hadoop-common-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Chris Nauroth (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (HADOOP-13081) add the ability to create multiple UGIs/subjects from one kerberos login
Date Mon, 25 Jul 2016 22:23:20 GMT

    [ https://issues.apache.org/jira/browse/HADOOP-13081?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15392755#comment-15392755
] 

Chris Nauroth commented on HADOOP-13081:
----------------------------------------

Hello [~sershe].  Some feedback on the current patch:

# On 6/11, I commented asking if it's feasible to add a unit test to {{TestUserGroupInformation}}.
 What are your thoughts?
# FindBugs flagged that it's a method named {{clone}}, but it doesn't implement {{Cloneable}}
and doesn't follow the traditional recipe for a {{clone}} method (e.g. calling the superclass).
 Maybe rename the method to something like {{copySubject}}?
# Could you add to the JavaDocs describing the intent of this method?  You could describe
how it supports adding different credentials to different UGI instances without forcing them
all to re-authenticate through Kerberos. 
# Checkstyle flagged that there were a few lines longer than 80 characters.


> add the ability to create multiple UGIs/subjects from one kerberos login
> ------------------------------------------------------------------------
>
>                 Key: HADOOP-13081
>                 URL: https://issues.apache.org/jira/browse/HADOOP-13081
>             Project: Hadoop Common
>          Issue Type: Bug
>            Reporter: Sergey Shelukhin
>            Assignee: Sergey Shelukhin
>         Attachments: HADOOP-13081.01.patch, HADOOP-13081.patch
>
>
> We have a scenario where we log in with kerberos as a certain user for some tasks, but
also want to add tokens to the resulting UGI that would be specific to each task. We don't
want to authenticate with kerberos for every task.
> I am not sure how this can be accomplished with the existing UGI interface. Perhaps some
clone method would be helpful, similar to createProxyUser minus the proxy stuff; or it could
just relogin anew from ticket cache. getUGIFromTicketCache seems like the best option in existing
code, but there doesn't appear to be a consistent way of handling ticket cache location -
the above method, that I only see called in test, is using a config setting that is not used
anywhere else, and the env variable for the location that is used in the main ticket cache
related methods is not set uniformly on all paths - therefore, trying to find the correct
ticket cache and passing it via the config setting to getUGIFromTicketCache seems even hackier
than doing the clone via reflection ;) Moreover, getUGIFromTicketCache ignores the user parameter
on the main path - it logs a warning for multiple principals and then logs in with first available.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org


Mime
View raw message