Mailing-List: contact issues-help@ambari.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@ambari.apache.org
Date: Thu, 2 Nov 2017 17:40:00 +0000 (UTC)
From: "Hudson (JIRA)" <jira@apache.org>
To: issues@ambari.apache.org
Message-ID: <JIRA.13111504.1508783499000.133976.1509644400338@Atlassian.JIRA>
In-Reply-To: <JIRA.13111504.1508783499000@Atlassian.JIRA>
References: <JIRA.13111504.1508783499000@Atlassian.JIRA> <JIRA.13111504.1508783499606@jira-lw-us.apache.org>
Subject: [jira] [Commented] (AMBARI-22293) Improve KDC integration
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Thu, 02 Nov 2017 17:40:06 -0000


    [ https://issues.apache.org/jira/browse/AMBARI-22293?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16236232#comment-16236232 ] 

Hudson commented on AMBARI-22293:
---------------------------------

FAILURE: Integrated in Jenkins build Ambari-trunk-Commit #8336 (See [https://builds.apache.org/job/Ambari-trunk-Commit/8336/])
AMBARI-22293. Improve KDC integration (rlevas) (rlevas: [http://git-wip-us.apache.org/repos/asf?p=ambari.git&a=commit&h=f844e5f3f952b57d790a238f0bafaf7d5ba1ddca])
* (edit) ambari-server/src/test/java/org/apache/ambari/server/serveraction/kerberos/KerberosServerActionTest.java
* (edit) ambari-server/src/test/python/stacks/2.6/configs/ranger-admin-secured.json
* (edit) ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/CreatePrincipalsServerAction.java
* (add) ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/KDCKerberosOperationHandler.java
* (edit) ambari-server/src/test/java/org/apache/ambari/server/serveraction/kerberos/KerberosOperationHandlerTest.java
* (edit) ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/ADKerberosOperationHandler.java
* (edit) ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/IPAKerberosOperationHandler.java
* (edit) ambari-server/src/main/java/org/apache/ambari/server/upgrade/UpgradeCatalog300.java
* (edit) ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-10/configuration/kerberos-env.xml
* (edit) ambari-server/docs/security/kerberos/kerberos_service.md
* (edit) ambari-server/src/main/resources/stacks/PERF/1.0/services/KERBEROS/configuration/kerberos-env.xml
* (edit) ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/MITKerberosOperationHandler.java
* (edit) ambari-web/app/controllers/main/admin/kerberos/step2_controller.js
* (edit) ambari-server/src/test/python/stacks/2.5/configs/ranger-admin-secured.json
* (edit) ambari-server/src/test/java/org/apache/ambari/server/serveraction/kerberos/IPAKerberosOperationHandlerTest.java
* (edit) ambari-server/src/test/java/org/apache/ambari/server/serveraction/kerberos/ADKerberosOperationHandlerTest.java
* (edit) ambari-server/src/test/resources/PreconfigureActionTest_cluster_config.json
* (edit) ambari-server/src/test/java/org/apache/ambari/server/upgrade/UpgradeCatalog300Test.java
* (edit) ambari-server/src/test/java/org/apache/ambari/server/controller/KerberosHelperTest.java
* (edit) ambari-server/src/test/python/stacks/2.5/configs/ranger-kms-secured.json
* (edit) ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/DestroyPrincipalsServerAction.java
* (edit) ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/KerberosOperationHandler.java
* (edit) ambari-server/src/main/resources/common-services/KERBEROS/1.10.3-30/configuration/kerberos-env.xml
* (add) ambari-server/src/test/java/org/apache/ambari/server/serveraction/kerberos/KDCKerberosOperationHandlerTest.java
* (edit) ambari-server/src/test/java/org/apache/ambari/server/serveraction/kerberos/MITKerberosOperationHandlerTest.java


> Improve KDC integration
> -----------------------
>
>                 Key: AMBARI-22293
>                 URL: https://issues.apache.org/jira/browse/AMBARI-22293
>             Project: Ambari
>          Issue Type: Task
>          Components: ambari-server
>    Affects Versions: 3.0.0
>            Reporter: Robert Levas
>            Assignee: Robert Levas
>            Priority: Major
>              Labels: kerberos
>             Fix For: 3.0.0
>
>         Attachments: AMBARI-22293_trunk_01.patch, AMBARI-22293_trunk_02.patch
>
>
> Improve KDC integration by making the interfaces more consistent with each other.
> *Notes:*
> * When using the MIT KDC or IPA options, the {{kerberos-env/admin_server_host}} value *must be the fully qualified domain name* (FQDN) of the host were the KDC administrator service is. 
> * When connecting to the MIT KDC and IPA server, a username a password is not used to authenticate using the kadmin utility.  A Kerberos ticket is first acquired and that is used for authentication.
> * When creating Kerberos identities using the MIT KDC and IPA handlers, the Ambari-generated password is not used.  All password's for principals in the MIT KDC and IP server are generated randomly by the KDC.
> * Removed {{kerberos-env/set_password_expiry}} and {{kerberos-env/password_chat_timeout}} properties since they are no longer needed
> * Changed {{kerberos-env/groups}} to {{kerberos-env/ipa_user_groups}} to be more explicit in how the property is used.
> * The setPassword implementation for the MIT KDC and IPA handlers do nothing except check to see if the relevant principal exists. This is to maintain backward compatibility with previous implementations.  


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)