[
https://issues.apache.org/jira/browse/HADOOP-13252?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Steve Loughran updated HADOOP-13252:
------------------------------------
Attachment: HADOOP-13252-branch-2-001.patch
Patch 001
# review credential use; move loader code into S3AUtils for ease of testing
# TemporaryCredentials to use Hadoop Credential Provider API
# Add a SimpleAWSCredentialsProvider which supports basic credentials and Can
be listed in fs.s3a.aws.credentials.provider
# fs.s3a.aws.credentials.provider takes a list of classes
# Add AWSCredentialProviderList. This AWSCredentialsProviderChain with
* Allows extra providers to be added dynamically.
* If any provider in the chain throws an exception other than an
AmazonClientException, that is rethrown, rather than swallowed
* Has some more diagnostics.
* On failure, the last AmazonClientException raised is rethrown.
* Special handling of AnonymousAWSCredentials. (i.e. supported in the chain)
> add logging of what's going on in s3 auth to help debug problems
> ----------------------------------------------------------------
>
> Key: HADOOP-13252
> URL: https://issues.apache.org/jira/browse/HADOOP-13252
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: fs/s3
> Affects Versions: 2.8.0
> Reporter: Steve Loughran
> Priority: Minor
> Attachments: HADOOP-13252-branch-2-001.patch
>
>
> We've now got some fairly complex auth mechanisms going on: -hadoop config,
> KMS, env vars, "none". IF something isn't working, it's going to be a lot
> harder to debug.
> I propose *carefully* adding some debug messages to identify which auth
> provider is doing the auth, so we can see if the env vars were kicking in,
> sysprops, etc.
> What we mustn't do is leak any secrets: this should be identifying whether
> properties and env vars are set, not what their values are. I don't believe
> that this will generate a security risk.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
