[
https://issues.apache.org/jira/browse/HDFS-13081?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16952282#comment-16952282
]
Chen Liang commented on HDFS-13081:
-----------------------------------
Hey folks, any plan to backport to branch-2? I do try do the backport if no
objection/concerns.
> Datanode#checkSecureConfig should allow SASL and privileged HTTP
> ----------------------------------------------------------------
>
> Key: HDFS-13081
> URL: https://issues.apache.org/jira/browse/HDFS-13081
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: datanode, security
> Affects Versions: 3.0.0
> Reporter: Xiaoyu Yao
> Assignee: Ajay Kumar
> Priority: Major
> Fix For: 3.1.0, 3.0.3
>
> Attachments: HDFS-13081.000.patch, HDFS-13081.001.patch,
> HDFS-13081.002.patch, HDFS-13081.003.patch, HDFS-13081.004.patch,
> HDFS-13081.005.patch, HDFS-13081.006.patch
>
>
> Datanode#checkSecureConfig currently check the following to determine if
> secure datanode is enabled.
> # The server has bound to privileged ports for RPC and HTTP via
> SecureDataNodeStarter.
> # The configuration enables SASL on DataTransferProtocol and HTTPS (no plain
> HTTP) for the HTTP server.
> Authentication of Datanode RPC server can be done either via SASL handshake
> or JSVC/privilege RPC port.
> This guarantees authentication of the datanode RPC server before a client
> transmits a secret, such as a block access token.
> Authentication of the HTTP server can also be done either via HTTPS/SSL or
> JSVC/privilege HTTP port. This guarantees authentication of datandoe HTTP
> server before a client transmits a secret, such as a delegation token.
> This ticket is open to allow privileged HTTP as an alternative to HTTPS to
> work with SASL based RPC protection.
>
> cc: [~cnauroth] , [~daryn], [~jnpandey] for additional feedback.
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
