ambari-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Hudson (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (AMBARI-11780) Ambari creation of oozie/conf/adminusers.txt breaks oozie role seperation for Kerberos
Date Mon, 22 Jun 2015 23:40:02 GMT

    [ https://issues.apache.org/jira/browse/AMBARI-11780?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14596855#comment-14596855
] 

Hudson commented on AMBARI-11780:
---------------------------------

SUCCESS: Integrated in Ambari-branch-2.1 #90 (See [https://builds.apache.org/job/Ambari-branch-2.1/90/])
Revert "AMBARI-11780. Ambari creation of oozie/conf/adminusers.txt breaks oozie role seperation
for Kerberos (rlevas)" (rlevas: http://git-wip-us.apache.org/repos/asf?p=ambari.git&a=commit&h=7cc0c4f26510a6d04a779e7a94774089b4801a67)
* ambari-server/src/test/python/stacks/2.2/configs/oozie-upgrade.json
* ambari-server/src/test/python/stacks/2.2/configs/oozie-downgrade.json
* ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/package/scripts/params_linux.py
* ambari-server/src/test/python/stacks/2.0.6/configs/default.json
* pom.xml
* ambari-server/src/test/python/stacks/2.0.6/configs/secured.json
* ambari-server/src/test/python/stacks/2.0.6/configs/default_oozie_mysql.json
* ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/package/templates/adminusers.txt.j2
* ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-env.xml
* ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/package/scripts/oozie.py
AMBARI-11780. Ambari creation of oozie/conf/adminusers.txt breaks oozie role seperation for
Kerberos (rlevas) (rlevas: http://git-wip-us.apache.org/repos/asf?p=ambari.git&a=commit&h=11fcc29e6da3849e6c58d2532a263e26e3b277b7)
* ambari-server/src/test/python/stacks/2.0.6/configs/default.json
* ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/package/scripts/oozie.py
* ambari-server/src/test/python/stacks/2.2/configs/oozie-downgrade.json
* ambari-server/src/test/python/stacks/2.0.6/configs/default_oozie_mysql.json
* ambari-server/src/test/python/stacks/2.0.6/configs/secured.json
* ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/configuration/oozie-env.xml
* ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/package/templates/adminusers.txt.j2
* ambari-server/src/test/python/stacks/2.2/configs/oozie-upgrade.json
* ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/package/scripts/params_linux.py


> Ambari creation of oozie/conf/adminusers.txt breaks oozie role seperation for Kerberos
> --------------------------------------------------------------------------------------
>
>                 Key: AMBARI-11780
>                 URL: https://issues.apache.org/jira/browse/AMBARI-11780
>             Project: Ambari
>          Issue Type: Bug
>          Components: ambari-server
>    Affects Versions: 2.0.0, 2.0.1, 2.1.0
>            Reporter: Robert Levas
>            Assignee: Robert Levas
>            Priority: Critical
>              Labels: kerberos
>             Fix For: 2.1.0
>
>         Attachments: AMBARI-11780_01.patch, AMBARI-11780_02.patch
>
>
> Oozie restart from Ambari rewrites oozie/conf/adminusers.txt
> To support role separation for Kerberos, we need an additional line added to the end
of this file.
> The new line is:
> {noformat}
> oozie-admin
> {noformat}
> The new file should be generated as:
> {code}
> #
> # Licensed to the Apache Software Foundation (ASF) under one
> # or more contributor license agreements.  See the NOTICE file
> # distributed with this work for additional information
> # regarding copyright ownership.  The ASF licenses this file
> # to you under the Apache License, Version 2.0 (the
> # "License"); you may not use this file except in compliance
> # with the License.  You may obtain a copy of the License at
> #
> #   http://www.apache.org/licenses/LICENSE-2.0
> #
> # Unless required by applicable law or agreed to in writing, software
> # distributed under the License is distributed on an "AS IS" BASIS,
> # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
> # See the License for the specific language governing permissions and
> # limitations under the License.
> #
> # Users should be set using following rules:
> #
> #     One user name per line
> #     Empty lines and lines starting with '#' are ignored
> oozie
> oozie-admin
> {code}
> *Solution*
> 1. Replace
> {code:title=common-services/OOZIE/4.0.0.2.0/package/templates/adminusers.txt.j2}
> {{oozie_user}}
> {code}
> with 
> {code:title=common-services/OOZIE/4.0.0.2.0/package/templates/adminusers.txt.j2}
> {% if oozie_admin_users %}
> {% for oozie_admin_user in oozie_admin_users.split(',') %}
>   {{oozie_admin_user}}
> {% endfor %}
> {% endif %}
> {code}
> 2. Add new property
> {code:title=common-services/OOZIE/4.0.0.2.0/configuration/oozie-env.xml}
>   <property>
>     <name>oozie_admin_users</name>
>     <value>oozie, oozie-admin</value>
>     <description>Oozie admin users.</description>
>   </property>
> {code}
> 3. If the admin user list needs to change when enabling Kerberos, oozie-env/oozie_admin_users
can be set in Oozie's Kerberos descriptor (kerberos.json).



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message