[
https://issues.apache.org/jira/browse/HADOOP-10784?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14068327#comment-14068327
]
liyunzhang commented on HADOOP-10784:
-------------------------------------
Hi Larry McCay- I found that curl support "--negotiate". I can create a key in
KMS in kerberos environment by following command:
curl -i --negotiate -u: -X POST -d @createkey.json
http://liyunzhangcentos.sh.intel.com:16000/kms/v1/keys --header
"Content-Type:application/json"
HTTP/1.1 401 Unauthorized
Server: Apache-Coyote/1.1
WWW-Authenticate: Negotiate
Set-Cookie: hadoop.auth=; Expires=Thu, 01-Jan-1970 00:00:00 GMT; HttpOnly
Content-Type: text/html;charset=utf-8
Content-Length: 997
Date: Mon, 21 Jul 2014 06:27:59 GMT
HTTP/1.1 201 Created
Server: Apache-Coyote/1.1
Set-Cookie:
hadoop.auth=u=HTTP&p=HTTP/[email protected]&t=kerberos&e=1405960084208&s=UgeM6AwoHo46HDntyVXB/OLK6u8=;
Expires=Mon, 21-Jul-2014 16:28:04 GMT; HttpOnly
Location: http://liyunzhangcentos.sh.intel.com:16000/kms/v1/keys/v1/key/k1
Content-Type: application/json
Content-Length: 55
Date: Mon, 21 Jul 2014 06:28:33 GMT
{
"versionName" : "k1@0",
"material" : "12345w=="
}
Beside, i found that there is no detail kms configuration document in
hadoop-common/hadoop-common-project/hadoop-kms/src/site/xdoc. It is difficult
for end-users to configure KMS without document.
> Need add more in KMS document
> -----------------------------
>
> Key: HADOOP-10784
> URL: https://issues.apache.org/jira/browse/HADOOP-10784
> Project: Hadoop Common
> Issue Type: Improvement
> Components: security
> Affects Versions: 2.4.1
> Reporter: liyunzhang
> Priority: Minor
>
> Now i can only find the kms document in
> http://aajisaka.github.io/hadoop-project/hadoop-kms/index.html, but it is
> very simple. for example, i don't know how to enabling Kerberos HTTP SPNEGO
> Authentication although i configure the kms-site.xml according to the
> reference page.
> How to test it ?
> I send following request to KMS server:
> curl -g --header "Authorization:Negotiate123455"
> http://localhost:16000/kms/v1/key/k1
> I read the KMS code and found that i need add parameters in request header
> and the format is "Authorization:Negotiate $token". But how the token is
> generated?
--
This message was sent by Atlassian JIRA
(v6.2#6252)
