[
https://issues.apache.org/jira/browse/OOZIE-1865?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14031385#comment-14031385
]
Robert Kanter commented on OOZIE-1865:
--------------------------------------
I looked into this and doing the above idea is hacky and requires a lot of
extra configuration properties. I've just tested using a hadoop-auth with
HADOOP-10158 and it works very easily; all you have to do is put both HTTP
principals (and the oozie principal) into the same keytab and set
{{oozie.authentication.kerberos.principal}} to {{*}} (asterisks).
I think we should just use this JIRA to update the Oozie HA Install
documentation to mention this limitation and that compiling against Hadoop-Auth
from Hadoop 2.5.0 or later with the settings I just mentioned will work.
> Oozie servers can't talk to each other with Oozie HA and Kerberos
> -----------------------------------------------------------------
>
> Key: OOZIE-1865
> URL: https://issues.apache.org/jira/browse/OOZIE-1865
> Project: Oozie
> Issue Type: Bug
> Components: HA
> Affects Versions: trunk
> Reporter: Robert Kanter
> Assignee: Robert Kanter
>
> When you use Oozie HA with Kerberos, you have to set
> {{oozie.authentication.kerberos.principal}} to {{HTTP/<load-balancer-host>}}
> instead of {{HTTP/<oozie-server-host>}}. This allows clients to connect to
> any of the Oozie servers through the load balancer. However, it also blocks
> clients from directly talking to any of the Oozie servers. In and of itself,
> that's okay, but it turns out that in most cases, it also blocks the Oozie
> servers from talking to each other, namely for log streaming, the
> sharelibupdate command, and collating instrumentation/metrics (OOZIE-1676).
> Ultimately, what we need to do is allow Oozie to use both
> {{HTTP/<load-balancer-host>}} instead of {{HTTP/<oozie-server-host>}} at the
> same time so that clients (including Oozie servers, users, Web UI, etc) can
> talk to Oozie both through the load balancer and directly. If my
> understanding of HADOOP-10158 is correct, HADOOP-10158 adds this ability.
> For this JIRA, we should update Oozie to take advantage of HADOOP-10158.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
