[
https://issues.apache.org/jira/browse/HADOOP-11479?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14279284#comment-14279284
]
Charles Lamb commented on HADOOP-11479:
---------------------------------------
[~ranadip],
Just to confirm, you are running the hdfs crypto command as user 'ranadip'
(assuming your cli prompt is showing user@host) and you are running your
namenode as hdfs (as indicated by the KMS message "User [hdfs] is not...").
Assuming the NN is running as user hdfs, then user 'hdfs' is the hdfs superuser
and it must have (as you have noted) GENERATE_EEK and READ access to ranskey1.
As [~hitliuyi] said, the hdfs crypto -createZone command can only be run by the
superuser.
Charles
> hdfs crypto -createZone fails to impersonate the real user in a kerberised
> environment
> --------------------------------------------------------------------------------------
>
> Key: HADOOP-11479
> URL: https://issues.apache.org/jira/browse/HADOOP-11479
> Project: Hadoop Common
> Issue Type: Bug
> Affects Versions: 2.6.0
> Environment: CentOS
> Reporter: Ranadip
> Attachments: KMS-test-acl.txt
>
>
> The problem occurs when KMS key level acl is created for the key before the
> encryption zone is created. The command tried to create the encryption zone
> using "hdfs" user's identity and not the real user's identity.
> Steps:
> In a kerberised environment:
> 1. Create key level ACL in KMS for a new key.
> 2. Create encryption key now. (Goes through fine)
> 3. Create encryption zone. (Fails)
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
