Keycloak supports a non-standard and somewhat dangerous token exchange type called "direct naked impersonation" that allows a client to impersonate any user using it's own credentials alone. The request looks like this, you would do a normal token-exchange, but leave out subject token and set requested_subject field instead:
curl -X POST \
-d "client_id=starting-client" \
-d "client_secret=the client secret" \
--data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
-d "requested_subject=wburke" \
http://localhost:8080/realms/myrealm/protocol/openid-connect/token
In practice, the change in auth manager would mean adding additional rest.auth.oauth2.token-exchange.requested_subject field.
The use case we have for it is an integration of iceberg rest catalog (polaris to be exact) with Apache Kyuubi. Out of the box Kyuubi supports LDAP or kerberos for authentication. Authorization story is a bit all over the place though, you can do full impersonation using kerberos depending on the setup or you can integrate it with Apache Ranger directly, but other than that you're on your own. Neither of those authorization solutions work for us, because we don't want to use either kerberos or Ranger.
One mechanism that I think could work is to rely on LDAP for authentication and then instruct Kyuubi to inject authenticated user's username in just the right places in spark conf (which is fortunately possible). In this case it would be the newly added requested_subject parameter that we would inject to effectively turn LDAP auth into OIDC impersonation.
P.S. I've not checked whether Nimbus allows this or not yet, but I'm pretty sure it should.
Keycloak supports a non-standard and somewhat dangerous token exchange type called "direct naked impersonation" that allows a client to impersonate any user using it's own credentials alone. The request looks like this, you would do a normal token-exchange, but leave out subject token and set
requested_subjectfield instead:In practice, the change in auth manager would mean adding additional
rest.auth.oauth2.token-exchange.requested_subjectfield.The use case we have for it is an integration of iceberg rest catalog (polaris to be exact) with Apache Kyuubi. Out of the box Kyuubi supports LDAP or kerberos for authentication. Authorization story is a bit all over the place though, you can do full impersonation using kerberos depending on the setup or you can integrate it with Apache Ranger directly, but other than that you're on your own. Neither of those authorization solutions work for us, because we don't want to use either kerberos or Ranger.
One mechanism that I think could work is to rely on LDAP for authentication and then instruct Kyuubi to inject authenticated user's username in just the right places in spark conf (which is fortunately possible). In this case it would be the newly added
requested_subjectparameter that we would inject to effectively turn LDAP auth into OIDC impersonation.P.S. I've not checked whether Nimbus allows this or not yet, but I'm pretty sure it should.