Mailing-List: contact common-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: common-issues@hadoop.apache.org
Date: Tue, 9 Jul 2013 18:57:52 +0000 (UTC)
From: "James C. Wu (JIRA)" <jira@apache.org>
To: common-issues@hadoop.apache.org
Message-ID: <JIRA.12636348.1363003127597.20563.1373396272388@arcas>
In-Reply-To: <JIRA.12636348.1363003127597@arcas>
References: <JIRA.12636348.1363003127597@arcas>
Subject: [jira] [Commented] (HADOOP-9392) Token based authentication and
 Single Sign On
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


    [ https://issues.apache.org/jira/browse/HADOOP-9392?page=3Dcom.atlassia=
n.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D137=
03646#comment-13703646 ]=20

James C. Wu commented on HADOOP-9392:
-------------------------------------

On page 9 of the new document, Hadoop web browser access, I am concerned ab=
out step 7. When the browser authenticates to the remote Idp, and forwards =
the results to the TAS for Hadoop identity token, how can TAS be sure that =
the authentication result sent by the browser is not faked?


               =20
> Token based authentication and Single Sign On
> ---------------------------------------------
>
>                 Key: HADOOP-9392
>                 URL: https://issues.apache.org/jira/browse/HADOOP-9392
>             Project: Hadoop Common
>          Issue Type: New Feature
>          Components: security
>            Reporter: Kai Zheng
>            Assignee: Kai Zheng
>             Fix For: 3.0.0
>
>         Attachments: token-based-authn-plus-sso.pdf, token-based-authn-pl=
us-sso-v2.0.pdf
>
>
> This is an umbrella entry for one of project Rhino=E2=80=99s topic, for d=
etails of project Rhino, please refer to https://github.com/intel-hadoop/pr=
oject-rhino/. The major goal for this entry as described in project Rhino w=
as=20
> =20
> =E2=80=9CCore, HDFS, ZooKeeper, and HBase currently support Kerberos auth=
entication at the RPC layer, via SASL. However this does not provide valuab=
le attributes such as group membership, classification level, organizationa=
l identity, or support for user defined attributes. Hadoop components must =
interrogate external resources for discovering these attributes and at scal=
e this is problematic. There is also no consistent delegation model. HDFS h=
as a simple delegation capability, and only Oozie can take limited advantag=
e of it. We will implement a common token based authentication framework to=
 decouple internal user and service authentication from external mechanisms=
 used to support it (like Kerberos)=E2=80=9D
> =20
> We=E2=80=99d like to start our work from Hadoop-Common and try to provide=
 common facilities by extending existing authentication framework which sup=
port:
> 1.=09Pluggable token provider interface=20
> 2.=09Pluggable token verification protocol and interface
> 3.=09Security mechanism to distribute secrets in cluster nodes
> 4.=09Delegation model of user authentication

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrato=
rs
For more information on JIRA, see: http://www.atlassian.com/software/jira