[Proposal] Enable writing of druid extensions that can provide dataSource level authorization

[himanshug]

See https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/druid-development/4nByc_xxxrU/ZJa-9qUEBgAJ

[himanshug]

I'm working on this one with @pjain1 , so assigning it to him.

[drcrallen]

One thing that wasn't clear from the group thread, are you planning on having all auth information in headers, or will it require parsing the message body?

[himanshug]

@drcrallen I'm thinking of putting no authentication code inside druid-core , any AuthenticationFilter can be injected from the extension and extension writer can choose to use whatever mechanism fits for them. Only thing that would go inside druid-core will be an interface AuthorizationInfo and checks at jersey endpoints. AuthenticationFilter injected from the extension will be responsible for setting up an implementation of AuthorizationInfo in the context and individual jersey end points will use that to accept/deny/filter the request.
How the injected AuthenticationFilter authenticates and fills the AuthorizationInfo implementation is up to the extension implementation and different ways are possible.

Parag would soon do a PR and that might clarify things more.

[drcrallen]

Note that https://github.com/acesinc/druid-cors-filter-extension is essentially a servlet extension. If you find some stuff that works well or that needs to change to make druid servlet extensions work well, it would be worth notifying them about.