Secured data access in virtual data processing

A method comprising:

• intercepting, by a first data agent in a first virtual compute node, a first request from an application in the first virtual compute node to access a secured data source for a requester, the first virtual compute node being one of a plurality of virtual compute nodes of a compute cluster in a virtual data processing environment including a plurality of secured data sources that are accessible by the plurality of virtual compute nodes, the secured data source being secured with a security authentication technology;
• forwarding, by the first data agent, the first request to a first data daemon outside the first virtual compute node;
• validating, by the first data daemon with a credential authority, a credential from a current application context associated with the first request;
• based on successfully validating the credential:
• authenticating, by the first data daemon, the requester using the security authentication technology for the secured data source,
• establishing a connection with the secured data source for access by the application to the secured data source, and
• generating, by the first data daemon, a delegation token comprising a value based on an authentication secret of the secured data source;
• sending the delegation token to a second virtual compute node of the plurality of virtual compute nodes;
• sending, by a second data agent in the second virtual compute node, the delegation token to a second data daemon for a second request to access the secured data source intercepted by the second data agent;
• validating, by the second data daemon, the delegation token from the second data agent;
• and
• based on validating the delegation token, authenticating, by the second data daemon, with the secured data source for the requester that initiated the second request.

A computing system comprising:

• a processor;
• and
• a non-transitory storage medium storing instructions executable on the processor to:
• intercept, by a first data agent in a first virtual compute node, a first request from an application in the first virtual compute node to access a secured data source for a requester, the first virtual compute node being one of a plurality of virtual compute nodes of a compute cluster in a virtual data processing environment including a plurality of secured data sources that are accessible by the plurality of virtual compute nodes, the secured data source being secured with a security authentication technology;
• forward, by the first data agent, the first request to a first data daemon outside the first virtual compute node;
• validate, by the first data daemon with a credential authority, a credential from a current application context associated with the first request;
• and
• based on successfully validating the credential:
• authenticate, by the first data daemon, the requester using the security authentication technology for the secured data source,
• establish a connection with the secured data source for access by the application to the secured data source, and
• generate, by the first data daemon, a delegation token comprising a value based on an authentication secret of the secured data source;
• send the delegation token to a second virtual compute node of the plurality of virtual compute nodes;
• send, by a second data agent in the second virtual compute node, the delegation token to a second data daemon for a second request to access the secured data source intercepted by the second data agent;
• validate, by the second data daemon, the delegation token from the second data agent;
• and
• based on validating the delegation token, authenticate, by the second data daemon, with the secured data source for the requester that initiated the second request.