[
https://issues.apache.org/jira/browse/HDDS-5052?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bharat Viswanadham updated HDDS-5052:
-------------------------------------
Description:
This Jira is to handle leader change between getScmInfo and getScmSignedCert.
*Problem:*
*Leader is SCM1 - Returned SCMID is SCM1ID*
ScmInfo returns the leader SCMID
*Leader is SCM2 - SCM ID is SCM2ID*
getSCMSignedCert, during generate certificate it has a check compare the scmId
passed in CSR, is same as current SCM scmID
In this case when the leader change between these 2 calls OM will fail to get a
Certificate.
*Proposed Solution:*
getScmInfo returns primary SCM ID, and OM can pass this Primary SCM ID in CSR.
In this way, even if the leader changes OM can still get a certificate.
Note: primary SCM Id is the same across the SCM HA quorum nodes.
was:
This Jira is to handle leader change between getScmInfo and getScmSignedCert.
*Problem:*
ScmInfo returns the leader SCMID
getSCMSignedCert, during generate certificate it has a check compare the scmId
passed in CSR, is same as current SCM scmID
In this case when the leader change between these 2 calls OM will fail to get a
Certificate.
*Proposed Solution:*
getScmInfo returns primary SCM ID, and OM can pass this Primary SCM ID in CSR.
In this way, even if the leader changes OM can still get a certificate.
Note: primary SCM Id is the same across the SCM HA quorum nodes.
> [SCM HA Security] Handle leader changes between SCMInfo and getSCMSigned Cert
> in OM
> -----------------------------------------------------------------------------------
>
> Key: HDDS-5052
> URL: https://issues.apache.org/jira/browse/HDDS-5052
> Project: Apache Ozone
> Issue Type: Bug
> Reporter: Bharat Viswanadham
> Assignee: Bharat Viswanadham
> Priority: Major
>
> This Jira is to handle leader change between getScmInfo and getScmSignedCert.
> *Problem:*
> *Leader is SCM1 - Returned SCMID is SCM1ID*
> ScmInfo returns the leader SCMID
> *Leader is SCM2 - SCM ID is SCM2ID*
> getSCMSignedCert, during generate certificate it has a check compare the
> scmId passed in CSR, is same as current SCM scmID
> In this case when the leader change between these 2 calls OM will fail to get
> a Certificate.
> *Proposed Solution:*
> getScmInfo returns primary SCM ID, and OM can pass this Primary SCM ID in CSR.
> In this way, even if the leader changes OM can still get a certificate.
> Note: primary SCM Id is the same across the SCM HA quorum nodes.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
