storm-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (STORM-346) (Security) Oozie style delegation tokens for HDFS/HBase
Date Thu, 24 Jul 2014 21:44:40 GMT

    [ https://issues.apache.org/jira/browse/STORM-346?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14073692#comment-14073692
] 

ASF GitHub Bot commented on STORM-346:
--------------------------------------

Github user Parth-Brahmbhatt commented on the pull request:

    https://github.com/apache/incubator-storm/pull/190#issuecomment-50082444
  
    Added a unit test on nimbus to verify that the credentials will be populated as part of
submit topology. I did not find any equivalent unit test for renewers so I added renewer test
as well, I think I found a bug in nimbus's renew-credentials method. When old and new credentials
do not match, the method calls 
    (.set-credentials! storm-cluster-state id new-creds) which seems to be missing a parameter
topology-conf so I changed it to (.set-credentials! storm-cluster-state id new-creds topology-conf).

    
    The test passed after this change but please confirm that this is indeed a bug and let
me know if you want to file a separate JIRA for it.


> (Security) Oozie style delegation tokens for HDFS/HBase
> -------------------------------------------------------
>
>                 Key: STORM-346
>                 URL: https://issues.apache.org/jira/browse/STORM-346
>             Project: Apache Storm (Incubating)
>          Issue Type: Bug
>            Reporter: Robert Joseph Evans
>            Assignee: Parth Brahmbhatt
>              Labels: security
>
> Oozie has the ability to fetch delegation tokens on behalf of other users by running
as a super user that can become a proxy user for almost anyone else.
> We should build one or more classes similar to AutoTGT that can fetch a delegation token
for HDFS/HBase, renew the token if needed, and then once the token is about to permanently
expire fetch a new one.
> According to some people I have talked with HBase may need to have a JIRA filed against
it so that it can pick up a new delegation token without needing to restart the process.



--
This message was sent by Atlassian JIRA
(v6.2#6252)

Mime
View raw message