Mailing-List: contact dev-help@ambari.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@ambari.apache.org
Content-Type: multipart/alternative;
 boundary="===============0129456472938998772=="
MIME-Version: 1.0
Subject: Re: Review Request 27208: Ambari: Add oozie install user as an Oozie
 admin user
From: "Dmytro Sen" <dsen@hortonworks.com>
To: "Andrew Onischuk" <aonishuk@hortonworks.com>,
 "Dmytro Sen" <dsen@hortonworks.com>
Cc: "Ambari" <dev@ambari.apache.org>
Date: Sun, 26 Oct 2014 16:24:47 -0000
Message-ID: <20141026162447.7138.40914@reviews.apache.org>
Auto-Submitted: auto-generated
Sender: "Dmytro Sen" <noreply@reviews.apache.org>
References: <20141026160618.7138.73070@reviews.apache.org>
In-Reply-To: <20141026160618.7138.73070@reviews.apache.org>
Reply-To: "Dmytro Sen" <dsen@hortonworks.com>

--===============0129456472938998772==
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/27208/#review58560
-----------------------------------------------------------

Ship it!


Ship It!

- Dmytro Sen


On Окт. 26, 2014, 4:06 п.п., Andrew Onischuk wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/27208/
> -----------------------------------------------------------
> 
> (Updated Окт. 26, 2014, 4:06 п.п.)
> 
> 
> Review request for Ambari, Andrew Onischuk and Dmytro Sen.
> 
> 
> Bugs: AMBARI-7976
>     https://issues.apache.org/jira/browse/AMBARI-7976
> 
> 
> Repository: ambari
> 
> 
> Description
> -------
> 
> Oozie has an authorization model for admin access to oozie facilities. Oozie
> admin users
> 
>   * have write access to all jobs
>   * have write access to admin operations
> 
> When authorization server security is enabled by config property  
> oozie.service.AuthorizationService.authorization.enabled (which is set to true
> in our installations - the default is false), then admin users are determined
> by either membership in a group identified by the property
> oozie.service.AuthorizationService.admin.groups.
> 
> Since we don't set either of them, we expect users to set the admin usernames
> in the file /etc/oozie/conf/adminusers.txt
> 
> See [Oozie User Authorization Configuration](https://oozie.apache.org/docs/4.0
> .0/AG_Install.html#User_Authorization_Configuration) for more details on admin
> user configuration
> 
> Because we want to do sharelib update operations which are write access
> operations, the user performing these should be an Oozie admin user. If not,
> the admin operation will fail.
> 
> We should explicitly add the oozie install user as the admin user by adding
> the user to adminusers.txt
> 
> This feature is also needed for rolling upgrade scenarios to explicitly update
> sharelib after upgrading the servers.
> 
> 
> Diffs
> -----
> 
>   ambari-common/src/main/python/resource_management/libraries/functions/__init__.py 3d92d64 
>   ambari-server/src/main/resources/stacks/HDP/2.0.6/services/OOZIE/metainfo.xml 9d4247e 
>   ambari-server/src/main/resources/stacks/HDP/2.0.6/services/OOZIE/package/scripts/oozie.py bba2e09 
>   ambari-server/src/main/resources/stacks/HDP/2.0.6/services/OOZIE/package/scripts/params.py 3960904 
>   ambari-server/src/main/resources/stacks/HDP/2.0.6/services/OOZIE/package/templates/adminusers.txt.j2 PRE-CREATION 
>   ambari-server/src/main/resources/stacks/HDP/2.2/services/OOZIE/configuration/oozie-site.xml 4a8eab7 
>   ambari-server/src/test/python/stacks/2.0.6/OOZIE/test_oozie_client.py 7afbf96 
> 
> Diff: https://reviews.apache.org/r/27208/diff/
> 
> 
> Testing
> -------
> 
> mvn clean test
> 
> 
> Thanks,
> 
> Andrew Onischuk
> 
>


--===============0129456472938998772==--