ambari-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Hudson (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (AMBARI-8542) Provide a way to parse and handle Kerberos descriptors
Date Mon, 08 Dec 2014 23:55:13 GMT

    [ https://issues.apache.org/jira/browse/AMBARI-8542?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14238710#comment-14238710
] 

Hudson commented on AMBARI-8542:
--------------------------------

SUCCESS: Integrated in Ambari-trunk-Commit-docker #416 (See [https://builds.apache.org/job/Ambari-trunk-Commit-docker/416/])
AMBARI-8542. Provide a way to parse and handle Kerberos descriptors (jspeidel: http://git-wip-us.apache.org/repos/asf?p=ambari.git&a=commit&h=e7b8383b5af0a39b2530dbfc24563eefd7f781c7)
* ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/AbstractKerberosDescriptorContainer.java
* ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosDescriptor.java
* ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosIdentityDescriptor.java
* ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosComponentDescriptorTest.java
* ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosServiceDescriptor.java
* ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosPrincipalDescriptorTest.java
* ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosConfigurationDescriptorTest.java
* ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosServiceDescriptorTest.java
* ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosPrincipalDescriptor.java
* ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosIdentityDescriptorTest.java
* ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosConfigurationDescriptor.java
* ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosKeytabDescriptorTest.java
* ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosKeytabDescriptor.java
* ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosDescriptorTest.java
* ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosComponentDescriptor.java
* ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosDescriptorType.java
* ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/AbstractKerberosDescriptor.java


> Provide a way to parse and handle Kerberos descriptors
> ------------------------------------------------------
>
>                 Key: AMBARI-8542
>                 URL: https://issues.apache.org/jira/browse/AMBARI-8542
>             Project: Ambari
>          Issue Type: Task
>          Components: ambari-server, stacks
>    Affects Versions: 2.0.0
>            Reporter: Robert Levas
>            Assignee: Robert Levas
>              Labels: kerberos, kerberos_descriptor, stack
>             Fix For: 2.0.0
>
>         Attachments: AMBARI-8542_01.patch, AMBARI-8542_02.patch, AMBARI-8542_02.patch
>
>
> Provide the ability to read in Kerberos descriptor files (kerberos.json) from the stack
at various levels (stack-level, service-level) and to merge them into a single hierarchy.
 The composite Kerberos descriptor data will be used to control the UI (Kerberos Wizard -
see AMBARI-7450).
> An example stack-level Kerberos Descriptor:
> {code}
> {
>   "properties": {
>     "realm": "${cluster-env/kerberos_domain}",
>     "keytab_dir": "/etc/security/keytabs"
>   },
>   "identities": [
>     {
>       "name": "spnego",
>       "principal": {
>         "value": "HTTP/_HOST@${realm}"
>       },
>       "keytab": {
>         "file": "${keytab_dir}/spnego.service.keytab",
>         "owner": {
>           "name": "root",
>           "access": "r"
>         },
>         "group": {
>           "name": "${cluster-env/user_group}",
>           "access": "r"
>         }
>       }
>     }
>   ],
>   "configurations": [
>   ]
> }
> {code}
> An example service-level Kerberos Descriptor - HDFS:
> {code}
> {
>   "configurations": [
>     {
>       "core-site": {
>         "hadoop.security.authentication": "kerberos",
>         "hadoop.rpc.protection": "authentication; integrity; privacy",
>         "hadoop.security.authorization": "true"
>       }
>     }
>   ],
>   "components": [
>     {
>       "name": "NAMENODE",
>       "identities": [
>         {
>           "name" : "namenode_nn",
>           "principal": {
>             "value": "nn/_HOST@${realm}",
>             "configuration": "hdfs-site/dfs.namenode.kerberos.principal"
>           },
>           "keytab": {
>             "file": "${keytab_dir}/nn.service.keytab",
>             "owner": {
>               "name": "${hadoop-env/hdfs_user}",
>               "access": "r"
>             },
>             "group": {
>               "name": "${cluster-env/user_group}",
>               "access": ""
>             },
>             "configuration": "hdfs-site/dfs.namenode.keytab.file"
>           }
>         },
>         {
>           "name" : "namenode_host",
>           "principal": {
>             "value": "host/_HOST@${realm}",
>             "configuration": "hdfs-site/dfs.namenode.kerberos.https.principal"
>           },
>           "keytab": {
>             "file": "${keytab_dir}/host.keytab",
>             "owner": {
>               "name": "${hadoop-env/hdfs_user}",
>               "access": "r"
>             },
>             "group": {
>               "name": "${cluster-env/user_group}",
>               "access": ""
>             },
>             "configuration": "hdfs-site/dfs.namenode.keytab.file"
>           }
>         },
>         {
>           "name" : "/spnego",
>           "principal": {
>             "configuration": "hdfs-site/dfs.web.authentication.kerberos.principal"
>           },
>           "keytab": {
>             "configuration": "hdfs/dfs.web.authentication.kerberos.keytab"
>           }
>         }
>       ]
>     },
>     {
>       "name": "DATANODE",
>       "identities": [
>         {
>           "name" : "datanode_dn",
>           "principal": {
>             "value": "dn/_HOST@${realm}",
>             "configuration": "hdfs-site/dfs.namenode.kerberos.principal"
>           },
>           "keytab": {
>             "file": "${keytab_dir}/dn.service.keytab",
>             "owner": {
>               "name": "${hadoop-env/hdfs_user}",
>               "access": "r"
>             },
>             "group": {
>               "name": "${cluster-env/user_group}",
>               "access": ""
>             },
>             "configuration": "hdfs-site/dfs.namenode.keytab.file"
>           }
>         },
>         {
>           "name" : "datanode_host",
>           "principal": {
>             "value": "host/_HOST@${realm}",
>             "configuration": "hdfs-site/dfs.datanode.kerberos.https.principal"
>           },
>           "keytab": {
>             "file": "${keytab_dir}/host.keytab.file",
>             "owner": {
>               "name": "${hadoop-env/hdfs_user}",
>               "access": "r"
>             },
>             "group": {
>               "name": "${cluster-env/user_group}",
>               "access": ""
>             },
>             "configuration": "hdfs-site/dfs.namenode.secondary.keytab.file"
>           }
>         }
>       ]
>     },
>     {
>       "name": "SECONDARY_NAMENODE",
>       "identities": [
>         {
>           "name" : "secondary_namenode_nn",
>           "principal": {
>             "value": "nn/_HOST@${realm}",
>             "configuration": "hdfs-site/dfs.namenode.secondary.kerberos.principal"
>           },
>           "keytab": {
>             "file": "${keytab_dir}/snn.service.keytab",
>             "owner": {
>               "name": "${hadoop-env/hdfs_user}",
>               "access": "r"
>             },
>             "group": {
>               "name": "${cluster-env/user_group}",
>               "access": ""
>             },
>             "configuration": "hdfs-site/dfs.namenode.secondary.keytab.file"
>           }
>         },
>         {
>           "name" : "secondary_namenode_host",
>           "principal": {
>             "value": "host/_HOST@${realm}",
>             "configuration": "hdfs-site/dfs.namenode.secondary.kerberos.https.principal"
>           },
>           "keytab": {
>             "file": "${keytab_dir}/host.keytab.file",
>             "owner": {
>               "name": "${hadoop-env/hdfs_user}",
>               "access": "r"
>             },
>             "group": {
>               "name": "${cluster-env/user_group}",
>               "access": ""
>             },
>             "configuration": "hdfs-site/dfs.namenode.secondary.keytab.file"
>           }
>         },
>         {
>           "name" : "/spnego",
>           "principal": {
>             "configuration": "hdfs-site/dfs.web.authentication.kerberos.principal"
>           },
>           "keytab": {
>             "configuration": "hdfs/dfs.web.authentication.kerberos.keytab"
>           }
>         }
>       ]
>     }
>   ]
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message