[
https://issues.apache.org/jira/browse/HADOOP-10791?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14075740#comment-14075740
]
Larry McCay commented on HADOOP-10791:
--------------------------------------
It certainly should be transparent and that is a fine place to do it - exactly
what I expected to see actually. I just think that the fact that the
RandomSignerSecretProvider introduces a way to get a randomized secret that it
should be able to be used with any number of persistence strategies which can
be abstracted by the credential provider API or something else if desirable.
Otherwise, we may see a proliferation of SignerSecretProviders just to change
the persistence.
If we added a method to the abstract base class then it could be used by
derived classes or not as appropriate for the concrete implementation.
If this is not seen as useful then I can add a CredProviderRandomSecretProvider
so that we can control where and how it is stored - it just seems unfortunate
to have a whole new implementation for it.
Of course the added benefit is that it would potentially build out cred
provider impls that can be used elsewhere too. For instance, a zookeeper
credential provider would be useful on its own.
Like I said, we can work around it but it seems like an opportunity to me.
> AuthenticationFilter should support externalizing the secret for signing and
> provide rotation support
> -----------------------------------------------------------------------------------------------------
>
> Key: HADOOP-10791
> URL: https://issues.apache.org/jira/browse/HADOOP-10791
> Project: Hadoop Common
> Issue Type: Improvement
> Components: security
> Affects Versions: 2.4.1
> Reporter: Alejandro Abdelnur
> Assignee: Robert Kanter
> Attachments: HADOOP-10791.patch, HADOOP-10791.patch
>
>
> It should be possible to externalize the secret used to sign the hadoop-auth
> cookies.
> In the case of WebHDFS the shared secret used by NN and DNs could be used. In
> the case of Oozie HA, the secret could be stored in Oozie HA control data in
> ZooKeeper.
> In addition, it is desirable for the secret to change periodically, this
> means that the AuthenticationService should remember a previous secret for
> the max duration of hadoop-auth cookie.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
