[
https://issues.apache.org/jira/browse/STORM-346?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14074780#comment-14074780
]
ASF GitHub Bot commented on STORM-346:
--------------------------------------
Github user revans2 commented on a diff in the pull request:
https://github.com/apache/incubator-storm/pull/190#discussion_r15419109
--- Diff: storm-core/src/clj/backtype/storm/daemon/nimbus.clj ---
@@ -1046,7 +1047,10 @@
(dissoc storm-conf
STORM-ZOOKEEPER-TOPOLOGY-AUTH-SCHEME STORM-ZOOKEEPER-TOPOLOGY-AUTH-PAYLOAD))
total-storm-conf (merge conf storm-conf)
topology (normalize-topology total-storm-conf topology)
+ nimbus-autocred-plugins
(AuthUtils/getNimbusAutoCredPlugins total-storm-conf)
--- End diff --
Why does the plugin need to be cleaned up as soon as the submission is
over? Creating an object each time a method is called feels like a lot of
overhead to me. It also makes it so that the plugin does not have the option
to cache things and amortize the overhead across multiple calls. Not that the
code currently needs to worry about it, as the current code is more or less
just a static function.
> If we generate these instances at startup then it means anyone wanting to
use it will have to change the nimbus config and restart nimbus.
Yes, I can see that. But that is kind of what I want. It becomes a
balancing act between convenience/insecurity and security/inconvenience. I
just feel nervous that anything on the classpath the user gets to decide to
load it into memory. It feels like it is too open ended, but honestly if you
feel strongly about it I will not push it. I would just want the config
changed so that it is prefixed with topology instead of nimbus so that it is
obvious that it is a topology specific config.
> (Security) Oozie style delegation tokens for HDFS/HBase
> -------------------------------------------------------
>
> Key: STORM-346
> URL: https://issues.apache.org/jira/browse/STORM-346
> Project: Apache Storm (Incubating)
> Issue Type: Bug
> Reporter: Robert Joseph Evans
> Assignee: Parth Brahmbhatt
> Labels: security
>
> Oozie has the ability to fetch delegation tokens on behalf of other users by
> running as a super user that can become a proxy user for almost anyone else.
> We should build one or more classes similar to AutoTGT that can fetch a
> delegation token for HDFS/HBase, renew the token if needed, and then once the
> token is about to permanently expire fetch a new one.
> According to some people I have talked with HBase may need to have a JIRA
> filed against it so that it can pick up a new delegation token without
> needing to restart the process.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
