[
https://issues.apache.org/jira/browse/HADOOP-10771?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14077049#comment-14077049
]
Daryn Sharp commented on HADOOP-10771:
--------------------------------------
Is this intended to be used with webhdfs? I think so, some of these comments
are forward-looking:
In general:
# {{DelegationTokenAuthenticatedURL#hashCode}} cannot use a mutable value
(delegation token) else the object will become "lost" in a collection.
# By changing to HttpFs to using UGI.getCurrentUser, won't this mean HttpFs is
going to morph into the user of the current context. RPC, hftp, and webhdfs
all remain in the UGI context that created the fs.
# {{DelegationTokenAuthenticatedURL#openConnection}} is making assumptions
about looking up tokens that I don't believe are compatible with webhdfs ha.
# Why do all the token ops cast the authenticator to
{{KerberosDelegationTokenAuthenticator}}? If this is supposed to flexible then
it seems that any authenticator should support token ops.
# {{DelegationTokenAuthenticationHandler#managementOperation}} should be using
creating a UGI from {{getUser}} on the token identifier, not directly creating
a ugi based on username, else the proxy user info is lost.
# I'm not sure SC_BAD_REQUEST is a good http response. I think it's going to
trigger unnecessary retries in the client. Didn't it return SC_FORBIDDEN
before?
# Does this allow the clients to authenticate with a token to do token ops? If
yes, token ops must always require kerberos.
# Is the ephemeral token discarding the proxy doas user?
# {{doDelegationTokenOperation}} is throwing non-json responses as
{{AuthenticationException}} which is going to short-out retry logic when there
is a transient error.
Upon first thought, hoisting token authentication and management operations up
into the auth filter seems like a good thing to do. However directly invoking
the secret manager will short-circuit the ability for a service to do extra
logic checks. Ex. In the case of the NN, how will {{DelegationTokenManager}}
be able to interact with the edits? How will it know to throw
{{RetriableException}} when in standby and the token doesn't exist yet? Etc?
> Refactor HTTP delegation support out of httpfs to common
> --------------------------------------------------------
>
> Key: HADOOP-10771
> URL: https://issues.apache.org/jira/browse/HADOOP-10771
> Project: Hadoop Common
> Issue Type: Improvement
> Components: security
> Affects Versions: 3.0.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Attachments: COMBO.patch, HADOOP-10771.patch, HADOOP-10771.patch,
> HADOOP-10771.patch, HADOOP-10771.sh
>
>
> HttpFS implements delegation token support in {{AuthenticationFilter}} &
> {{AuthenticationHandler}} subclasses.
> For HADOOP-10770 we need similar functionality for KMS.
> Not to duplicate code, we should refactor existing code to common.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
