fapifta commented on PR #5404: URL: https://github.com/apache/ozone/pull/5404#issuecomment-1772525503
Thank you for the answer @ChenSammi. For delegation tokens, I see a potential problem, because the verification does happen based on the certificate, and to identify the certificate based on which we verify the DelegationToken, we use the certificate's serial ID. This does not necessarily means an error, and we should be ok with it, but atm we do not have tests for such a scenario. I think, we have an option to get the certificate from the SCM, ScmSecurityProtocol#getCertificate(String certSerialID) can provide the certificate in PEM format based on the certificate serial ID, which we have in the VERSION file or in the datanode.id file, and we can reach this method via the CertificateClient#getCertificate(String certId) method, which will try to download the certificate if the client does not have it cached already. These methods can get intermediate and root certificates as well, the only caveat is that SCM's should not use this recovery method, but that is true for creating a new CSR as well if that CSR is sent via the protocol not via an in process call for signing. Would you consider this approach to get the older certificate instead? I don't feel that it is more complex, maybe even simpler as we do not need to calculate the public key just get it from the certificate. All in all I am fine with both approach, I prefer re-fetching the certificate from SCM, but I can live with the other, so I leave it to your judgement after discussing it in detail already. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
