[
https://issues.apache.org/jira/browse/STORM-346?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14065634#comment-14065634
]
ASF GitHub Bot commented on STORM-346:
--------------------------------------
Github user revans2 commented on the pull request:
https://github.com/apache/incubator-storm/pull/190#issuecomment-49372008
I really guess I didn't explain things very well in the JIRA. So the
current way IAutoCredentials and ICredentialsRenewer work with nimbus are.
IAutoCredentials will run on the gateway as the topology user. It gets
handed a map that it can place any credentials in needs into.
Those credentials are uploaded to nimbus, which places them in zookeeper.
Periodically nimbus will download the serialized credentials and hand them
to ICredentialsRenewer which will run as the nimbus user. If it modifies the
the credentials they are pushed to zookeeper.
At the same time the worker running as the topology user will download the
credentials from zookeeper and pass them to IAutoCredentials to the passed in
Subject with them. This repeats any time the credentials change in zookeeper.
What I would like to see is something where IAutoCredentials has an option
of not running on the gateway, or it is a noop on the gateway. Instead after
the credentials are submitted to nimbus, something similar to, or an extended
version of ICredentialsRenewer would run as the nimbus user and get the
credentials on behalf of the topology user.
The rest of the process would stay the same, except if a token is about to
expire completely. In that case it would fetch a brand new token.
> (Security) Oozie style delegation tokens for HDFS/HBase
> -------------------------------------------------------
>
> Key: STORM-346
> URL: https://issues.apache.org/jira/browse/STORM-346
> Project: Apache Storm (Incubating)
> Issue Type: Bug
> Reporter: Robert Joseph Evans
> Assignee: Parth Brahmbhatt
> Labels: security
>
> Oozie has the ability to fetch delegation tokens on behalf of other users by
> running as a super user that can become a proxy user for almost anyone else.
> We should build one or more classes similar to AutoTGT that can fetch a
> delegation token for HDFS/HBase, renew the token if needed, and then once the
> token is about to permanently expire fetch a new one.
> According to some people I have talked with HBase may need to have a JIRA
> filed against it so that it can pick up a new delegation token without
> needing to restart the process.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
