Mailing-List: contact common-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: common-issues@hadoop.apache.org
Date: Tue, 29 Mar 2016 10:47:25 +0000 (UTC)
From: "Steve Loughran (JIRA)" <jira@apache.org>
To: common-issues@hadoop.apache.org
Message-ID: <JIRA.12948684.1457592698000.75008.1459248445736@Atlassian.JIRA>
In-Reply-To: <JIRA.12948684.1457592698000@Atlassian.JIRA>
References: <JIRA.12948684.1457592698000@Atlassian.JIRA>
 <JIRA.12948684.1457592698157@arcas>
Subject: [jira] [Commented] (HADOOP-12911) Upgrade Hadoop MiniKDC with Kerby
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


    [ https://issues.apache.org/jira/browse/HADOOP-12911?page=3Dcom.atlassi=
an.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D15=
215827#comment-15215827 ]=20

Steve Loughran commented on HADOOP-12911:
-----------------------------------------

I really like this code; I like how much simpler the POMs and the internals=
 are getting. We will need people who understand Kerberos to review it thou=
gh; I don't count myself as one.

h2. MiniKdc.java

1. This could be a good time to make MiniKDC a subclass of AbstractService,=
 though it may (will?) break external users. Perhaps we could have a MiniKD=
C service, which the existing MiniKDC code instantiated on its existing lif=
ecycle.


2. If not done already, can the miniconf prefer TCP over UDP? It fails fast=
er.


3. Why does /MiniKdc reset "sun.security.krb5.debug"? If set, I'd like it t=
o stay that way. You could use is current value as the default when reading
the configuration .

4.=20

{code}
InputStream is =3D getResourceAsStream("minikdc-krb5.conf");
{code}
Add a {{Preconditions}} check that this isn't null.

5. need a check after {{transport =3D conf.getProperty(TRANSPORT);}} for a =
null value?

6. Teardown. Again, I'd like the JVM properties to be left unaltered. At th=
e very least: remember their originals. KDiag manipulates these in its own =
production code.

in {{TestClientRMTokens.java}} the realm is changed. does that make the com=
ment on line 122 incorrect?


> Upgrade Hadoop MiniKDC with Kerby
> ---------------------------------
>
>                 Key: HADOOP-12911
>                 URL: https://issues.apache.org/jira/browse/HADOOP-12911
>             Project: Hadoop Common
>          Issue Type: Improvement
>          Components: test
>            Reporter: Jiajia Li
>            Assignee: Jiajia Li
>         Attachments: HADOOP-12911-v1.patch, HADOOP-12911-v2.patch, HADOOP=
-12911-v3.patch, HADOOP-12911-v4.patch
>
>
> As discussed in the mailing list, we=E2=80=99d like to introduce Apache K=
erby into Hadoop. Initially it=E2=80=99s good to start with upgrading Hadoo=
p MiniKDC with Kerby offerings. Apache Kerby (https://github.com/apache/dir=
ectory-kerby), as an Apache Directory sub project, is a Java Kerberos bindi=
ng. It provides a SimpleKDC server that borrowed ideas from MiniKDC and imp=
lemented all the facilities existing in MiniKDC. Currently MiniKDC depends =
on the old Kerberos implementation in Directory Server project, but the imp=
lementation is stopped being maintained. Directory community has a plan to =
replace the implementation using Kerby. MiniKDC can use Kerby SimpleKDC dir=
ectly to avoid depending on the full of Directory project. Kerby also provi=
des nice identity backends such as the lightweight memory based one and the=
 very simple json one for easy development and test environments.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)