Hao Hao has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/15414 )
Change subject: [java] fix Kudu Ranger plugin when Ranger is Kerberized ...................................................................... [java] fix Kudu Ranger plugin when Ranger is Kerberized Kudu Ranger plugin currently failed to connect to the Ranger service if it is Kerberized. This patch fixes it by login 'kudu' user via calling UserGroupInformation.loginUserFromKeytab, since Ranger client-side library RangerAdminRESTClient uses UserGroupInformation to determine if Kerberos is enabled. Note that the Ranger client side library also handles Kerberos re-login/renewal via calling UserGroupInformation.checkTGTAndReloginFromKeytab. This patch also introduces two new properties 'principal' and 'keytab' in SubprocessConfiguration as they are generic enough for other subprocess type to use as well. Since MiniRanger is not available yet, I did manual tests to ensure the Ranger plugin is able to connect to the Ranger service on a secured cluster (even after running for longer than the Kerberos ticket and renewal lifetime). Change-Id: Ibe043293ea9cc1c2f43a331603dc1e3b36ff6ae0 Reviewed-on: http://gerrit.cloudera.org:8080/15414 Reviewed-by: Andrew Wong <aw...@cloudera.com> Tested-by: Hao Hao <hao....@cloudera.com> --- M java/kudu-subprocess/src/main/java/org/apache/kudu/subprocess/KuduSubprocessException.java M java/kudu-subprocess/src/main/java/org/apache/kudu/subprocess/SubprocessConfiguration.java M java/kudu-subprocess/src/main/java/org/apache/kudu/subprocess/SubprocessExecutor.java M java/kudu-subprocess/src/main/java/org/apache/kudu/subprocess/echo/EchoSubprocessMain.java M java/kudu-subprocess/src/main/java/org/apache/kudu/subprocess/ranger/RangerProtocolHandler.java M java/kudu-subprocess/src/main/java/org/apache/kudu/subprocess/ranger/RangerSubprocessMain.java M java/kudu-subprocess/src/main/java/org/apache/kudu/subprocess/ranger/authorization/RangerKuduAuthorizer.java M java/kudu-subprocess/src/test/java/org/apache/kudu/subprocess/echo/TestEchoSubprocess.java M java/kudu-subprocess/src/test/java/org/apache/kudu/subprocess/ranger/TestRangerSubprocess.java 9 files changed, 101 insertions(+), 20 deletions(-) Approvals: Andrew Wong: Looks good to me, approved Hao Hao: Verified -- To view, visit http://gerrit.cloudera.org:8080/15414 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: merged Gerrit-Change-Id: Ibe043293ea9cc1c2f43a331603dc1e3b36ff6ae0 Gerrit-Change-Number: 15414 Gerrit-PatchSet: 8 Gerrit-Owner: Hao Hao <hao....@cloudera.com> Gerrit-Reviewer: Adar Dembo <a...@cloudera.com> Gerrit-Reviewer: Andrew Wong <aw...@cloudera.com> Gerrit-Reviewer: Attila Bukor <abu...@apache.org> Gerrit-Reviewer: Grant Henke <granthe...@apache.org> Gerrit-Reviewer: Hao Hao <hao....@cloudera.com> Gerrit-Reviewer: Kudu Jenkins (120)
