[
https://issues.apache.org/jira/browse/NIFI-1488?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15198118#comment-15198118
]
ASF GitHub Bot commented on NIFI-1488:
--------------------------------------
Github user markap14 commented on a diff in the pull request:
https://github.com/apache/nifi/pull/281#discussion_r56410960
--- Diff:
nifi-commons/nifi-hadoop-utils/src/main/java/org/apache/nifi/hadoop/KerberosTicketRenewer.java
---
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.nifi.hadoop;
+
+import org.apache.hadoop.security.UserGroupInformation;
+import org.apache.nifi.logging.ComponentLog;
+
+import java.io.IOException;
+
+/**
+ * Periodically attempts to renew the Kerberos user's ticket for the given
UGI.
+ */
+public class KerberosTicketRenewer implements Runnable {
+
+ private final UserGroupInformation ugi;
+ private final long renewalPeriod;
+ private final ComponentLog logger;
+
+ private volatile boolean stopped = false;
+
+ public KerberosTicketRenewer(final UserGroupInformation ugi, final
long renewalPeriod, final ComponentLog logger) {
+ this.ugi = ugi;
+ this.renewalPeriod = renewalPeriod;
+ this.logger = logger;
+ }
+
+ @Override
+ public void run() {
+ stopped = false;
+ while (!stopped) {
+ try {
+ logger.debug("Invoking renewal attempt for Kerberos
ticket");
+ // While we run this "frequently", the Hadoop
implementation will only perform the login at 80% of ticket lifetime.
+ ugi.checkTGTAndReloginFromKeytab();
+ } catch (IOException e) {
+ // Should failures to renew the ticket be retried more
quickly?
--- End diff --
I definitely think they should. I believe 24 hours is a fairly common
renewal period, but we don't want to wait 24 hours on failure. Perhaps provide
a new constructor arg for retryPeriod?
> Add Kerberos Support to HBase processors
> ----------------------------------------
>
> Key: NIFI-1488
> URL: https://issues.apache.org/jira/browse/NIFI-1488
> Project: Apache NiFi
> Issue Type: Improvement
> Affects Versions: 0.4.0, 0.4.1
> Reporter: Bryan Bende
> Assignee: Ricky Saltzer
> Fix For: 0.6.0
>
> Attachments:
> 0001-NIFI-1488-Adjusting-unused-imports-and-adding-licens.patch,
> 0001-NIFI-1488-fixed-bug-that-returned-wrong-variable-for.patch
>
>
> Our current HBase integration does not support communicating with a
> Kerberized HBase install. We should support this just like we do for the HDFS
> processors.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
