[
https://issues.apache.org/jira/browse/STORM-346?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14073692#comment-14073692
]
ASF GitHub Bot commented on STORM-346:
--------------------------------------
Github user Parth-Brahmbhatt commented on the pull request:
https://github.com/apache/incubator-storm/pull/190#issuecomment-50082444
Added a unit test on nimbus to verify that the credentials will be
populated as part of submit topology. I did not find any equivalent unit test
for renewers so I added renewer test as well, I think I found a bug in nimbus's
renew-credentials method. When old and new credentials do not match, the method
calls
(.set-credentials! storm-cluster-state id new-creds) which seems to be
missing a parameter topology-conf so I changed it to (.set-credentials!
storm-cluster-state id new-creds topology-conf).
The test passed after this change but please confirm that this is indeed a
bug and let me know if you want to file a separate JIRA for it.
> (Security) Oozie style delegation tokens for HDFS/HBase
> -------------------------------------------------------
>
> Key: STORM-346
> URL: https://issues.apache.org/jira/browse/STORM-346
> Project: Apache Storm (Incubating)
> Issue Type: Bug
> Reporter: Robert Joseph Evans
> Assignee: Parth Brahmbhatt
> Labels: security
>
> Oozie has the ability to fetch delegation tokens on behalf of other users by
> running as a super user that can become a proxy user for almost anyone else.
> We should build one or more classes similar to AutoTGT that can fetch a
> delegation token for HDFS/HBase, renew the token if needed, and then once the
> token is about to permanently expire fetch a new one.
> According to some people I have talked with HBase may need to have a JIRA
> filed against it so that it can pick up a new delegation token without
> needing to restart the process.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
