virajjasani commented on pull request #3013: URL: https://github.com/apache/ambari/pull/3013#issuecomment-643654970
> Also is unclear, do we have any error handler and user input checker? As far as i see - the user input is passed "as is" and i have some security concerns about it Thanks for the review. The only user params for enabling replication are: 1. Peer cluster ZK quorum, ZK port 2. Parent ZKey for HBase 3. Cluster ID that we would like to provide For any non-secure cluster A, if the cluster has access to peer cluster ZK quorum, it will take such input and setup replication. However, for secure clusters (used in production), only if cluster A has ACLs open, has access to peer cluster by means of e.g KRB authentication, only then cluster A will be able to setup connection with cluster B. Hence, for secure clusters, this should not cause any security threat as such. Moreover, taking care of Authentic functionalities and further validations is HBase's responsibility and we can clearly see the replication command failing for security reasons as per HBase replication command execution. What we are trying to add in Ambari is just the way for allowing users to add/update/remove replication peers, which so far users have to do on their own. ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
