Mailing-List: contact common-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: common-issues@hadoop.apache.org
Date: Sat, 13 Sep 2014 18:34:34 +0000 (UTC)
From: "Allen Wittenauer (JIRA)" <jira@apache.org>
To: common-issues@hadoop.apache.org
Message-ID: <JIRA.12636348.1363003127000.28112.1410633274570@Atlassian.JIRA>
In-Reply-To: <JIRA.12636348.1363003127000@Atlassian.JIRA>
References: <JIRA.12636348.1363003127000@Atlassian.JIRA>
 <JIRA.12636348.1363003127597@arcas>
Subject: [jira] [Updated] (HADOOP-9392) Token based authentication and
 Single Sign On
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


     [ https://issues.apache.org/jira/browse/HADOOP-9392?page=3Dcom.atlassi=
an.jira.plugin.system.issuetabpanels:all-tabpanel ]

Allen Wittenauer updated HADOOP-9392:
-------------------------------------
    Fix Version/s:     (was: 3.0.0)

> Token based authentication and Single Sign On
> ---------------------------------------------
>
>                 Key: HADOOP-9392
>                 URL: https://issues.apache.org/jira/browse/HADOOP-9392
>             Project: Hadoop Common
>          Issue Type: New Feature
>          Components: security
>            Reporter: Kai Zheng
>            Assignee: Yi Liu
>         Attachments: TokenAuth-breakdown.pdf, token-based-authn-plus-sso-=
v2.0.pdf, token-based-authn-plus-sso.pdf
>
>
> This is an umbrella entry for one of project Rhino=E2=80=99s topic, for d=
etails of project Rhino, please refer to https://github.com/intel-hadoop/pr=
oject-rhino/. The major goal for this entry as described in project Rhino w=
as=20
> =20
> =E2=80=9CCore, HDFS, ZooKeeper, and HBase currently support Kerberos auth=
entication at the RPC layer, via SASL. However this does not provide valuab=
le attributes such as group membership, classification level, organizationa=
l identity, or support for user defined attributes. Hadoop components must =
interrogate external resources for discovering these attributes and at scal=
e this is problematic. There is also no consistent delegation model. HDFS h=
as a simple delegation capability, and only Oozie can take limited advantag=
e of it. We will implement a common token based authentication framework to=
 decouple internal user and service authentication from external mechanisms=
 used to support it (like Kerberos)=E2=80=9D
> =20
> We=E2=80=99d like to start our work from Hadoop-Common and try to provide=
 common facilities by extending existing authentication framework which sup=
port:
> 1.=09Pluggable token provider interface=20
> 2.=09Pluggable token verification protocol and interface
> 3.=09Security mechanism to distribute secrets in cluster nodes
> 4.=09Delegation model of user authentication


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)