Mailing-List: contact hdfs-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: hdfs-issues@hadoop.apache.org
Date: Sat, 16 Aug 2014 02:52:18 +0000 (UTC)
From: "Alejandro Abdelnur (JIRA)" <jira@apache.org>
To: hdfs-issues@hadoop.apache.org
Message-ID: <JIRA.12732213.1407294771273.13377.1408157538675@arcas>
In-Reply-To: <JIRA.12732213.1407294771273@arcas>
References: <JIRA.12732213.1407294771273@arcas>
Subject: [jira] [Commented] (HDFS-6826) Plugin interface to enable
 delegation of HDFS authorization assertions
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


    [ https://issues.apache.org/jira/browse/HDFS-6826?page=3Dcom.atlassian.=
jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D14099=
469#comment-14099469 ]=20

Alejandro Abdelnur commented on HDFS-6826:
------------------------------------------

[~sneethiraj], got it, it makes sense.

Next week I would start working on the v2 patch to get it in proper shape. =
As a first cut I would prefer to make things pluggable without altering API=
s. we can work on refining the APIs once we have the desired functionality.=
 Also, something to keep in mind, this plugin API is meant to be used by so=
mebody with very good understanding of the NameNode guts and expected behav=
ior.

> Plugin interface to enable delegation of HDFS authorization assertions
> ----------------------------------------------------------------------
>
>                 Key: HDFS-6826
>                 URL: https://issues.apache.org/jira/browse/HDFS-6826
>             Project: Hadoop HDFS
>          Issue Type: New Feature
>          Components: security
>    Affects Versions: 2.4.1
>            Reporter: Alejandro Abdelnur
>            Assignee: Alejandro Abdelnur
>         Attachments: HDFS-6826-idea.patch, HDFS-6826-idea2.patch, HDFS-68=
26v3.patch, HDFSPluggableAuthorizationProposal-v2.pdf, HDFSPluggableAuthori=
zationProposal.pdf
>
>
> When Hbase data, HiveMetaStore data or Search data is accessed via servic=
es (Hbase region servers, HiveServer2, Impala, Solr) the services can enfor=
ce permissions on corresponding entities (databases, tables, views, columns=
, search collections, documents). It is desirable, when the data is accesse=
d directly by users accessing the underlying data files (i.e. from a MapRed=
uce job), that the permission of the data files map to the permissions of t=
he corresponding data entity (i.e. table, column family or search collectio=
n).
> To enable this we need to have the necessary hooks in place in the NameNo=
de to delegate authorization to an external system that can map HDFS files/=
directories to data entities and resolve their permissions based on the dat=
a entities permissions.
> I=E2=80=99ll be posting a design proposal in the next few days.


--
This message was sent by Atlassian JIRA
(v6.2#6252)