flink-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (FLINK-3930) Implement Service-Level Authorization
Date Thu, 01 Sep 2016 14:52:21 GMT

    [ https://issues.apache.org/jira/browse/FLINK-3930?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15455662#comment-15455662
] 

ASF GitHub Bot commented on FLINK-3930:
---------------------------------------

Github user rmetzger commented on the issue:

    https://github.com/apache/flink/pull/2425
  
    I manually tested the code. Taskmanagers are properly rejected on missmatching cookies,
it works when they match.
    
    One thing I found was that the error reporting is not very good:
    
    ```
    robert@robert-da ...k-1.2-SNAPSHOT-bin/flink-1.2-SNAPSHOT (git)-[FLINK-3930] % ./bin/flink
run -k asdf ./examples/batch/WordCount.jar
    Cluster configuration: Standalone cluster with JobManager at /127.0.0.1:6123
    Using address 127.0.0.1:6123 to connect to JobManager.
    JobManager web interface address http://127.0.0.1:8081
    Starting execution of program
    Executing WordCount example with default input data set.
    Use --input to specify file input.
    Printing result to stdout. Use --output to specify output path.
    Submitting job with JobID: 0816b6a3427cdcfc1160655edc2cef09. Waiting for job completion.
    
    ------------------------------------------------------------
     The program finished with the following exception:
    
    org.apache.flink.client.program.ProgramInvocationException: The program execution failed:
Couldn't retrieve the JobExecutionResult from the JobManager.
    	at org.apache.flink.client.program.ClusterClient.run(ClusterClient.java:404)
    	at org.apache.flink.client.program.StandaloneClusterClient.submitJob(StandaloneClusterClient.java:92)
    	at org.apache.flink.client.program.ClusterClient.run(ClusterClient.java:380)
    	at org.apache.flink.client.program.ClusterClient.run(ClusterClient.java:367)
    	at org.apache.flink.client.program.ContextEnvironment.execute(ContextEnvironment.java:61)
    	at org.apache.flink.api.java.ExecutionEnvironment.execute(ExecutionEnvironment.java:896)
    	at org.apache.flink.api.java.DataSet.collect(DataSet.java:410)
    	at org.apache.flink.api.java.DataSet.print(DataSet.java:1605)
    	at org.apache.flink.examples.java.wordcount.WordCount.main(WordCount.java:92)
    	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    	at java.lang.reflect.Method.invoke(Method.java:498)
    	at org.apache.flink.client.program.PackagedProgram.callMainMethod(PackagedProgram.java:509)
    	at org.apache.flink.client.program.PackagedProgram.invokeInteractiveModeForExecution(PackagedProgram.java:403)
    	at org.apache.flink.client.program.ClusterClient.run(ClusterClient.java:322)
    	at org.apache.flink.client.CliFrontend.executeProgram(CliFrontend.java:775)
    	at org.apache.flink.client.CliFrontend.run(CliFrontend.java:251)
    	at org.apache.flink.client.CliFrontend.parseParameters(CliFrontend.java:1003)
    	at org.apache.flink.client.CliFrontend.main(CliFrontend.java:1046)
    Caused by: org.apache.flink.runtime.client.JobExecutionException: Couldn't retrieve the
JobExecutionResult from the JobManager.
    	at org.apache.flink.runtime.client.JobClient.awaitJobResult(JobClient.java:292)
    	at org.apache.flink.runtime.client.JobClient.submitJobAndWait(JobClient.java:377)
    	at org.apache.flink.client.program.ClusterClient.run(ClusterClient.java:400)
    	... 19 more
    Caused by: org.apache.flink.runtime.client.JobClientActorConnectionTimeoutException: Lost
connection to the JobManager.
    	at org.apache.flink.runtime.client.JobClientActor.handleMessage(JobClientActor.java:207)
    	at org.apache.flink.runtime.akka.FlinkUntypedActor.handleLeaderSessionID(FlinkUntypedActor.java:90)
    	at org.apache.flink.runtime.akka.FlinkUntypedActor.onReceive(FlinkUntypedActor.java:70)
    	at akka.actor.UntypedActor$$anonfun$receive$1.applyOrElse(UntypedActor.scala:167)
    	at akka.actor.Actor$class.aroundReceive(Actor.scala:465)
    	at akka.actor.UntypedActor.aroundReceive(UntypedActor.scala:97)
    	at akka.actor.ActorCell.receiveMessage(ActorCell.scala:516)
    	at akka.actor.ActorCell.invoke(ActorCell.scala:487)
    	at akka.dispatch.Mailbox.processMailbox(Mailbox.scala:254)
    	at akka.dispatch.Mailbox.run(Mailbox.scala:221)
    	at akka.dispatch.Mailbox.exec(Mailbox.scala:231)
    	at scala.concurrent.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260)
    	at scala.concurrent.forkjoin.ForkJoinPool$WorkQueue.pollAndExecAll(ForkJoinPool.java:1253)
    	at scala.concurrent.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1346)
    	at scala.concurrent.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979)
    	at scala.concurrent.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107)
    ```
    
    But I think that this is akka's fault, not ours.



> Implement Service-Level Authorization
> -------------------------------------
>
>                 Key: FLINK-3930
>                 URL: https://issues.apache.org/jira/browse/FLINK-3930
>             Project: Flink
>          Issue Type: New Feature
>          Components: Security
>            Reporter: Eron Wright 
>            Assignee: Vijay Srinivasaraghavan
>              Labels: security
>   Original Estimate: 672h
>  Remaining Estimate: 672h
>
> _This issue is part of a series of improvements detailed in the [Secure Data Access|https://docs.google.com/document/d/1-GQB6uVOyoaXGwtqwqLV8BHDxWiMO2WnVzBoJ8oPaAs/edit?usp=sharing]
design doc._
> Service-level authorization is the initial authorization mechanism to ensure clients
(or servers) connecting to the Flink cluster are authorized to do so.   The purpose is to
prevent a cluster from being used by an unauthorized user, whether to execute jobs, disrupt
cluster functionality, or gain access to secrets stored within the cluster.
> Implement service-level authorization as described in the design doc.
> - Introduce a shared secret cookie
> - Enable Akka security cookie
> - Implement data transfer authentication
> - Secure the web dashboard



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message