> On Aug. 1, 2016, 3:17 a.m., Sumit Mohanty wrote:
> > ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/package/scripts/params_linux.py,
> >  line 150
> > <https://reviews.apache.org/r/50647/diff/1/?file=1458849#file1458849line150>
> >
> >     Will the removal of the check cause issues for Ambari upgrade for a 
> > deployed 2.1 or 2.2 cluster?

Sorry missed the whole change - ignore.


- Sumit


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50647/#review144299
-----------------------------------------------------------


On Aug. 1, 2016, 2 a.m., Robert Levas wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/50647/
> -----------------------------------------------------------
> 
> (Updated Aug. 1, 2016, 2 a.m.)
> 
> 
> Review request for Ambari, Alejandro Fernandez, Andrew Onischuk, Jonathan 
> Hurley, Jayush Luniya, Sumit Mohanty, Vitalyi Brodetskyi, and Venkat 
> Ranganathan.
> 
> 
> Bugs: AMBARI-17968
>     https://issues.apache.org/jira/browse/AMBARI-17968
> 
> 
> Repository: ambari
> 
> 
> Description
> -------
> 
> Changed `oozie-site/oozie.authentication.kerberos.principal` and 
> `oozie-site/oozie.authentication.kerberos.keytab` properties are reverted 
> while regenerating keytab files.
> 
> The changed properties are needed to support Oozie in high availability (HA) 
> mode with failover enabled via a load balancing proxy server.
> 
> # Cause
> The relevant part of the Kerberos descriptor for Oozie is:
> ```
>             {
>               "name": "/spnego",
>               "principal": {
>                 "configuration": 
> "oozie-site/oozie.authentication.kerberos.principal"
>               },
>               "keytab": {
>                 "configuration": 
> "oozie-site/oozie.authentication.kerberos.keytab"
>               }
>             }
> ```
> 
> Because of this, certain Kerberos-related operations (like Regenerate 
> Keytabs) resets the values of 
> `oozie-site/oozie.authentication.kerberos.principal` and 
> `oozie-site/oozie.authentication.kerberos.keytab` to match the principal name 
> and keytab file of the Kerberos identity definition for `/spnego`.
> 
> However, in HA, the properties need to be something like:
> ```
> oozie.authentication.kerberos.prinipal= "*"
> oozie.authentication.kerberos.keytab = "/path/to/oozie_ha.keytab"
> ```
> 
> # Solution
> After enabling HA and either before or after enabling Kerberos, the following 
> `oozie-site` properties may be set:
> * `oozie.ha.authentication.kerberos.principal`
> * `oozie.ha.authentication.kerberos.keytab`
> 
> If either exist when configuring Oozie, the value of the property will be 
> used to update the relevant `oozie.authentication.kerberos.*` property.
> 
> For example:
> * if `oozie.ha.authentication.kerberos.principal` is set, its value will set 
> used to set `oozie.authentication.kerberos.principal`
> * if `oozie.ha.authentication.kerberos.keytab` is set, its value will set 
> used to set `oozie.authentication.kerberos.keytab`
> Note: One or both may be set. 
> 
> So even though `oozie.authentication.kerberos.principal` will contain a 
> principal name like `HTTP/_HOST@SOME.REALM`, when writing the oozie-site.xml 
> file, the value for `oozie.authentication.kerberos.principal` will be written 
> out as the value set for `oozie.ha.authentication.kerberos.principal`, which 
> would typically be "*", when HA is enabled for Oozie.
> 
> 
> Diffs
> -----
> 
>   
> ambari-server/src/main/java/org/apache/ambari/server/controller/internal/BlueprintConfigurationProcessor.java
>  23c9edc 
>   
> ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/package/scripts/params_linux.py
>  00229d3 
>   ambari-server/src/test/python/stacks/2.0.6/OOZIE/test_oozie_server.py 
> 99d6dec 
> 
> Diff: https://reviews.apache.org/r/50647/diff/
> 
> 
> Testing
> -------
> 
> Manually tested
> 
> # Local test results: 
> 
> [INFO] 
> ------------------------------------------------------------------------
> [INFO] BUILD SUCCESS
> [INFO] 
> ------------------------------------------------------------------------
> [INFO] Total time: 1:19.684s
> [INFO] Finished at: Sun Jul 31 21:36:24 EDT 2016
> [INFO] Final Memory: 71M/1705M
> [INFO] 
> ------------------------------------------------------------------------
> 
> # Jenkins test results: PENDING
> 
> 
> Thanks,
> 
> Robert Levas
> 
>

Reply via email to