Mailing-List: contact user-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@hadoop.apache.org
Received-SPF: pass (athena.apache.org: domain of ivan.frain@gmail.com
 designates 209.85.212.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAOcnVr1Ks8R5MbbO1pnkE=P=qU3W4AnG7OY0P2KjezUm9oDkRQ@mail.gmail.com>
References: 
 <CANx3uAi=q5Aij=Amznt2245kdYJsKNFQmXZW4E1pbubb5c8hxg@mail.gmail.com>
	<CAOcnVr1Ks8R5MbbO1pnkE=P=qU3W4AnG7OY0P2KjezUm9oDkRQ@mail.gmail.com>
Date: Tue, 9 Oct 2012 08:46:23 +0200
Message-ID: 
 <CAFrC+12vrOErvR0xbGD5E21Ah7PZOZo-coRghs-bUz=_u5=BGQ@mail.gmail.com>
Subject: Re: Secure hadoop and group permission on HDFS
From: Ivan Frain <ivan.frain@gmail.com>
To: user@hadoop.apache.org
Content-Type: multipart/alternative; boundary=f46d04426a444f398804cb9ab2c4

--f46d04426a444f398804cb9ab2c4
Content-Type: text/plain; charset=ISO-8859-1

Hi Koert,

Another option is to use the LdapGroupsMapping which picks up the group
membership from a LDAP directory.
You can find more details on the JIRA issue:
https://issues.apache.org/jira/browse/HADOOP-8121
Up to now, it is available for ActiveDirectory and released in
hadoop-2.0.0-alpha and next releases.
You can easily apply the patch on a 0.23.1, I already did that and it works
well.

OpenLdap with POSIX groups is not yet supported by this patch, it was
tailored for ActiveDirectory.


BR,
Ivan


2012/10/9 Harsh J <harsh@cloudera.com>

> Koert,
>
> If you use the org.apache.hadoop.security.ShellBasedUnixGroupsMapping
> class (via hadoop.security.group.mapping), then yes the NameNode's
> view of the local unix groups (and the primary group) of the user is
> the final say on what groups the user belongs to. This can be relied
> on - but note that HDFS uses BSD style semantics when it comes to
> groups and when creating directories/files, the parent directory
> groups are inherited automatically unless altered after creation.
>
> On Tue, Oct 9, 2012 at 2:30 AM, Koert Kuipers <koert@tresata.com> wrote:
> > With secure hadoop the user name is authenticated by the kerberos server.
> > But what about the groups that the user is a member of? Are these simple
> the
> > groups that the user is a member of on the namenode machine?
> > Is it viable to manage access to files on HDFS using groups on a secure
> > hadoop cluster?
> >
>
>
>
> --
> Harsh J
>


-- 
Ivan Frain
11, route de Grenade
31530 Saint-Paul-sur-Save
mobile: +33 (0)6 52 52 47 07

--f46d04426a444f398804cb9ab2c4
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div>Hi Koert,</div><div><br></div>Another option is to use the LdapGroupsM=
apping which picks up the group membership from a LDAP directory.<div>You c=
an find more details on the JIRA issue:=A0<a href=3D"https://issues.apache.=
org/jira/browse/HADOOP-8121">https://issues.apache.org/jira/browse/HADOOP-8=
121</a></div>
<div>Up to now, it is available for ActiveDirectory and released in hadoop-=
2.0.0-alpha and next releases.</div><div>You can easily apply the patch on =
a 0.23.1, I already did that and it works well.</div><div><br></div><div>
OpenLdap with POSIX groups is not yet supported by this patch, it was tailo=
red for ActiveDirectory.</div><div><br></div><div><br></div><div>BR,</div><=
div>Ivan</div><div><br><br><div class=3D"gmail_quote">2012/10/9 Harsh J <sp=
an dir=3D"ltr">&lt;<a href=3D"mailto:harsh@cloudera.com" target=3D"_blank">=
harsh@cloudera.com</a>&gt;</span><br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">Koert,<br>
<br>
If you use the org.apache.hadoop.security.ShellBasedUnixGroupsMapping<br>
class (via hadoop.security.group.mapping), then yes the NameNode&#39;s<br>
view of the local unix groups (and the primary group) of the user is<br>
the final say on what groups the user belongs to. This can be relied<br>
on - but note that HDFS uses BSD style semantics when it comes to<br>
groups and when creating directories/files, the parent directory<br>
groups are inherited automatically unless altered after creation.<br>
<div class=3D"HOEnZb"><div class=3D"h5"><br>
On Tue, Oct 9, 2012 at 2:30 AM, Koert Kuipers &lt;<a href=3D"mailto:koert@t=
resata.com">koert@tresata.com</a>&gt; wrote:<br>
&gt; With secure hadoop the user name is authenticated by the kerberos serv=
er.<br>
&gt; But what about the groups that the user is a member of? Are these simp=
le the<br>
&gt; groups that the user is a member of on the namenode machine?<br>
&gt; Is it viable to manage access to files on HDFS using groups on a secur=
e<br>
&gt; hadoop cluster?<br>
&gt;<br>
<br>
<br>
<br>
</div></div><span class=3D"HOEnZb"><font color=3D"#888888">--<br>
Harsh J<br>
</font></span></blockquote></div><br><br clear=3D"all"><div><br></div>-- <b=
r>Ivan Frain<br>11, route de Grenade<div>31530 Saint-Paul-sur-Save</div><di=
v>mobile: +33 (0)6 52 52 47 07</div><div><br><br></div><br>
</div>

--f46d04426a444f398804cb9ab2c4--