[Impala-ASF-CR] KUDU-2198. Allow disregarding system-wide auth-to-local mapping

[Impala Public Jenkins (Code Review)]

Impala Public Jenkins has posted comments on this change. ( 
http://gerrit.cloudera.org:8080/8875 )

Change subject: KUDU-2198. Allow disregarding system-wide auth-to-local mapping
..


Patch Set 1: Verified+1


--
To view, visit http://gerrit.cloudera.org:8080/8875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I2e893493f52965ea54d2ceaac83d375285b49486
Gerrit-Change-Number: 8875
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Ho 
Gerrit-Reviewer: Impala Public Jenkins
Gerrit-Reviewer: Joe McDonnell 
Gerrit-Reviewer: Lars Volker 
Gerrit-Reviewer: Michael Ho 
Gerrit-Reviewer: Sailesh Mukil 
Gerrit-Reviewer: Todd Lipcon 
Gerrit-Comment-Date: Thu, 21 Dec 2017 00:13:40 +
Gerrit-HasComments: No

[Impala-ASF-CR] KUDU-2198. Allow disregarding system-wide auth-to-local mapping

[Impala Public Jenkins (Code Review)]

Impala Public Jenkins has submitted this change and it was merged. ( 
http://gerrit.cloudera.org:8080/8875 )

Change subject: KUDU-2198. Allow disregarding system-wide auth-to-local mapping
..

KUDU-2198. Allow disregarding system-wide auth-to-local mapping

This adds a workaround for an issue reported on the user mailing list.
Some systems are configured such that the auth_to_local mapping provided
by the krb5 library doesn't work properly for service accounts.

This patch adds a new configuration which allows Kudu to disregard the
system auth_to_local rules and instead just map kerberos principals to
their first component, which is typically the username.

Change-Id: I2e893493f52965ea54d2ceaac83d375285b49486
Reviewed-on: http://gerrit.cloudera.org:8080/8373
Reviewed-by: Alexey Serbin 
Reviewed-by: Dan Burkert 
Tested-by: Kudu Jenkins
Reviewed-on: http://gerrit.cloudera.org:8080/8875
Reviewed-by: Joe McDonnell 
Tested-by: Impala Public Jenkins
---
M be/src/kudu/security/init.cc
1 file changed, 24 insertions(+), 11 deletions(-)

Approvals:
  Joe McDonnell: Looks good to me, approved
  Impala Public Jenkins: Verified

--
To view, visit http://gerrit.cloudera.org:8080/8875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I2e893493f52965ea54d2ceaac83d375285b49486
Gerrit-Change-Number: 8875
Gerrit-PatchSet: 2
Gerrit-Owner: Michael Ho 
Gerrit-Reviewer: Impala Public Jenkins
Gerrit-Reviewer: Joe McDonnell 
Gerrit-Reviewer: Lars Volker 
Gerrit-Reviewer: Michael Ho 
Gerrit-Reviewer: Sailesh Mukil 
Gerrit-Reviewer: Todd Lipcon 

[Impala-ASF-CR] KUDU-2198. Allow disregarding system-wide auth-to-local mapping

[Impala Public Jenkins (Code Review)]

Impala Public Jenkins has posted comments on this change. ( 
http://gerrit.cloudera.org:8080/8875 )

Change subject: KUDU-2198. Allow disregarding system-wide auth-to-local mapping
..


Patch Set 1:

Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/1642/


--
To view, visit http://gerrit.cloudera.org:8080/8875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I2e893493f52965ea54d2ceaac83d375285b49486
Gerrit-Change-Number: 8875
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Ho 
Gerrit-Reviewer: Impala Public Jenkins
Gerrit-Reviewer: Joe McDonnell 
Gerrit-Reviewer: Lars Volker 
Gerrit-Reviewer: Michael Ho 
Gerrit-Reviewer: Sailesh Mukil 
Gerrit-Reviewer: Todd Lipcon 
Gerrit-Comment-Date: Wed, 20 Dec 2017 20:26:14 +
Gerrit-HasComments: No

[Impala-ASF-CR] KUDU-2198. Allow disregarding system-wide auth-to-local mapping

[Joe McDonnell (Code Review)]

Joe McDonnell has posted comments on this change. ( 
http://gerrit.cloudera.org:8080/8875 )

Change subject: KUDU-2198. Allow disregarding system-wide auth-to-local mapping
..


Patch Set 1: Code-Review+2

This is a straight-forward cherry pick.


--
To view, visit http://gerrit.cloudera.org:8080/8875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I2e893493f52965ea54d2ceaac83d375285b49486
Gerrit-Change-Number: 8875
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Ho 
Gerrit-Reviewer: Joe McDonnell 
Gerrit-Reviewer: Lars Volker 
Gerrit-Reviewer: Michael Ho 
Gerrit-Reviewer: Sailesh Mukil 
Gerrit-Reviewer: Todd Lipcon 
Gerrit-Comment-Date: Wed, 20 Dec 2017 02:11:24 +
Gerrit-HasComments: No

[Impala-ASF-CR] KUDU-2198. Allow disregarding system-wide auth-to-local mapping

[Michael Ho (Code Review)]

Michael Ho has removed Kudu Jenkins from this change.  ( 
http://gerrit.cloudera.org:8080/8875 )

Change subject: KUDU-2198. Allow disregarding system-wide auth-to-local mapping
..


Removed reviewer Kudu Jenkins.
--
To view, visit http://gerrit.cloudera.org:8080/8875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: deleteReviewer
Gerrit-Change-Id: I2e893493f52965ea54d2ceaac83d375285b49486
Gerrit-Change-Number: 8875
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Ho 
Gerrit-Reviewer: Alexey Serbin 
Gerrit-Reviewer: Dan Burkert 
Gerrit-Reviewer: Michael Ho 
Gerrit-Reviewer: Todd Lipcon 

[Impala-ASF-CR] KUDU-2198. Allow disregarding system-wide auth-to-local mapping

[Michael Ho (Code Review)]

Michael Ho has removed Dan Burkert from this change.  ( 
http://gerrit.cloudera.org:8080/8875 )

Change subject: KUDU-2198. Allow disregarding system-wide auth-to-local mapping
..


Removed reviewer Dan Burkert.
--
To view, visit http://gerrit.cloudera.org:8080/8875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: deleteReviewer
Gerrit-Change-Id: I2e893493f52965ea54d2ceaac83d375285b49486
Gerrit-Change-Number: 8875
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Ho 
Gerrit-Reviewer: Alexey Serbin 
Gerrit-Reviewer: Michael Ho 
Gerrit-Reviewer: Todd Lipcon 

[Impala-ASF-CR] KUDU-2198. Allow disregarding system-wide auth-to-local mapping

[Michael Ho (Code Review)]

Michael Ho has posted comments on this change. ( 
http://gerrit.cloudera.org:8080/8875 )

Change subject: KUDU-2198. Allow disregarding system-wide auth-to-local mapping
..


Patch Set 1:

(1 comment)

Mostly a clean cherry-pick albeit hiding the newly added flags for now.

http://gerrit.cloudera.org:8080/#/c/8875/1/be/src/kudu/security/init.cc
File be/src/kudu/security/init.cc:

http://gerrit.cloudera.org:8080/#/c/8875/1/be/src/kudu/security/init.cc@54
PS1, Line 54: DEFINE_bool_hidden
Switched to using DEFINE_bool_hidden here.



--
To view, visit http://gerrit.cloudera.org:8080/8875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I2e893493f52965ea54d2ceaac83d375285b49486
Gerrit-Change-Number: 8875
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Ho 
Gerrit-Reviewer: Alexey Serbin 
Gerrit-Reviewer: Dan Burkert 
Gerrit-Reviewer: Kudu Jenkins
Gerrit-Reviewer: Michael Ho 
Gerrit-Reviewer: Todd Lipcon 
Gerrit-Comment-Date: Tue, 19 Dec 2017 03:42:18 +
Gerrit-HasComments: Yes

[Impala-ASF-CR] KUDU-2198. Allow disregarding system-wide auth-to-local mapping

[Michael Ho (Code Review)]

Michael Ho has removed Alexey Serbin from this change.  ( 
http://gerrit.cloudera.org:8080/8875 )

Change subject: KUDU-2198. Allow disregarding system-wide auth-to-local mapping
..


Removed reviewer Alexey Serbin.
--
To view, visit http://gerrit.cloudera.org:8080/8875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: deleteReviewer
Gerrit-Change-Id: I2e893493f52965ea54d2ceaac83d375285b49486
Gerrit-Change-Number: 8875
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Ho 
Gerrit-Reviewer: Michael Ho 
Gerrit-Reviewer: Sailesh Mukil 
Gerrit-Reviewer: Todd Lipcon 

[Impala-ASF-CR] KUDU-2198. Allow disregarding system-wide auth-to-local mapping

[Michael Ho (Code Review)]

Hello Alexey Serbin, Dan Burkert, Kudu Jenkins,

I'd like you to do a code review. Please visit

http://gerrit.cloudera.org:8080/8875

to review the following change.


Change subject: KUDU-2198. Allow disregarding system-wide auth-to-local mapping
..

KUDU-2198. Allow disregarding system-wide auth-to-local mapping

This adds a workaround for an issue reported on the user mailing list.
Some systems are configured such that the auth_to_local mapping provided
by the krb5 library doesn't work properly for service accounts.

This patch adds a new configuration which allows Kudu to disregard the
system auth_to_local rules and instead just map kerberos principals to
their first component, which is typically the username.

Change-Id: I2e893493f52965ea54d2ceaac83d375285b49486
Reviewed-on: http://gerrit.cloudera.org:8080/8373
Reviewed-by: Alexey Serbin 
Reviewed-by: Dan Burkert 
Tested-by: Kudu Jenkins
---
M be/src/kudu/security/init.cc
1 file changed, 24 insertions(+), 11 deletions(-)



  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/75/8875/1
--
To view, visit http://gerrit.cloudera.org:8080/8875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I2e893493f52965ea54d2ceaac83d375285b49486
Gerrit-Change-Number: 8875
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Ho 
Gerrit-Reviewer: Alexey Serbin 
Gerrit-Reviewer: Dan Burkert 
Gerrit-Reviewer: Kudu Jenkins
Gerrit-Reviewer: Todd Lipcon