[
https://issues.apache.org/jira/browse/HADOOP-10791?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14079746#comment-14079746
]
Alejandro Abdelnur commented on HADOOP-10791:
---------------------------------------------
*AuthenticationFilter.java*:
The boostrap of the signer secret provider logic is a bit complex, how about?
{code}
validity = Long.parseLong(config.getProperty(AUTH_TOKEN_VALIDITY, "36000"))
* 1000; //10 hours
secretProvider = (SignerSecretProvider) filterConfig.getServletContext().
getAttribute(SIGNATURE_PROVIDER_ATTRIBUTE);
if (secretProvider == null) {
String signerSecretProviderClassName =
config.getProperty(configPrefix + SIGNER_SECRET_PROVIDER_CLASS, null);
if (signerSecretProviderClassName == null) {
String signatureSecret =
config.getProperty(configPrefix + SIGNATURE_SECRET, null);
if (signatureSecret != null) {
secretProvider = new StringSignerSecretProvider(signatureSecret);
} else {
secretProvider = new RandomSignerSecretProvider();
}
} else {
try {
Class<?> klass = Thread.currentThread().getContextClassLoader().
loadClass(signerSecretProviderClassName);
secretProvider = (SignerSecretProvider) klass.newInstance();
} catch (ClassNotFoundException ex) {
throw new ServletException(ex);
} catch (InstantiationException ex) {
throw new ServletException(ex);
} catch (IllegalAccessException ex) {
throw new ServletException(ex);
}
}
try {
secretProvider.init(config, validity);
} catch (Exception ex) {
throw new ServletException(ex);
}
}
{code}
Note the {{StringSignerSecretProvider}} would have a constructor that takes a
secret besides the default one.
*RollingSignerSecretProvider.java*:
* the scheduler should be created in the init() method, to avoid a run away
thread if an exception happens before init.
* if {{rollSecret()}} is synched so it cannot run simultaneously with
{{destroy()}} then we need to have a boolean that indicates if the provider is
destroyed, and check that in {{rollSecret()}}, if destroy do a NOP.
*Signer.java*:
* we can get rid of the Signer(byte[]) constructor.
*SignerSecretProvider.java*:
* {{init()}} should not have a {{secretStr}} param, that is impl specific.
*Logic change:*
Now we are creating a new array on every {{getAllSecrets()}} call on every
{{getCurrentSecret()}} call. this is because we don’t want a caller to be able
to modify the secret.
How about moving the signing/verification logic into the
{{SignerSecretProvider}}, then you don’t give away the secrets, then you don’t
have to clone them either.
> AuthenticationFilter should support externalizing the secret for signing and
> provide rotation support
> -----------------------------------------------------------------------------------------------------
>
> Key: HADOOP-10791
> URL: https://issues.apache.org/jira/browse/HADOOP-10791
> Project: Hadoop Common
> Issue Type: Improvement
> Components: security
> Affects Versions: 2.4.1
> Reporter: Alejandro Abdelnur
> Assignee: Robert Kanter
> Attachments: HADOOP-10791.patch, HADOOP-10791.patch
>
>
> It should be possible to externalize the secret used to sign the hadoop-auth
> cookies.
> In the case of WebHDFS the shared secret used by NN and DNs could be used. In
> the case of Oozie HA, the secret could be stored in Oozie HA control data in
> ZooKeeper.
> In addition, it is desirable for the secret to change periodically, this
> means that the AuthenticationService should remember a previous secret for
> the max duration of hadoop-auth cookie.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
