Mailing-List: contact user-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
MIME-Version: 1.0
From: "K. N. Ramachandran" <knram06@gmail.com>
Date: Mon, 18 Apr 2016 10:19:23 -0400
Message-ID: 
 <CAP8=CDY7bCJ8kxymzc99rUmLH=NU-9SkaEzEFgg7ttTd_2GJ4g@mail.gmail.com>
Subject: YARN and Kerberos: Client <-> ApplicationMaster RPC
To: user@hadoop.apache.org
Content-Type: multipart/alternative; boundary=001a1137bac84807eb0530c30dc2

--001a1137bac84807eb0530c30dc2
Content-Type: text/plain; charset=UTF-8

Hello all,

We have a legacy YARN Application code and we were looking at the changes
needed to allow this to run on a Kerberos cluster. The AM (ApplnMaster)
builds an RPC Server and the Client connects to this to get status updates
and program output.

1) Is there an example for this kind of RPC Setup on a Kerberos cluster? We
followed the outline in the TestSaslRPC test (testKerberosRpc function),
but we were wondering if there is a better way?

2) The main issue now is that our changes depend on the user having a
keytab. Following the TestSaslRPC outline, we do a SecurityUtil.login(conf,
(user keytab), (user principal)) when we build the RPC Server (AM side) and
the Client code is able to connect to it.

But ideally the user would have logged in with only a password and that
should be enough. How do we login and build the RPC Server on the AM side
without asking for a password?


Regards,
Ramachandran K.N.
Ph: 814-441-4279

--001a1137bac84807eb0530c30dc2
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello all,<div><br></div><div>We have a legacy YARN Applic=
ation code and we were looking at the changes needed to allow this to run o=
n a Kerberos cluster. The AM (ApplnMaster) builds an RPC Server and the Cli=
ent connects to this to get status updates and program output.</div><div><b=
r></div><div>1) Is there an example for this kind of RPC Setup on a Kerbero=
s cluster? We followed the outline in the TestSaslRPC test (testKerberosRpc=
 function), but we were wondering if there is a better way?</div><div><br><=
/div><div>2) The main issue now is that our changes depend on the user havi=
ng a keytab. Following the TestSaslRPC outline, we do a <font face=3D"monos=
pace, monospace">SecurityUtil.login(conf, (user keytab), (user principal))<=
/font> when we build the RPC Server (AM side) and the Client code is able t=
o connect to it.</div><div><br></div><div>But ideally the user would have l=
ogged in with only a password and that should be enough. How do we login an=
d build the RPC Server on the AM side without asking for a password?</div><=
div><br clear=3D"all"><div><br></div>Regards,<br><div class=3D"gmail_signat=
ure"><div dir=3D"ltr">Ramachandran K.N.<br><div>Ph: 814-441-4279</div></div=
></div>
</div></div>

--001a1137bac84807eb0530c30dc2--