Return-Path: X-Original-To: apmail-storm-dev-archive@minotaur.apache.org Delivered-To: apmail-storm-dev-archive@minotaur.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 4DA4211B98 for ; Tue, 22 Jul 2014 16:49:02 +0000 (UTC) Received: (qmail 9670 invoked by uid 500); 22 Jul 2014 16:49:02 -0000 Delivered-To: apmail-storm-dev-archive@storm.apache.org Received: (qmail 9620 invoked by uid 500); 22 Jul 2014 16:49:02 -0000 Mailing-List: contact dev-help@storm.incubator.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@storm.incubator.apache.org Delivered-To: mailing list dev@storm.incubator.apache.org Received: (qmail 9609 invoked by uid 99); 22 Jul 2014 16:49:02 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 22 Jul 2014 16:49:02 +0000 X-ASF-Spam-Status: No, hits=-2000.0 required=5.0 tests=ALL_TRUSTED,RP_MATCHES_RCVD X-Spam-Check-By: apache.org Received: from [140.211.11.3] (HELO mail.apache.org) (140.211.11.3) by apache.org (qpsmtpd/0.29) with SMTP; Tue, 22 Jul 2014 16:49:00 +0000 Received: (qmail 8010 invoked by uid 99); 22 Jul 2014 16:48:40 -0000 Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 22 Jul 2014 16:48:40 +0000 Date: Tue, 22 Jul 2014 16:48:40 +0000 (UTC) From: "ASF GitHub Bot (JIRA)" To: dev@storm.incubator.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Commented] (STORM-346) (Security) Oozie style delegation tokens for HDFS/HBase MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 X-Virus-Checked: Checked by ClamAV on apache.org [ https://issues.apache.org/jira/browse/STORM-346?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14070491#comment-14070491 ] ASF GitHub Bot commented on STORM-346: -------------------------------------- Github user Parth-Brahmbhatt commented on the pull request: https://github.com/apache/incubator-storm/pull/190#issuecomment-49766164 I have added a new interface that will execute on nimbus during submitTopology operation so nimbus can get credentials on behalf of the user. I also had to change the ICredentialsRenewer so we can pass the topology configuration to the renew methods in addition to the credentials map. > (Security) Oozie style delegation tokens for HDFS/HBase > ------------------------------------------------------- > > Key: STORM-346 > URL: https://issues.apache.org/jira/browse/STORM-346 > Project: Apache Storm (Incubating) > Issue Type: Bug > Reporter: Robert Joseph Evans > Assignee: Parth Brahmbhatt > Labels: security > > Oozie has the ability to fetch delegation tokens on behalf of other users by running as a super user that can become a proxy user for almost anyone else. > We should build one or more classes similar to AutoTGT that can fetch a delegation token for HDFS/HBase, renew the token if needed, and then once the token is about to permanently expire fetch a new one. > According to some people I have talked with HBase may need to have a JIRA filed against it so that it can pick up a new delegation token without needing to restart the process. -- This message was sent by Atlassian JIRA (v6.2#6252)