[
https://issues.apache.org/jira/browse/STORM-346?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14074659#comment-14074659
]
ASF GitHub Bot commented on STORM-346:
--------------------------------------
Github user revans2 commented on a diff in the pull request:
https://github.com/apache/incubator-storm/pull/190#discussion_r15414374
--- Diff: storm-core/src/jvm/backtype/storm/Config.java ---
@@ -1186,7 +1193,15 @@
*/
public static final String TOPOLOGY_ISOLATED_MACHINES =
"topology.isolate.machines";
public static final Object TOPOLOGY_ISOLATED_MACHINES_SCHEMA =
Number.class;
-
+
+ /**
+ * HDFS information, used to get the delegation token on behalf of the
topology
+ * submitter user and renew the tokens. see {@link
backtype.storm.security.auth.kerberos.AutoHDFS}
+ * kerberos principal name with realm should be provided.
+ */
+ public static final Object HDFS_PRINCIPAL = "topology.hdfs.user";
--- End diff --
can we name this TOPOLOGY_HDFS_PRINCIPAL? just so it is clear it is for the
topology, even in the clojure/java code.
> (Security) Oozie style delegation tokens for HDFS/HBase
> -------------------------------------------------------
>
> Key: STORM-346
> URL: https://issues.apache.org/jira/browse/STORM-346
> Project: Apache Storm (Incubating)
> Issue Type: Bug
> Reporter: Robert Joseph Evans
> Assignee: Parth Brahmbhatt
> Labels: security
>
> Oozie has the ability to fetch delegation tokens on behalf of other users by
> running as a super user that can become a proxy user for almost anyone else.
> We should build one or more classes similar to AutoTGT that can fetch a
> delegation token for HDFS/HBase, renew the token if needed, and then once the
> token is about to permanently expire fetch a new one.
> According to some people I have talked with HBase may need to have a JIRA
> filed against it so that it can pick up a new delegation token without
> needing to restart the process.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
