storm-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <>
Subject [jira] [Commented] (STORM-346) (Security) Oozie style delegation tokens for HDFS/HBase
Date Tue, 22 Jul 2014 16:48:40 GMT


ASF GitHub Bot commented on STORM-346:

Github user Parth-Brahmbhatt commented on the pull request:
    I have added a new interface that will execute on nimbus during submitTopology operation
so nimbus can get credentials on behalf of the user.  I also had to change the ICredentialsRenewer
so we can pass the topology configuration to the renew methods in addition to the credentials

> (Security) Oozie style delegation tokens for HDFS/HBase
> -------------------------------------------------------
>                 Key: STORM-346
>                 URL:
>             Project: Apache Storm (Incubating)
>          Issue Type: Bug
>            Reporter: Robert Joseph Evans
>            Assignee: Parth Brahmbhatt
>              Labels: security
> Oozie has the ability to fetch delegation tokens on behalf of other users by running
as a super user that can become a proxy user for almost anyone else.
> We should build one or more classes similar to AutoTGT that can fetch a delegation token
for HDFS/HBase, renew the token if needed, and then once the token is about to permanently
expire fetch a new one.
> According to some people I have talked with HBase may need to have a JIRA filed against
it so that it can pick up a new delegation token without needing to restart the process.

This message was sent by Atlassian JIRA

View raw message