[
https://issues.apache.org/jira/browse/HADOOP-10791?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14075692#comment-14075692
]
Larry McCay commented on HADOOP-10791:
--------------------------------------
Hi [~rkanter] - I've been trying to see where/how to leverage the credential
provider API within this pluggable mechanism. I think that I am missing the
persistence of the random signer secret - unless you are just keeping it in
memory for now and waiting for the ZK implementation to persist. What I would
like to see is a persistence hook that we can have multiple mechanisms for
persistence.
We would have at least three persistent stores that I can see off the bat:
1. current file
2. zookeeper
3. java keystore (available through cred provider already)
If we implement all three as credential provider api providers then that
contract could be the hook.
If not, we need another abstraction to plug in the various implementations.
Am I misunderstanding the thinking behind the pluggability being introduced
here and/or missing the persistence of the random impl in this patch?
> AuthenticationFilter should support externalizing the secret for signing and
> provide rotation support
> -----------------------------------------------------------------------------------------------------
>
> Key: HADOOP-10791
> URL: https://issues.apache.org/jira/browse/HADOOP-10791
> Project: Hadoop Common
> Issue Type: Improvement
> Components: security
> Affects Versions: 2.4.1
> Reporter: Alejandro Abdelnur
> Assignee: Robert Kanter
> Attachments: HADOOP-10791.patch, HADOOP-10791.patch
>
>
> It should be possible to externalize the secret used to sign the hadoop-auth
> cookies.
> In the case of WebHDFS the shared secret used by NN and DNs could be used. In
> the case of Oozie HA, the secret could be stored in Oozie HA control data in
> ZooKeeper.
> In addition, it is desirable for the secret to change periodically, this
> means that the AuthenticationService should remember a previous secret for
> the max duration of hadoop-auth cookie.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
