Mailing-List: contact user-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@hadoop.apache.org
Received-SPF: pass (nike.apache.org: domain of bcwalrus@cloudera.com
 designates 209.85.215.50 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CA+KbhciT-hMrh8+QmsWCRJqX3MYm0=gHuLhU6fR6TEfW_UXxdA@mail.gmail.com>
References: 
 <CA+KbhciT-hMrh8+QmsWCRJqX3MYm0=gHuLhU6fR6TEfW_UXxdA@mail.gmail.com>
From: bc Wong <bcwalrus@cloudera.com>
Date: Wed, 8 Jan 2014 00:24:28 -0800
Message-ID: 
 <CAAd8ce8V+RrmPYn829YiqhRZx+vLKiLSTrcJrZv_AoogP-UJNg@mail.gmail.com>
Subject: Re: Ways to manage user accounts on hadoop cluster when using
 kerberos security
To: user@hadoop.apache.org
Content-Type: multipart/alternative; boundary=001a11c33e4ae09dbc04ef71392b

--001a11c33e4ae09dbc04ef71392b
Content-Type: text/plain; charset=UTF-8

LDAP/AD is pretty much it. You can also have Kerberos authenticate directly
to AD, or set up one-way trust between AD and MIT Kerberos. There are other
identity management systems that basically implement the same. At the end
of the day, you need to have (1) users in KDC (2) users on the nodes, and
(3) user-group mapping. And it makes sense for all three to come from the
same system.

Cheers,
bc


On Tue, Jan 7, 2014 at 2:55 PM, Manoj Samel <manoj.samel@gmail.com> wrote:

> Hi,
>
> From the documentation + code,  "when kerberos is enabled, all tasks are
> run as the end user (e..g as user "joe" and not as hadoop user "mapred")
> using the task-controller (which is setuid root and when it runs, it does a
> setuid/setgid etc. to Joe and his groups ). For this to work, user "joe"
> linux account has to be present on all nodes of the cluster."
>
> In a environment with large and dynamic user population; it is not
> practical to add every end user to every node of the cluster (and drop user
> when end user is deactivated etc.)
>
> What are other options get this working ?
>
> I am assuming that if the users are in a LDAP, can using the PAM for LDAP
> solve the issue.
>
> Any other suggestions?
>
> --
> Thanks,
>
> Manoj
>

--001a11c33e4ae09dbc04ef71392b
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-family:arial,he=
lvetica,sans-serif">LDAP/AD is pretty much it. You can also have Kerberos a=
uthenticate directly to AD, or set up one-way trust between AD and MIT Kerb=
eros. There are other identity management systems that basically implement =
the same. At the end of the day, you need to have (1) users in KDC (2) user=
s on the nodes, and (3) user-group mapping. And it makes sense for all thre=
e to come from the same system.</div>

<div class=3D"gmail_default" style=3D"font-family:arial,helvetica,sans-seri=
f"><br></div><div class=3D"gmail_default" style=3D"font-family:arial,helvet=
ica,sans-serif">Cheers,</div><div class=3D"gmail_default" style=3D"font-fam=
ily:arial,helvetica,sans-serif">

bc</div><div class=3D"gmail_extra"><br><br><div class=3D"gmail_quote">On Tu=
e, Jan 7, 2014 at 2:55 PM, Manoj Samel <span dir=3D"ltr">&lt;<a href=3D"mai=
lto:manoj.samel@gmail.com" target=3D"_blank">manoj.samel@gmail.com</a>&gt;<=
/span> wrote:<br>

<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex"><div dir=3D"ltr">Hi,<div><br></div><div>From=
 the documentation + code, =C2=A0&quot;when kerberos is enabled, all tasks =
are run as the end user (e..g as user &quot;joe&quot; and not as hadoop use=
r &quot;mapred&quot;) using the task-controller (which is setuid root and w=
hen it runs, it does a setuid/setgid etc. to Joe and his groups ). For this=
 to work, user &quot;joe&quot; linux account has to be present on all nodes=
 of the cluster.&quot;</div>


<div><br></div><div>In a environment with large and dynamic user population=
; it is not practical to add every end user to every node of the cluster (a=
nd drop user when end user is deactivated etc.)</div><div><br></div><div>


What are other options get this working ?=C2=A0</div><div><br></div><div>I =
am assuming that if the users are in a LDAP, can using the PAM for LDAP sol=
ve the issue.</div><div><br></div><div>Any other suggestions?</div><span cl=
ass=3D"HOEnZb"><font color=3D"#888888"><div>

<div>
<br></div>-- <br><div dir=3D"ltr"><div>Thanks,<br><br></div>Manoj<br></div>
</div></font></span></div>
</blockquote></div><br></div></div>

--001a11c33e4ae09dbc04ef71392b--