Skip to main content

DataHub Frontend Proxy

DataHub frontend is a Play service written in Java. It is served as a mid-tier between DataHub GMS which is the backend service and DataHub Web.

Pre-requisites​

  • You need to have JDK11 installed on your machine to be able to build DataHub Frontend.
  • You need to have Chrome web browser installed to be able to build because UI tests have a dependency on Google Chrome.

Build​

DataHub Frontend is already built as part of top level build:

./gradlew build

However, if you only want to build DataHub Frontend specifically:

./gradlew :datahub-frontend:dist

Dependencies​

Before starting DataHub Frontend, you need to make sure that DataHub GMS and all its dependencies have already started and running.

Start via Docker image​

Quickest way to try out DataHub Frontend is running the Docker image.

Start via command line​

If you do modify things and want to try it out quickly without building the Docker image, you can also run the application directly from command line after a successful build:

cd datahub-frontend/run && ./run-local-frontend

Checking out DataHub UI​

After starting your application in one of the two ways mentioned above, you can connect to it by typing below into your favorite web browser:

http://localhost:9002

To be able to sign in, you need to provide your user name. The default account is datahub, password datahub.

Authentication​

DataHub frontend leverages Java Authentication and Authorization Service (JAAS) to perform the authentication. By default we provided a DummyLoginModule which will accept any username/password combination. You can update jaas.conf to match your authentication requirement. For example, use the following config for LDAP-based authentication,

WHZ-Authentication {
  com.sun.security.auth.module.LdapLoginModule sufficient
  userProvider="ldaps://<host>:636/dc=<domain>"
  authIdentity="{USERNAME}"
  userFilter="(&(objectClass=person)(uid={USERNAME}))"
  java.naming.security.authentication="simple"
  debug="false"
  useSSL="true";
};

Authentication in React​

The React app supports both JAAS as described above and separately OIDC authentication. To learn about configuring OIDC for React, see the OIDC in React document.

Token ID response header​

Every response proxied to the Metadata Service carries an X-DH-JTI header holding the jti (JWT ID) claim of the access token or UI session token that made the request. The Metadata Service assigns a random UUID as the jti when it issues a token, so the value identifies the token but cannot be used to authenticate, and the caller already holds the token it was read from. A reverse proxy or service mesh in front of the frontend can log the header to attribute requests to a specific token (for example, to audit where a leaked token was used) and may strip it before responding to clients. The header is omitted when the request carries no JWT bearer token.

API Debugging​

Most DataHub frontend API endpoints are protected using Play Authentication, which means it requires authentication information stored in the cookie for the request to go through. This makes debugging using curl difficult. One option is to first make a curl call against the /authenticate endpoint and stores the authentication info in a cookie file like this

curl -c cookie.txt -d '{"username":"datahub", "password":"datahub"}' -H 'Content-Type: application/json' http://localhost:9002/authenticate

You can then make all subsequent calls using the same cookie file to pass the authentication check.

curl -b cookie.txt "http://localhost:9001/api/v2/search?type=dataset&input=page"