Cloudera Docs

Configuring header-based authentication for Apache Atlas

Enable header-based authentication in Apache Atlas to validate user identities and roles passed from trusted gateways through secured HTTP headers.

Header-based authentication lets a trusted gateway or proxy pass user identity and optional role or request correlation data to Atlas using HTTP headers. Compared to JWT authentication, this method simplifies backend configuration and improves performance by offloading cryptographic token validation to the edge gateway. It also allows the proxy to directly inject centralized role mappings.

Property names use the atlas.authn.header.* prefix. Default header names use the x-awc-* prefix; you can point the properties at different header names if your edge uses another convention.

Confirm your proxy injects the username and optional roles and request ID headers that you will reference in Atlas configuration.

  1. In Cloudera Manager, select the Atlas service, and open the Configuration tab.
  2. Open Atlas Server Advanced Configuration Snippet (Safety Valve) for conf/atlas-application.properties, or the category where your deployment surfaces header authentication.
  3. Set the following keys in atlas-application.properties.
    Table 1. Header-based authentication properties
    Property Description
    atlas.authn.header.enabled Turns header-based authentication on or off (default false).
    atlas.authn.header.username Names the HTTP header that carries the authenticated user (default x-awc-username).
    atlas.authn.header.roles Names the HTTP header that carries role information (default x-awc-roles).
    atlas.authn.header.requestid Names the HTTP header that carries a request identifier (default x-awc-requestid).
  4. Save the configuration, deploy client configuration if required, and restart affected Atlas roles.

When enabled, Atlas reads the configured headers on each request and maps them into the authentication context according to your security stack.

To verify connectivity with synthetic headers on a test host (only where spoofing is not possible), you can send a POST request to the basic search endpoint:

curl -i -X POST \
  -H "Content-Type: application/json" \
  -H "x-awc-username: admin" \
  -H "x-awc-roles: ROLE_ADMIN" \
  -H "x-awc-requestid: req-1" \
  --data-raw '{"excludeDeletedEntities":true,"includeSubClassifications":true,"includeSubTypes":true,"includeClassificationAttributes":true,"entityFilters":null,"tagFilters":null,"attributes":[],"limit":25,"offset":0,"typeName":"_ALL_ENTITY_TYPES","classification":null,"termName":null}' \
  http://[***ATLAS_SERVER***]:31000/api/atlas/v2/search/basic