[
https://issues.apache.org/jira/browse/HADOOP-10791?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14078621#comment-14078621
]
Alejandro Abdelnur commented on HADOOP-10791:
---------------------------------------------
Owen, I would say that persisting the rolling secret for other purposes of HA
(to share it with other HA instances) is kind of not very useful. Without HA,
on restart, simply generate a new random secret; all cookies signed with the
now-gone secret will be rejected triggering a re-authentication. Now, note that
we are talking about hadoop-auth cookies being signed, hadoop-auth cookies are
not meant to be transferred to other processes (ie tasks). On the other hand,
delegation tokens are, delegation tokens as you know, are keep in the secret
store of the server(s), thus you need HA for delegation tokens to be useful
across failures.
Said that, I’m not opposed to have an API to save it, just it should not be in
the contract API but in a base impl.
> AuthenticationFilter should support externalizing the secret for signing and
> provide rotation support
> -----------------------------------------------------------------------------------------------------
>
> Key: HADOOP-10791
> URL: https://issues.apache.org/jira/browse/HADOOP-10791
> Project: Hadoop Common
> Issue Type: Improvement
> Components: security
> Affects Versions: 2.4.1
> Reporter: Alejandro Abdelnur
> Assignee: Robert Kanter
> Attachments: HADOOP-10791.patch, HADOOP-10791.patch
>
>
> It should be possible to externalize the secret used to sign the hadoop-auth
> cookies.
> In the case of WebHDFS the shared secret used by NN and DNs could be used. In
> the case of Oozie HA, the secret could be stored in Oozie HA control data in
> ZooKeeper.
> In addition, it is desirable for the secret to change periodically, this
> means that the AuthenticationService should remember a previous secret for
> the max duration of hadoop-auth cookie.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
