accumulo-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From joshelser <...@git.apache.org>
Subject [GitHub] accumulo issue #273: ACCUMULO-4665 Use UGI with real Kerberos credentials
Date Mon, 26 Jun 2017 20:59:32 GMT
Github user joshelser commented on the issue:

    https://github.com/apache/accumulo/pull/273
  
    > I notice this change was targeted to 1.7. Is there any impact from this change on
using 1.7.3 server with 1.7.4 client and visa versa?
    
    There is obviously the change in implementation that this introduces. However, I believe
it is purely in the "bugfix" realm. If you ran my test without the KerberosToken patch, you'd
get an error in KerberosToken about mis-matched principals -- if you squashed that, you would
get a `GSS initiate failed` error when you try to make the Accumulo RPC. All of this comes
from our poor handling of this scenario.
    
    To the best of my knowledge, there wouldn't be any negative aspect to this change WRT
cross-version support aside from the implicit change in how the clients operate. As long as
the RPC was set up in such a way that it _could_ theoretically work (at the SASL/Kerberos
level) it should continue to work.


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---

Mime
View raw message