and sent to the Metadata Service
|
|||
|
|
to authenticate each request.</p><p>For users who want to access the Metadata Service programmatically, i.e. for running ingestion, the current recommendation is to generate
|
|||
|
|
a <strong>Personal Access Token</strong> (described above) from the root "datahub" user account, and using this token when configuring your <a href="/docs/metadata-ingestion#recipes">Ingestion Recipes</a>.
|
|||
|
|
To configure the token for use in ingestion, simply populate the "token" configuration for the <code>datahub-rest</code> sink:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">source:</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # source configs</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">sink:</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> type: "datahub-rest"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> config:</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ...</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> token: <your-personal-access-token-here!></span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><blockquote><p>Note that ingestion occurring via <code>datahub-kafka</code> sink will continue to be Unauthenticated <em>for now</em>. Soon, we will be introducing
|
|||
|
|
support for providing an access token in the event payload itself to authenticate ingestion requests over Kafka.</p></blockquote><h3 class="anchor anchorWithStickyNavbar_LWe7" id="the-role-of-datahub-frontend-proxy-going-forward">The Role of DataHub Frontend Proxy Going Forward<a href="#the-role-of-datahub-frontend-proxy-going-forward" class="hash-link" aria-label="Direct link to The Role of DataHub Frontend Proxy Going Forward" title="Direct link to The Role of DataHub Frontend Proxy Going Forward"></a></h3><p>With these changes, DataHub Frontend Proxy will continue to play a vital part in the complex dance of Authentication. It will serve as the place
|
|||
|
|
where UI-based session authentication originates and will continue to support 3rd Party SSO configuration (OIDC)
|
|||
|
|
and JAAS configuration as it does today.</p><p>The major improvement is that the Frontend Service will validate credentials provided at UI login time
|
|||
|
|
and generate a DataHub <strong>Access Token</strong>, embedding it into traditional session cookie (which will continue to work).</p><p>In summary, DataHub Frontend Service will continue to play a vital role to Authentication. It's scope, however, will likely
|
|||
|
|
remain limited to concerns specific to the React UI.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="where-to-go-from-here">Where to go from here<a href="#where-to-go-from-here" class="hash-link" aria-label="Direct link to Where to go from here" title="Direct link to Where to go from here"></a></h2><p>These changes represent the first milestone in Metadata Service Authentication. They will serve as a foundation upon which we can build new features, prioritized based on Community demand:</p><ol><li><strong>Dynamic Authenticator Plugins</strong>: Configure + register custom Authenticator implementations, without forking DataHub.</li><li><strong>Service Accounts</strong>: Create service accounts and generate Access tokens on their behalf.</li><li><strong>Kafka Ingestion Authentication</strong>: Authenticate ingestion requests coming from the Kafka ingestion sink inside the Metadata Service.</li><li><strong>Access Token Management</strong>: Ability to view, manage, and revoke access tokens that have been generated. (Currently, access tokens inlcude no server side state, and thus cannot be revoked once granted)</li></ol><p>...and more! To advocate for these features or others, reach out on <a href="https://datahubspace.slack.com/join/shared_invite/zt-nx7i0dj7-I3IJYC551vpnvvjIaNRRGw#/shared-invite/email" target="_blank" rel="noopener noreferrer">Slack</a>.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="qas">Q&As<a href="#qas" class="hash-link" aria-label="Direct link to Q&As" title="Direct link to Q&As"></a></h2><h3 class="anchor anchorWithStickyNavbar_LWe7" id="what-if-i-dont-want-to-use-metadata-service-authentication">What if I don't want to use Metadata Service Authentication?<a href="#what-if-i-dont-want-to-use-metadata-service-authentication" class="hash-link" aria-label="Direct link to What if I don't want to use Metadata Service Authentication?" title="Direct link to What if I don't want to use Metadata Service Authentication?"></a></h3><p>That's perfectly fine, for now. Metadata Service Authentication is disabled by default, only enabled if you provide the
|
|||
|
|
environment variable <code>METADATA_SERVICE_AUTH_ENABLED</code> to the <code>datahub-gms</code> container or change the <code>authentication.enabled</code> to "true"
|
|||
|
|
inside your DataHub Metadata Service configuration (<code>application.yaml</code>).</p><p>That being said, we will be recommending that you enable Authentication for production use cases, to prevent
|
|||
|
|
arbitrary actors from ingesting metadata into DataHub.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="if-i-enable-metadata-service-authentication-will-ingestion-stop-working">If I enable Metadata Service Authentication, will ingestion stop working?<a href="#if-i-enable-metadata-service-authentication-will-ingestion-stop-working" class="hash-link" aria-label="Direct link to If I enable Metadata Service Authentication, will ingestion stop working?" title="Direct link to If I enable Metadata Service Authentication, will ingestion stop working?"></a></h3><p>If you enable Metadata Service Authentication, you will want to provide a value for the "token" configuration value
|
|||
|
|
when using the <code>datahub-rest</code> sink in your <a href="/docs/metadata-ingestion/#recipes">Ingestion Recipes</a>. See
|
|||
|
|
the <a href="/docs/metadata-ingestion/sink_docs/datahub#config-details">Rest Sink Docs</a> for configuration details.</p><p>We'd recommend generating a Personal Access Token (described above) from a trusted DataHub Account (e.g. root 'datahub' user) when configuring
|
|||
|
|
your Ingestion sources.</p><p>Note that you can also provide the "extraHeaders" configuration in <code>datahub-rest</code> sink to specify a custom header to
|
|||
|
|
pass with each request. This can be used in conjunction to authenticate using a custom Authenticator, for example.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="how-do-i-generate-an-access-token-for-a-service-account">How do I generate an Access Token for a service account?<a href="#how-do-i-generate-an-access-token-for-a-service-account" class="hash-link" aria-label="Direct link to How do I generate an Access Token for a service account?" title="Direct link to How do I generate an Access Token for a service account?"></a></h3><p>There is no formal concept of "service account" or "bot" on DataHub (yet). For now, we recommend you configure any
|
|||
|
|
programmatic clients of DataHub to use a Personal Access Token generated from a user with the correct privileges, for example
|
|||
|
|
the root "datahub" user account.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="i-want-to-authenticate-requests-using-a-custom-authenticator-how-do-i-do-this">I want to authenticate requests using a custom Authenticator? How do I do this?<a href="#i-want-to-authenticate-requests-using-a-custom-authenticator-how-do-i-do-this" class="hash-link" aria-label="Direct link to I want to authenticate requests using a custom Authenticator? How do I do this?" title="Direct link to I want to authenticate requests using a custom Authenticator? How do I do this?"></a></h3><p>You can configure DataHub to add your custom <strong>Authenticator</strong> to the <strong>Authentication Chain</strong> by changing the <code>application.yaml</code> configuration file for the Metadata Service:</p><div class="language-yml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-yml codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">authentication</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">enabled</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"> </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># Enable Metadata Service Authentication</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">...</span><span class="token plain">.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">authenticators</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># Configure an Authenticator Chain</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">type</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> <fully</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">qualified</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">authenticator</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">class</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">name</span><span class="token punctuation" style="color:rgb(199, 146, 234)">></span><span class="token plain"> </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># E.g. com.linkedin.datahub.authentication.CustomAuthenticator</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">configs</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># Specific configs that should be passed into 'init' method of Authenticator</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key
|
|||
|
|
of the Metadata Service java process.</p><p>We love contributions! Feel free to raise a PR to contribute an Authenticator back if it's generally useful.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="now-that-i-can-make-authenticated-requests-to-either-datahub-proxy-service-and-datahub-metadata-service-which-should-i-use">Now that I can make authenticated requests to either DataHub Proxy Service and DataHub Metadata Service, which should I use?<a href="#now-that-i-can-make-authenticated-requests-to-either-datahub-proxy-service-and-datahub-metadata-service-which-should-i-use" class="hash-link" aria-label="Direct link to Now that I can make authenticated requests to either DataHub Proxy Service and DataHub Metadata Service, which should I use?" title="Direct link to Now that I can make authenticated requests to either DataHub Proxy Service and DataHub Metadata Service, which should I use?"></a></h3><p>Previously, we were recommending that folks contact the Metadata Service directly when doing things like</p><ul><li>ingesting Metadata via recipes</li><li>issuing programmatic requests to the Rest.li APIs</li><li>issuing programmatic requests to the GraphQL APIs</li></ul><p>With these changes, we will be shifting to the recommendation that folks direct all traffic, whether it's programmatic or not,
|
|||
|
|
to the <strong>DataHub Frontend Proxy</strong>, as routing to Metadata Service endpoints is currently available at the path <code>/api/gms</code>.
|
|||
|
|
This recommendation is in effort to minimize the exposed surface area of DataHub to make securing, operating, maintaining, and developing
|
|||
|
|
the platform simpler.</p><p>In practice, this will require migrating Metadata <a href="/docs/metadata-ingestion#recipes">Ingestion Recipes</a> use the <code>datahub-rest</code> sink to pointing at a slightly different
|
|||
|
|
host + path.</p><p>Example recipe that proxies through DataHub Frontend</p><div class="language-yml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-yml codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">source</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># source configs</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">sink</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">type</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"datahub-rest"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">config</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">...</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">token</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> <your</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">personal</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">token</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">here</span><span class="token tag" style="color:rgb(255, 85, 114)">!</span><span class="token punctuation" style="color:rgb(199, 146, 234)">></span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h2 class="anchor anchorWithStickyNavbar_LWe7" id="feedback--questions--concerns">Feedback / Questions / Concerns<a href="#feedback--questions--concerns" class="hash-link" aria-label="Direct link to Feedback / Questions / Concerns" title="Direct link to Feedback / Questions / Concerns"></a></h2><p>We want to hear from you! For any inquiries, including Feedback, Questions, or Concerns, reach out on <a href="https://datahubspace.slack.com/join/shared_invite/zt-nx7i0dj7-I3IJYC551vpnvvjIaNRRGw#/shared-invite/email" target="_blank" rel="noopener noreferrer">Slack</a>!</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="slackUtm_uoBr"><div class="slackUtm_uoBr"><hr>Need more help? Join the conversation in <a href="https://datahub.com/slack?utm_source=docs&utm_medium=footer&utm_camp
|
|||
|
|
<script src="/assets/js/runtime~main.50e13f51.js"></script>
|
|||
|
|
<script src="/assets/js/main.edc0853c.js"></script>
|
|||
|
|
</body>
|
|||
|
|
</html>
|