[
https://issues.apache.org/jira/browse/NIFI-5041?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16474367#comment-16474367
]
ASF GitHub Bot commented on NIFI-5041:
--------------------------------------
Github user peter-toth commented on the issue:
https://github.com/apache/nifi/pull/2630
Hi @mattyb149,
Thanks for the feedback, I amended the error handling a bit:
- Processor is yielded now if there is no session available
- KerberosKeytabSPNegoScheme throws a ProcessException on a Kerberos error,
so the flow file will be penalized automatically
- CS session manager thread no longer dies on an exception, it goes to
sleep instead and then retries to fill up the sessions
> Add convenient SPNEGO/Kerberos authentication support to LivySessionController
> ------------------------------------------------------------------------------
>
> Key: NIFI-5041
> URL: https://issues.apache.org/jira/browse/NIFI-5041
> Project: Apache NiFi
> Issue Type: Improvement
> Reporter: Peter Toth
> Priority: Minor
>
> Livy requires SPNEGO/Kerberos authentication on a secured cluster. Initiating
> such an authentication from NiFi is a viable by providing a
> java.security.auth.login.config system property
> (https://docs.oracle.com/javase/8/docs/technotes/guides/security/jgss/lab/part6.html),
> but this is a bit cumbersome and needs kinit running outside of NiFi.
> An alternative and more sophisticated solution would be to do the SPNEGO
> negotiation programmatically.
> * This solution would add some new properties to the LivySessionController
> to fetch kerberos principal and password/keytab
> * Add the required HTTP Negotiate header (with an SPNEGO token) to the
> HttpURLConnection to do the authentication programmatically
> (https://tools.ietf.org/html/rfc4559)
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
