multi-tenant secure user impersonation

securityexternal call

UserCredentials -> ImpersonatedSecurityContext

Proxy execution requests to cluster managers and storage using the end-user's identity rather than the gateway's system user.

Problem it solves

Gateway-level execution bypasses file-level (HDFS) and queue-level (YARN) access controls.

Consumes

UserCredentials

Emits

ImpersonatedSecurityContext

Establishes

DelegatedStorageAccess

Distilled from 1 source

The real projects this mechanism was found in. Attribution is the point — this is how the best teams actually do it.