[
https://issues.apache.org/jira/browse/NIFI-5041?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16484090#comment-16484090
]
ASF GitHub Bot commented on NIFI-5041:
--------------------------------------
Github user peter-toth commented on a diff in the pull request:
https://github.com/apache/nifi/pull/2630#discussion_r189932016
--- Diff:
nifi-nar-bundles/nifi-spark-bundle/nifi-livy-controller-service/src/main/java/org/apache/nifi/controller/livy/LivySessionController.java
---
@@ -551,4 +561,11 @@ private SSLContext
getSslSocketFactory(SSLContextService sslService)
return sslContext;
}
+ private void checkSessionManagerError() throws IOException {
+ Exception exception = sessionManagerError;
+ if (exception != null) {
+ throw new IOException(exception);
--- End diff --
good idea @mattyb149, added a new SessionManagerException
> Add convenient SPNEGO/Kerberos authentication support to LivySessionController
> ------------------------------------------------------------------------------
>
> Key: NIFI-5041
> URL: https://issues.apache.org/jira/browse/NIFI-5041
> Project: Apache NiFi
> Issue Type: Improvement
> Reporter: Peter Toth
> Priority: Minor
>
> Livy requires SPNEGO/Kerberos authentication on a secured cluster. Initiating
> such an authentication from NiFi is a viable by providing a
> java.security.auth.login.config system property
> (https://docs.oracle.com/javase/8/docs/technotes/guides/security/jgss/lab/part6.html),
> but this is a bit cumbersome and needs kinit running outside of NiFi.
> An alternative and more sophisticated solution would be to do the SPNEGO
> negotiation programmatically.
> * This solution would add some new properties to the LivySessionController
> to fetch kerberos principal and password/keytab
> * Add the required HTTP Negotiate header (with an SPNEGO token) to the
> HttpURLConnection to do the authentication programmatically
> (https://tools.ietf.org/html/rfc4559)
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
