hadoop-common-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Tsz Wo (Nicholas), SZE (JIRA)" <j...@apache.org>
Subject [jira] Commented: (HADOOP-2184) Change RPC to provide secure communication
Date Sat, 10 Nov 2007 20:31:50 GMT

    [ https://issues.apache.org/jira/browse/HADOOP-2184?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12541585
] 

Tsz Wo (Nicholas), SZE commented on HADOOP-2184:
------------------------------------------------

(1) and (3) depends on the security implementation.

For example, if we use Kerberos, then we will use a Kerberos ticket to establish a connection
and use Kerberos session key to encrypt data.  In this case, we create KerberosSocket by a
KerberosSocketFactory and the KerberosSocket will do the rest.

For the simple implementation we are going to do, we send username and group list in plain
text, say, to NameNode.  Then, NameNode trusts all the information are correct.


> Change RPC to provide secure communication
> ------------------------------------------
>
>                 Key: HADOOP-2184
>                 URL: https://issues.apache.org/jira/browse/HADOOP-2184
>             Project: Hadoop
>          Issue Type: New Feature
>          Components: ipc
>    Affects Versions: 0.15.0
>            Reporter: Tsz Wo (Nicholas), SZE
>            Assignee: Raghu Angadi
>             Fix For: 0.16.0
>
>
> In the current version of RPC, there is no authentication or data protection.  We propose
to change the RPC framework, so that secure communication is possible.
> The new RPC should:
> - Compatible with current RPC
> - Allow a pluggable security implementations (see HADOOP-1701)
> - Support both secure and non-secure modes.
> Here is a rough idea:
> - Store security information (e.g. username, keys) in a ticket
> - Use the ticket to establish a RPC connection
> - Create secure sockets by the (subclass of) SocketFactory corresponding to the selected
security implementations
> - Send the data and RPC parameters with the secure sockets
> When authentication is supported, the RPC callee should also initialize caller information
during RPC setup and execute the RPC on the caller's behalf.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.


Mime
View raw message