[RFC] Kerberos Support for Hugegraph

[hingu-8103]

Hi HugeGraph Dev Community,

I'd like to open a discussion on a proposed enhancement: Kerberos Support for Apache HugeGraph.

Motivation

In many enterprise environments, Kerberos is the standard authentication mechanism for SSO and
centralized identity management.
Adding native Kerberos support would make HugeGraph easier to adopt in Kerberos-first deployments
while keeping existing authentication flows intact.

Proposal

Introduce Kerberos support as an opt-in, additive capability across HugeGraph interfaces,
delivered in phases.
The implementation will use Java's built-in org.ietf.jgss.* (GSSAPI) and
javax.security.auth.* (JAAS), without adding new third-party dependencies.

Key Highlights

• Backward compatible: existing auth behavior remains unchanged unless Kerberos is enabled
• Phased delivery: REST first, then Gremlin WebSocket, Cypher API, and SDKs/toolkits
• Reusable foundation: server-side token validation and principal mapping are implemented once and reused
• Enterprise-friendly: fits existing Kerberos/SSO environments

Phase-wise Plan

Phase 1 — REST API:
Add Negotiate auth on the server and Kerberos support in the REST client.

Phase 2 — Gremlin WebSocket:
Add SASL GSSAPI support for Gremlin connections.

Phase 3 — Cypher API:
Add Kerberos handling for Cypher auth flow and client config.

Phase 4 — SDKs / Toolkits:
Add Kerberos support to language-specific clients and CLI tools.

---

RFC doc: Kerberos Auth Support for HugeGraph
I welcome feedback on scope, sequencing, and rollout expectations.

Best regards,
Dev Hingu

[hingu-8103]

Here's the link to the commit for PoC. (This PoC is generated with the help of github copilot).