[
https://issues.apache.org/jira/browse/MAPREDUCE-7236?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Yicong Cai updated MAPREDUCE-7236:
----------------------------------
Summary: HadoopArchiveLogs will use token to create proxy user when
kerberos on (was: HadoopArchiveLogs use token to create proxy user)
> HadoopArchiveLogs will use token to create proxy user when kerberos on
> ----------------------------------------------------------------------
>
> Key: MAPREDUCE-7236
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-7236
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Affects Versions: 2.9.2
> Reporter: Yicong Cai
> Priority: Major
>
> HadoopArchiveLogsRunner runs in the Yarn Container via DistributedShell.
> The Client of the DistributedShell gets the Token and uses it for the Runner.
> The Runner create ProxyUser via Token, which violates the ProxyUser principle.
> There are two solutions:
> 1. Pass the Keytab to the Runner, login with Keytab and create ProxyUser.
> 2. Run the HadoopArchiveLogs task with HDFS Super User. After the Archive is
> finished, use chown to modify it to the corresponding user.
> I prefer to use the first way to solve the problem. Any suggestions?
--
This message was sent by Atlassian Jira
(v8.3.2#803003)
---------------------------------------------------------------------
To unsubscribe, e-mail: mapreduce-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: mapreduce-issues-h...@hadoop.apache.org
