Return-Path: X-Original-To: apmail-hadoop-user-archive@minotaur.apache.org Delivered-To: apmail-hadoop-user-archive@minotaur.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 8059C1022D for ; Sat, 12 Dec 2015 14:55:12 +0000 (UTC) Received: (qmail 98451 invoked by uid 500); 12 Dec 2015 14:55:07 -0000 Delivered-To: apmail-hadoop-user-archive@hadoop.apache.org Received: (qmail 98322 invoked by uid 500); 12 Dec 2015 14:55:06 -0000 Mailing-List: contact user-help@hadoop.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Delivered-To: mailing list user@hadoop.apache.org Received: (qmail 98312 invoked by uid 99); 12 Dec 2015 14:55:06 -0000 Received: from Unknown (HELO spamd4-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 12 Dec 2015 14:55:06 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd4-us-west.apache.org (ASF Mail Server at spamd4-us-west.apache.org) with ESMTP id 2F032C0052 for ; Sat, 12 Dec 2015 14:55:06 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd4-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: 5.5 X-Spam-Level: ***** X-Spam-Status: No, score=5.5 tagged_above=-999 required=6.31 tests=[HTML_MESSAGE=3, RDNS_NONE=2.5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=disabled Received: from mx1-us-east.apache.org ([10.40.0.8]) by localhost (spamd4-us-west.apache.org [10.40.0.11]) (amavisd-new, port 10024) with ESMTP id q70jxxniISbY for ; Sat, 12 Dec 2015 14:54:58 +0000 (UTC) Received: from Exchange02.qunarservers.com (unknown [59.151.11.101]) by mx1-us-east.apache.org (ASF Mail Server at mx1-us-east.apache.org) with ESMTPS id 08EF142A63 for ; Sat, 12 Dec 2015 14:51:44 +0000 (UTC) Received: from EXCHANGE23.qunarservers.com ([fe80::2c7c:3c51:7b63:d774]) by Exchange02.qunarservers.com ([2002:3b97:b65::3b97:b65]) with mapi id 14.03.0224.002; Sat, 12 Dec 2015 22:51:08 +0800 From: =?gb2312?B?wvPK98jZ?= To: "user@hadoop.apache.org" Subject: =?gb2312?B?c2VydmljZSBsZXZlbCBhdXRob3JpemF0aW9uIGNoZWNrIHRoZSBjb21iaW5h?= =?gb2312?B?dGlvbiBvZiBob3N0IGFuZCB1c2VyIKOoaGFkb29wLTEyNjI4o6k=?= Thread-Topic: =?gb2312?B?c2VydmljZSBsZXZlbCBhdXRob3JpemF0aW9uIGNoZWNrIHRoZSBjb21iaW5h?= =?gb2312?B?dGlvbiBvZiBob3N0IGFuZCB1c2VyIKOoaGFkb29wLTEyNjI4o6k=?= Thread-Index: AdE07B/bIbPlh1KrQR6vvMB+Krxumw== Date: Sat, 12 Dec 2015 14:51:08 +0000 Message-ID: <7404AE097F6C3543904DA0C380B20D6626597F@EXCHANGE23.qunarservers.com> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.86.201.174] Content-Type: multipart/alternative; boundary="_000_7404AE097F6C3543904DA0C380B20D6626597FEXCHANGE23qunarse_" MIME-Version: 1.0 --_000_7404AE097F6C3543904DA0C380B20D6626597FEXCHANGE23qunarse_ Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 aGkgYWxsLA0KDQpTZXJ2aWNlIGxldmVsIGF1dGhvcml6YXRpb24gaW4gaGFkb29wMi4yLngsaGFk b29wMi41LngsaGFkb29wMi42LnggY2FuIG9ubHkgY2hlY2sgdGhlIHVzZXIgZnJvbSBjbGllbnQu IFNlcnZpY2UgbGV2ZWwgYXV0aG9yaXphdGlvbiBpbiBoYWRvb3AyLjcueCBhZGQgdGhlIGZ1bmN0 aW9uIG9mIGNoZWNraW5nIHRoZSBob3N0KGlwKSBmcm9tIGNsaWVudCwgYnV0IG9ubHkgY2FuIGNo ZWNrIGhvc3QgYW5kIHVzZXIgaW5kZXBlbmRlbnRseSBhbmQgY2Fubm90IGNoZWNrIHRoZSBjb21i aW5hdGlvbiBvZiBob3N0IGFuZCB1c2VyLg0KDQpJIHN1Ym1pdHRlZCBhIGltcHJvdmVtZW50IGlz c3VlIGFuZCB0aGUgcGF0Y2ggd2hpY2ggYWRkIHRoZSBmdW5jdGlvbiBvZiBjaGVja2luZyBhdXRo b3JpemF0aW9uIG9mIHRoZSBjb21iaW5hdGlvbiBvZiBob3N0IGFuZCB1c2VyIGZvciBoYWRvb3Ay LjIueCwgaGFkb29wMi41LngsIGhhZG9vcDIuNi54IDogaHR0cHM6Ly9pc3N1ZXMuYXBhY2hlLm9y Zy9qaXJhL2Jyb3dzZS9IQURPT1AtMTI2MjggLg0KDQpBZnRlciBwdXQgdGhlIHBhdGNoLHdlIGNh biBzZXQgdGhlIGF1dGhvcml6YXRpb24gb2YgaG9zdC11c2VyIHBhaXIgaW4gdGhlIGhhZG9vcC1w b2xpY3kueG1sLlRha2Ugc2VjdXJpdHkuY2xpZW50LnByb3RvY29sLmFjbCBmb3IgZXhhbXBsZToN CklmIHdlIG9ubHkgbGV0IHRoZSBoYWRvb3BfdXNlcjEgZnJvbSAxOTIuMTY4LjAuMShpcCkgaGFz IHRoZSBhdXRob3JpemF0aW9uLCB3ZSBjYW4gc2V0ICJoYWRvb3BfdXNlcjE6MTkyLjE2OC4wLjEi LiBTbyBoYWRvb3BfdXNlcjEgZnJvbSBvdGhlciBob3N0IGJ1dCAxOTIuMTY4LjAuMSBkb2Vzbid0 IGhhdmUgdGhlIGF1dGhvcml6YXRpb24uIElmIHdlIGFkZCB0aGUgYXV0aG9yaXphdGlvbiBvZiBo YWRvb3BfdXNlcjIgZnJvbSBteWhvc3QuY29tLmNuKGhvc3RuYW1lKSwgd2UgY2FuIHNldCAiaGFk b29wX3VzZXIyOm15aG9zdC5jb20uY24iOyBpZiB3ZSBhdXRob3JpemUgaGFkb29wX3VzZXIzIGZy b20gYW55IGhvc3Qsd2UganVzdCBzZXQgImhhZG9vcF91c2VyMyIgbGlrZSBiZWZvcmU7IGlmIHdl IHdhbnQgdG9hdXRob3JpemUgYW55IHVzZXIgZnJvbSB0aGUgaG9zdCAxOTIuMTY4LjEwLjEwLCB3 ZSBjYW4gc2V0ICIqOjE5Mi4xNjguMTAuMTAiLg0KZXhhbXBsZaO6DQo8cHJvcGVydHk+DQo8bmFt ZT5zZWN1cml0eS5jbGllbnQucHJvdG9jb2wuYWNsPC9uYW1lPg0KPHZhbHVlPmhhZG9vcF91c2Vy MToxOTIuMTY4LjAuMSxoYWRvb3BfdXNlcjI6bXlob3N0LmNvbS5jbixoYWRvb3BfdXNlcjMsKjox OTIuMTY4LjEwLjEwPC92YWx1ZT4NCjwvcHJvcGVydHk+DQpJdCBpcyBhbHNvIGFwcGxpZWQgdG8g dGhlIGJsb2NrZWQgYWNjZXNzIGNvbnRyb2wgbGlzdCBhZnRlciBoYWRvb3AyLjYuMKO6DQpleGFt cGxlo7oNCjxwcm9wZXJ0eT4NCjxuYW1lPnNlY3VyaXR5LmNsaWVudC5wcm90b2NvbC5hY2wuYmxv Y2tlZDwvbmFtZT4NCjx2YWx1ZT5oYWRvb3BfdXNlcjE6MTkyLjE2OC4wLjEsaGFkb29wX3VzZXIy Om15aG9zdC5jb20uY24saGFkb29wX3VzZXIzLCo6MTkyLjE2OC4xMC4xMDwvdmFsdWU+DQo8L3By b3BlcnR5Pg0KVGhlIGZvcm1hdCBvZiBhY2Nlc3MgY29udHJvbCBsaXN0IGlzIGNvbXBsZXRlbHkg Q29tcGF0aWJsZS4NClRoZSBsaXN0IG9mIHVzZXJzIGFuZCBncm91cHMgYXJlIGJvdGggY29tbWEg c2VwYXJhdGVkIGxpc3Qgb2YgbmFtZXMuIFRoZSB0d28gbGlzdHMgYXJlIHNlcGFyYXRlZCBieSBh IHNwYWNlLg0KQWRkIGEgYmxhbmsgYXQgdGhlIGJlZ2lubmluZyBvZiB0aGUgbGluZSBpZiBvbmx5 IGEgbGlzdCBvZiBncm91cHMgaXMgdG8gYmUgcHJvdmlkZWQsIGVxdWl2YWxlbnRseSBhIGNvbW1h LXNlcGFyYXRlZCBsaXN0IG9mIHVzZXJzIGZvbGxvd2VkIGJ5IGEgc3BhY2Ugb3Igbm90aGluZyBp bXBsaWVzIG9ubHkgYSBzZXQgb2YgZ2l2ZW4gdXNlcnMuQSBzcGVjaWFsIHZhbHVlIG9mICogaW1w bGllcyB0aGF0IGFsbCB1c2VycyBmcm9tIGFueSBob3N0IGFyZSBhbGxvd2VkIHRvIGFjY2VzcyB0 aGUgc2VydmljZS4NCkV4YW1wbGU6DQp1c2VyMSx1c2VyMiBncm91cDEsZ3JvdXAyIKOodXNlcjEs dXNlcjIsZ3JvdXAxLGdyb3VwMiBmcm9tIGFueSBob3N0IGhhdmUgdGhlIGF1dGhvcml6YXRpb26j qQ0KdXNlcjE6MTkyLjE2OC4wLjEsdXNlcjI6bXlob3N0MS5jb20uY24gZ3JvdXAxOjE5Mi4xNjgu MC4yLGdyb3VwMjpteWhvc3QyLmNvbS5jbiCjqHVzZXIxIGZyb20gMTkyLjE2OC4wLjEsIHVzZXIy IGZyb20gbXlob3N0MS5jb20uY24sIGdyb3VwMSBmcm9tIDE5Mi4xNjguMC4yLGdyb3VwMiBmcm9t IG15aG9zdDIuY29tLmNuIGhhdmUgdGhlIGF1dGhvcml6YXRpb26jqQ0KKjoxOTIuMTY4LjAuMSwq Om15aG9zdDEuY29tLmNuIChhbnkgdXNlciBmcm9tIDE5Mi4xNjguMC4xLCBhbnkgdXNlciBmcm9t IG15aG9zdDEuY29tLmNuIGhhdmUgdGhlIGF1dGhvcml6YXRpb26jqQ0KKiAoYW55IHVzZXIgZnJv bSBhbnkgaG9zdCBoYXZlIHRoZSBhdXRob3JpemF0aW9uKQ0KZXhhbXBsZTE6DQo8cHJvcGVydHk+ DQo8bmFtZT5zZWN1cml0eS5jbGllbnQucHJvdG9jb2wuYWNsPC9uYW1lPg0KPHZhbHVlPio8L3Zh bHVlPg0KPC9wcm9wZXJ0eT4NCmV4YW1wbGUyOg0KPHByb3BlcnR5Pg0KPG5hbWU+c2VjdXJpdHku Y2xpZW50LnByb3RvY29sLmFjbDwvbmFtZT4NCjx2YWx1ZT51c2VyMSx1c2VyMiBncm91cDEsZ3Jv dXAyPC92YWx1ZT4NCjwvcHJvcGVydHk+DQpleGFtcGxlMzoNCjxwcm9wZXJ0eT4NCjxuYW1lPnNl Y3VyaXR5LmNsaWVudC5wcm90b2NvbC5hY2w8L25hbWU+DQo8dmFsdWU+KjoxOTIuMTY4LjAuMSwq Om15aG9zdDEuY29tLmNuPC92YWx1ZT4NCjwvcHJvcGVydHk+DQpleGFtcGxlMzoNCjxwcm9wZXJ0 eT4NCjxuYW1lPnNlY3VyaXR5LmNsaWVudC5wcm90b2NvbC5hY2w8L25hbWU+DQo8dmFsdWU+dXNl cjE6MTkyLjE2OC4wLjEsdXNlcjI6bXlob3N0MS5jb20uY24gZ3JvdXAxOjE5Mi4xNjguMC4yLGdy b3VwMjpteWhvc3QyLmNvbS5jbjwvdmFsdWU+DQo8L3Byb3BlcnR5Pg0KDQoNClRoYW5rcyBhbmQg aGFwcHkgd2Vla2VuZCENCg0K --_000_7404AE097F6C3543904DA0C380B20D6626597FEXCHANGE23qunarse_ Content-Type: text/html; charset="gb2312" Content-Transfer-Encoding: quoted-printable

hi a= ll,

 

Service level authorization in hadoop2.2.x,hadoop2.5= .x,hadoop2.6.x can only check the user from client. Service level authoriza= tion in hadoop2.7.x add the function of checking the host(ip) from client, but only can check host and user independently and cannot che= ck the combination of host and user.

 

I su= bmitted a improvement issue and the patch which add the function of checkin= g authorization of the combination of host and user for hadoop2.2.x, hadoop= 2.5.x, hadoop2.6.x : https://issu= es.apache.org/jira/browse/HADOOP-12628 .

 

After put the patch,we can set the authorization of = host-user pair in the hadoop-policy.xml.Take security.client.protocol.acl f= or example:

If we only let the hadoop_user1 from 192.168.0.1(ip)= has the authorization, we can set "hadoop_user1:192.168.0.1". So= hadoop_user1 from other host but 192.168.0.1 doesn't have the authorizatio= n. If we add the authorization of hadoop_user2 from myhost.com.cn(hostname), = we can set "hadoop_user2:myhost.com.cn"; if we authorize hadoop_u= ser3 from any host,we just set "hadoop_user3" like before; if we = want toauthorize any user from the host 192.168.10.10, we can set "*:192.168.10.10".

example=A3=BA
<property>
<name>security.client.protocol.acl</name>
<value>hadoop_user1:192.168.0.1,hadoop_user2:myhost.com.cn,hadoop_use= r3,*:192.168.10.10</value>
</property>

It is also applied to the blocked access control lis= t after hadoop2.6.0=A3=BA
example=A3=BA=
<property>
<name>security.client.protocol.acl.blocked</name>
<value>hadoop_user1:192.168.0.1,hadoop_user2:myhost.com.cn,hadoop_use= r3,*:192.168.10.10</value>
</property>

The format of access control list is completely Comp= atible.

The list of users and groups are both comma separate= d list of names. The two lists are separated by a space.
Add a blank at the beginning of the line if only a list of groups is to be = provided, equivalently a comma-separated list of users followed by a space = or nothing implies only a set of given users.A special value of * implies t= hat all users from any host are allowed to access the service.

Example: 
user1,user2 group1,group2 =A3=A8user1,user2,group1,group2 = from any host have the authorization=A3=A9

user1:192.168.0.1,user2:myhost1.com.cn group1:192.16= 8.0.2,group2:myhost2.com.cn =A3=A8= user1 from 192.168.0.1, user2 from myhost1.com.cn, g= roup1 from 192.168.0.2,group2 from myhost2.com.cn have the authorization=A3=A9

*:192.168.0.1,*:myhost1.com.cn (any user from 192.16= 8.0.1, any user from myhost1.com.cn have the authorization=A3=A9

* (any user from any host have the authorization)

example1:
<property>
<name>security.client.protocol.acl</name>
<value>*</value>
</property>

example2:
<property>
<name>security.client.protocol.acl</name>
<value>user1,user2 group1,group2</value>
</property>

example3:
<property>
<name>security.client.protocol.acl</name>
<value>*:192.168.0.1,*:myhost1.com.cn</value>
</property>

example3:
<property>
<name>security.client.protocol.acl</name>
<value>user1:192.168.0.1,user2:myhost1.com.cn group1:192.168.0.2,grou= p2:myhost2.com.cn</value>
</property>

 

Thanks and happy weekend!

 

--_000_7404AE097F6C3543904DA0C380B20D6626597FEXCHANGE23qunarse_--