Re: Review Request 52102: UI for user home directory creation

2016-09-20 Thread Zhe (Joe) Wang 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52102/#review149764
---


Ship it!




Ship It!

- Zhe (Joe) Wang


On Sept. 21, 2016, 12:04 a.m., Richard Zang wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/52102/
> ---
> 
> (Updated Sept. 21, 2016, 12:04 a.m.)
> 
> 
> Review request for Ambari and Zhe (Joe) Wang.
> 
> 
> Bugs: AMBARI-15059
> https://issues.apache.org/jira/browse/AMBARI-15059
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> Add extra handling logic for navigating out and save button.
> 
> 
> Diffs
> -
> 
>   
> ambari-admin/src/main/resources/ui/admin-web/app/scripts/controllers/loginActivities/HomeDirectoryCtrl.js
>  582b68b 
>   
> ambari-admin/src/main/resources/ui/admin-web/app/views/loginActivities/homeDirectory.html
>  ee5d860 
> 
> Diff: https://reviews.apache.org/r/52102/diff/
> 
> 
> Testing
> ---
> 
> Manually tested on live cluster.
> All unit tests passed.
> PhantomJS 1.9.7 (Mac OS X): Executed 76 of 76 SUCCESS (0.191 secs / 0.408 
> secs)
> 
> 
> Thanks,
> 
> Richard Zang
> 
>

Re: Review Request 52102: UI for user home directory creation

2016-09-20 Thread Richard Zang 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52102/
---

(Updated Sept. 21, 2016, 12:04 a.m.)


Review request for Ambari and Zhe (Joe) Wang.


Changes
---

remove IDE related indentation


Bugs: AMBARI-15059
https://issues.apache.org/jira/browse/AMBARI-15059


Repository: ambari


Description
---

Add extra handling logic for navigating out and save button.


Diffs (updated)
-

  
ambari-admin/src/main/resources/ui/admin-web/app/scripts/controllers/loginActivities/HomeDirectoryCtrl.js
 582b68b 
  
ambari-admin/src/main/resources/ui/admin-web/app/views/loginActivities/homeDirectory.html
 ee5d860 

Diff: https://reviews.apache.org/r/52102/diff/


Testing
---

Manually tested on live cluster.
All unit tests passed.
PhantomJS 1.9.7 (Mac OS X): Executed 76 of 76 SUCCESS (0.191 secs / 0.408 secs)


Thanks,

Richard Zang

Re: Review Request 52102: UI for user home directory creation

2016-09-20 Thread Zhe (Joe) Wang 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52102/#review149757
---




ambari-admin/src/main/resources/ui/admin-web/app/scripts/controllers/loginActivities/HomeDirectoryCtrl.js
 (line 24)


Indent?


- Zhe (Joe) Wang


On Sept. 20, 2016, 10:59 p.m., Richard Zang wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/52102/
> ---
> 
> (Updated Sept. 20, 2016, 10:59 p.m.)
> 
> 
> Review request for Ambari and Zhe (Joe) Wang.
> 
> 
> Bugs: AMBARI-15059
> https://issues.apache.org/jira/browse/AMBARI-15059
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> Add extra handling logic for navigating out and save button.
> 
> 
> Diffs
> -
> 
>   
> ambari-admin/src/main/resources/ui/admin-web/app/scripts/controllers/loginActivities/HomeDirectoryCtrl.js
>  582b68b 
>   
> ambari-admin/src/main/resources/ui/admin-web/app/views/loginActivities/homeDirectory.html
>  ee5d860 
> 
> Diff: https://reviews.apache.org/r/52102/diff/
> 
> 
> Testing
> ---
> 
> Manually tested on live cluster.
> All unit tests passed.
> PhantomJS 1.9.7 (Mac OS X): Executed 76 of 76 SUCCESS (0.191 secs / 0.408 
> secs)
> 
> 
> Thanks,
> 
> Richard Zang
> 
>

Re: Review Request 51815: Introduce conditional dependencies in stack defition to handle blueprint validation gracefully

2016-09-20 Thread Amruta Borkar 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/51815/
---

(Updated Sept. 20, 2016, 11:18 p.m.)


Review request for Ambari, Shantanu Mundkur, Di Li, Jayush Luniya, Juanjo  
Marron, Laszlo Puskas, and Robert Nettleton.


Changes
---

Hello,  I have added  tag to represent different 
condition-types and made two sub-types 'IF-PROPERTY-EXISTS' and 
'PROPERTY-VALUE-EQUALS'. Also addressed other two changes suggested by Robert. 
I am still working on adding more test cases. Please review and provide 
feedback.


Bugs: AMBARI-18355
https://issues.apache.org/jira/browse/AMBARI-18355


Repository: ambari


Description
---

Currently stack definitions do not list conditional dependencies, adding those 
to the stack definitions would make it easy to validate errors in case of 
blueprint deployment. Please refer to document attached to Jira


Diffs (updated)
-

  
ambari-server/src/main/java/org/apache/ambari/server/state/DependencyConditionInfo.java
 PRE-CREATION 
  
ambari-server/src/main/java/org/apache/ambari/server/state/DependencyInfo.java 
e3db662 
  
ambari-server/src/main/java/org/apache/ambari/server/topology/BlueprintValidatorImpl.java
 a5f33ff 
  ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/metainfo.xml 
65d166a 
  
ambari-server/src/test/java/org/apache/ambari/server/topology/BlueprintValidatorImplTest.java
 b1de8ef 

Diff: https://reviews.apache.org/r/51815/diff/


Testing
---

Written Junit test cases. Perfomred manual testing to check the Namenode HA 
component dependency. Was able to proceed with the installation for valid 
blueprint. and got validation error message while registering blueprint when 
the Blueprint did not satisfy the conditional dependencies.


Thanks,

Amruta Borkar

Review Request 52102: UI for user home directory creation

2016-09-20 Thread Richard Zang 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52102/
---

Review request for Ambari and Zhe (Joe) Wang.


Bugs: AMBARI-15059
https://issues.apache.org/jira/browse/AMBARI-15059


Repository: ambari


Description
---

Add extra handling logic for navigating out and save button.


Diffs
-

  
ambari-admin/src/main/resources/ui/admin-web/app/scripts/controllers/loginActivities/HomeDirectoryCtrl.js
 582b68b 
  
ambari-admin/src/main/resources/ui/admin-web/app/views/loginActivities/homeDirectory.html
 ee5d860 

Diff: https://reviews.apache.org/r/52102/diff/


Testing
---

Manually tested on live cluster.
All unit tests passed.
PhantomJS 1.9.7 (Mac OS X): Executed 76 of 76 SUCCESS (0.191 secs / 0.408 secs)


Thanks,

Richard Zang

Re: Review Request 51815: Introduce conditional dependencies in stack defition to handle blueprint validation gracefully

2016-09-20 Thread Jayush Luniya 


> On Sept. 16, 2016, 3:44 p.m., Robert Nettleton wrote:
> > Thanks for providing this patch.  This is a feature in Blueprints that is 
> > sorely needed, and will be beneficial for Blueprints generally. 
> > 
> > I would ask, if possible, that some consideration be put into making the 
> > XML syntax for specifying conditions on dependencies a little more generic, 
> > and then making the two conditional types implemented here be subtypes of 
> > the generic type.  My thinking here is that having this be just a little 
> > more flexible may benefit Blueprints in the future, as more conditional 
> > types may be required for different usage types.  
> > 
> > I agree completely that conditions based on configuration are the most 
> > common, and the two conditional types implemented are likely to be used in 
> > a variety of ways across the stacks, but it would be great if these were 
> > treated as specific sub-types of the condition, to make future conditions 
> > easier to add. 
> > 
> > Can you please add Jayush Lunia to this review list?  I believe he's 
> > looking at some stack-level refactorings, so it would be good to get his 
> > input as well.
> > 
> > Thanks.

Generally I agree with the comments here. We should categorize the type of 
condition too by adding condition-type property (i.e. 
config).


- Jayush


---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/51815/#review149205
---


On Sept. 16, 2016, 4:57 p.m., Amruta Borkar wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/51815/
> ---
> 
> (Updated Sept. 16, 2016, 4:57 p.m.)
> 
> 
> Review request for Ambari, Shantanu Mundkur, Di Li, Jayush Luniya, Juanjo  
> Marron, Laszlo Puskas, and Robert Nettleton.
> 
> 
> Bugs: AMBARI-18355
> https://issues.apache.org/jira/browse/AMBARI-18355
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> Currently stack definitions do not list conditional dependencies, adding 
> those to the stack definitions would make it easy to validate errors in case 
> of blueprint deployment. Please refer to document attached to Jira
> 
> 
> Diffs
> -
> 
>   
> ambari-server/src/main/java/org/apache/ambari/server/state/DependencyConditionInfo.java
>  PRE-CREATION 
>   
> ambari-server/src/main/java/org/apache/ambari/server/state/DependencyInfo.java
>  e3db662 
>   
> ambari-server/src/main/java/org/apache/ambari/server/topology/BlueprintValidatorImpl.java
>  a5f33ff 
>   
> ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/metainfo.xml 
> 65d166a 
>   
> ambari-server/src/test/java/org/apache/ambari/server/topology/BlueprintValidatorImplTest.java
>  b1de8ef 
> 
> Diff: https://reviews.apache.org/r/51815/diff/
> 
> 
> Testing
> ---
> 
> Written Junit test cases. Perfomred manual testing to check the Namenode HA 
> component dependency. Was able to proceed with the installation for valid 
> blueprint. and got validation error message while registering blueprint when 
> the Blueprint did not satisfy the conditional dependencies.
> 
> 
> Thanks,
> 
> Amruta Borkar
> 
>

Re: Review Request 52038: AMBARI-18418 StackServiceDirectory debug messages are logged with placeholders

2016-09-20 Thread Jayush Luniya 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52038/#review149742
---


Ship it!




Ship It!

- Jayush Luniya


On Sept. 19, 2016, 2:28 p.m., Attila Doroszlai wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/52038/
> ---
> 
> (Updated Sept. 19, 2016, 2:28 p.m.)
> 
> 
> Review request for Ambari, Balázs Bence Sári, Jayush Luniya, Oliver Szabo, 
> and Sebastian Toader.
> 
> 
> Bugs: AMBARI-18418
> https://issues.apache.org/jira/browse/AMBARI-18418
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> Replaced String.format placeholders with Log4J placeholders
> 
> 
> Diffs
> -
> 
>   
> ambari-server/src/main/java/org/apache/ambari/server/stack/StackServiceDirectory.java
>  a8b4632 
> 
> Diff: https://reviews.apache.org/r/52038/diff/
> 
> 
> Testing
> ---
> 
> * Set `log4j.rootLogger=DEBUG,file` in 
> `/etc/ambari-server/conf/log4j.properties`
>  * Start Ambari server (no cluster needed)
>  * Verify `StackServiceDirectory` messages contain service name, stack name, 
> not %s placeholders
>Example:
>  wrong: `19 Sep 2016 14:01:08,380 DEBUG [main] StackServiceDirectory:159 
> - Service package folder %s for service %s for stack %s does not exist.`
>  good: `19 Sep 2016 14:07:22,651 DEBUG [main] StackServiceDirectory:159 - 
> Service package folder 
> /var/lib/ambari-server/resources/stacks/HDP/2.4/services/ACCUMULO/package for 
> service ACCUMULO for stack HDP-2.4 does not exist.`
> 
> 
> Thanks,
> 
> Attila Doroszlai
> 
>

Re: Review Request 52072: AMBARI-18390 : Configuration warnings during "Add Service" Wizard includes seemingly nonsensical heapsize recommendations for AMS heap sizes.

2016-09-20 Thread Sid Wagle 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52072/#review149725
---


Ship it!




Ship It!

- Sid Wagle


On Sept. 20, 2016, 5:11 p.m., Aravindan Vijayan wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/52072/
> ---
> 
> (Updated Sept. 20, 2016, 5:11 p.m.)
> 
> 
> Review request for Ambari, Dmytro Sen, Sumit Mohanty, and Sid Wagle.
> 
> 
> Bugs: AMBARI-18390
> https://issues.apache.org/jira/browse/AMBARI-18390
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> AMS stack validations for Metrics collector and HBase heap sizes based on 
> unused memory on host were wrongly calculated.
> 
> 
> Diffs
> -
> 
>   ambari-server/src/main/resources/stacks/HDP/2.0.6/services/stack_advisor.py 
> fd0dfed 
> 
> Diff: https://reviews.apache.org/r/52072/diff/
> 
> 
> Testing
> ---
> 
> Manually tested.
> Ambari-server python unit tests pass.
> 
> 
> Thanks,
> 
> Aravindan Vijayan
> 
>

Re: Review Request 52068: Create authentication filter to perform Kerberos authentication for Ambari

2016-09-20 Thread Robert Levas 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52068/
---

(Updated Sept. 20, 2016, 2:26 p.m.)


Review request for Ambari, Jonathan Hurley, Myroslav Papirkovskyy, and Nate 
Cole.


Changes
---

Removed duplicate dependency for `hadoop-auth`


Bugs: AMBARI-18406
https://issues.apache.org/jira/browse/AMBARI-18406


Repository: ambari


Description
---

Users should be able to authenticate to use Ambari by providing a Kerberos 
token using SPNEGO - Simple and Protected GSSAPI Negotiation Mechanism.  This 
includes access to the Ambari REST API as well as the Ambari web-based UI. 

The implementation should support the ability to perform the full SPNEGO 
handshake as well as access requests directly providing the appropriate HTTP 
header containing the Kerberos token. For example:

```
Authorization: Negotiate YIICcgY...r/vJcLO
```
In the full handshake model
- The client requests access to a web resource
- The server responds with an HTTP 401 status (`Unauthorized`), including the 
header `WWW-Authenticate: Negotiate`
- The client generates the Kerberos data and creates a new request containing 
the authentication header - `Authorization: Negotiate YIICcgY...r/vJcLO`

Since Ambari needs to generally return a HTTP status of 403 ({{Forbidden}}) 
when authentication is needed, a _hint_ must be sent along with the request 
indicate to Ambari that Kerberos authentication is desired.  If this _hint_ is 
received, then Ambari will respond with the appropriate status and header to 
initiate SPNEGO with the client. This _hint_ is an Ambari-specific header named 
"X-Negotiate-Authentication" with the value of "true":

```
X-Negotiate-Authentication: true
```

No matter what the handshake mechanism is (or lack of), once the Kerberos token 
is received by Ambari, Ambari is to parse and validate the token.  If a failure 
occurs, Ambari is to respond with the appropriate HTTP status and related 
header(s).  Upon success, the user's principal name is retrieved and converted 
into a _local_ user name.  The use of an auth-to-local rule set processor may 
be needed to perform this translation.  Using this _local_ username, an 
appropriate Ambari user account is located and used as the authenticated users 
identity - details, privileges, etc Failure to find an appropriate Ambari 
user account is to result in an authentication failure response.


Diffs (updated)
-

  ambari-project/pom.xml 2615b46 
  ambari-server/pom.xml 323ce22 
  
ambari-server/src/main/java/org/apache/ambari/server/configuration/Configuration.java
 b2fa4c0 
  
ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelper.java
 c4d21fc 
  
ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java
 5bc5cd8 
  
ambari-server/src/main/java/org/apache/ambari/server/security/AmbariEntryPoint.java
 2028f46 
  
ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariAuthToLocalUserDetailsService.java
 PRE-CREATION 
  
ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosAuthenticationFilter.java
 PRE-CREATION 
  
ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosTicketValidator.java
 PRE-CREATION 
  
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/AbstractPrepareKerberosServerAction.java
 b6b0713 
  
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/ConfigureAmbariIdentitiesServerAction.java
 PRE-CREATION 
  
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/ConfigureAmbariIndetityServerAction.java
 96540ef 
  
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/CreatePrincipalsServerAction.java
 e31e6ff 
  
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/KerberosServerAction.java
 db210e0 
  ambari-server/src/main/resources/webapp/WEB-INF/spring-security.xml a86973c 
  
ambari-server/src/test/java/org/apache/ambari/server/controller/KerberosHelperTest.java
 3c97ce9 
  
ambari-server/src/test/java/org/apache/ambari/server/security/authentication/kerberos/AmbariAuthToLocalUserDetailsServiceTest.java
 PRE-CREATION 
  
ambari-server/src/test/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosAuthenticationFilterTest.java
 PRE-CREATION 
  
ambari-server/src/test/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosTicketValidatorTest.java
 PRE-CREATION 

Diff: https://reviews.apache.org/r/52068/diff/


Testing
---

Manual testing

# Local test results: 

[INFO] 
[INFO] BUILD SUCCESS
[INFO] 
[INFO]

Re: Review Request 52068: Create authentication filter to perform Kerberos authentication for Ambari

2016-09-20 Thread Robert Levas 


> On Sept. 20, 2016, 1:26 p.m., Nate Cole wrote:
> > ambari-server/pom.xml, lines 1403-1411
> > 
> >
> > How will this affect the size of Ambari?  The KerberosName class is 
> > pretty lightweight, so hopefully we don't need all of Hadoop Client for 
> > this.  Also, what's the reliance on ZK?

Good queston.  We are importing this to get the Auth-to-local parser 
functionality provided by the hadoop classes. I originally wrote my own (that 
worked well) but was persuaded to use the one from the Hadoop libs for 
"consistency". 

In any case, the dependency seems like a single JAR:

```
+- org.apache.hadoop:hadoop-auth:jar:2.7.2:compile
|  - org.apache.zookeeper:zookeeper:jar:3.4.6:compile
| +- jline:jline:jar:2.11:compile (version managed from 0.9.94)
| - io.netty:netty:jar:3.7.0.Final:compile
```

I am not sure what the deal is with Zookeep, so I excluded it...


- Robert


---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52068/#review149684
---


On Sept. 20, 2016, 10:41 a.m., Robert Levas wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/52068/
> ---
> 
> (Updated Sept. 20, 2016, 10:41 a.m.)
> 
> 
> Review request for Ambari, Jonathan Hurley, Myroslav Papirkovskyy, and Nate 
> Cole.
> 
> 
> Bugs: AMBARI-18406
> https://issues.apache.org/jira/browse/AMBARI-18406
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> Users should be able to authenticate to use Ambari by providing a Kerberos 
> token using SPNEGO - Simple and Protected GSSAPI Negotiation Mechanism.  This 
> includes access to the Ambari REST API as well as the Ambari web-based UI. 
> 
> The implementation should support the ability to perform the full SPNEGO 
> handshake as well as access requests directly providing the appropriate HTTP 
> header containing the Kerberos token. For example:
> 
> ```
> Authorization: Negotiate YIICcgY...r/vJcLO
> ```
> In the full handshake model
> - The client requests access to a web resource
> - The server responds with an HTTP 401 status (`Unauthorized`), including the 
> header `WWW-Authenticate: Negotiate`
> - The client generates the Kerberos data and creates a new request containing 
> the authentication header - `Authorization: Negotiate YIICcgY...r/vJcLO`
> 
> Since Ambari needs to generally return a HTTP status of 403 ({{Forbidden}}) 
> when authentication is needed, a _hint_ must be sent along with the request 
> indicate to Ambari that Kerberos authentication is desired.  If this _hint_ 
> is received, then Ambari will respond with the appropriate status and header 
> to initiate SPNEGO with the client. This _hint_ is an Ambari-specific header 
> named "X-Negotiate-Authentication" with the value of "true":
> 
> ```
> X-Negotiate-Authentication: true
> ```
> 
> No matter what the handshake mechanism is (or lack of), once the Kerberos 
> token is received by Ambari, Ambari is to parse and validate the token.  If a 
> failure occurs, Ambari is to respond with the appropriate HTTP status and 
> related header(s).  Upon success, the user's principal name is retrieved and 
> converted into a _local_ user name.  The use of an auth-to-local rule set 
> processor may be needed to perform this translation.  Using this _local_ 
> username, an appropriate Ambari user account is located and used as the 
> authenticated users identity - details, privileges, etc Failure to find 
> an appropriate Ambari user account is to result in an authentication failure 
> response.
> 
> 
> Diffs
> -
> 
>   ambari-project/pom.xml 2615b46 
>   ambari-server/pom.xml 323ce22 
>   
> ambari-server/src/main/java/org/apache/ambari/server/configuration/Configuration.java
>  b2fa4c0 
>   
> ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelper.java
>  c4d21fc 
>   
> ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java
>  5bc5cd8 
>   
> ambari-server/src/main/java/org/apache/ambari/server/security/AmbariEntryPoint.java
>  2028f46 
>   
> ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariAuthToLocalUserDetailsService.java
>  PRE-CREATION 
>   
> ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosAuthenticationFilter.java
>  PRE-CREATION 
>   
> ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosTicketValidator.java
>  PRE-CREATION 
>   
> ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/AbstractPrepareKerberosServerAction.java
>  b6b0713 
>   
>

Re: Review Request 52068: Create authentication filter to perform Kerberos authentication for Ambari

2016-09-20 Thread Robert Levas 


> On Sept. 20, 2016, 12:59 p.m., Jonathan Hurley wrote:
> > ambari-server/src/main/java/org/apache/ambari/server/security/AmbariEntryPoint.java,
> >  lines 39-41
> > 
> >
> > Should this check to see if an auth token is already supplied in the 
> > request before returning the 401?

We only get here if authentication has failed. So if the authentication token 
was supplied and validated, then the flow would lead somewhere else.  The name 
of the class and usage of it seems confusing, but it is a Spring thing.  
Apparently if (and only if) authentcation fails, then 
`org.apache.ambari.server.security.AmbariEntryPoint#commence` is invoked.  So 
this is where we determine how to respond to the failure.  I am not sure if 
this its only usage, but from existing Ambari code and some examples on the 
web, this is what it looks like to me.


> On Sept. 20, 2016, 12:59 p.m., Jonathan Hurley wrote:
> > ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariAuthToLocalUserDetailsService.java,
> >  lines 121-126
> > 
> >
> > I think it's fine to keep this as-is for now; however is there a 
> > performant way that we can determine if there are more than 1 match and log 
> > a warning about it? Could really help debugging issues in the future.

This is why I made it a preferred order list. I hope to change the whole Ambari 
user database mechanism in the future as this is not optimal.


- Robert


---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52068/#review149673
---


On Sept. 20, 2016, 10:41 a.m., Robert Levas wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/52068/
> ---
> 
> (Updated Sept. 20, 2016, 10:41 a.m.)
> 
> 
> Review request for Ambari, Jonathan Hurley, Myroslav Papirkovskyy, and Nate 
> Cole.
> 
> 
> Bugs: AMBARI-18406
> https://issues.apache.org/jira/browse/AMBARI-18406
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> Users should be able to authenticate to use Ambari by providing a Kerberos 
> token using SPNEGO - Simple and Protected GSSAPI Negotiation Mechanism.  This 
> includes access to the Ambari REST API as well as the Ambari web-based UI. 
> 
> The implementation should support the ability to perform the full SPNEGO 
> handshake as well as access requests directly providing the appropriate HTTP 
> header containing the Kerberos token. For example:
> 
> ```
> Authorization: Negotiate YIICcgY...r/vJcLO
> ```
> In the full handshake model
> - The client requests access to a web resource
> - The server responds with an HTTP 401 status (`Unauthorized`), including the 
> header `WWW-Authenticate: Negotiate`
> - The client generates the Kerberos data and creates a new request containing 
> the authentication header - `Authorization: Negotiate YIICcgY...r/vJcLO`
> 
> Since Ambari needs to generally return a HTTP status of 403 ({{Forbidden}}) 
> when authentication is needed, a _hint_ must be sent along with the request 
> indicate to Ambari that Kerberos authentication is desired.  If this _hint_ 
> is received, then Ambari will respond with the appropriate status and header 
> to initiate SPNEGO with the client. This _hint_ is an Ambari-specific header 
> named "X-Negotiate-Authentication" with the value of "true":
> 
> ```
> X-Negotiate-Authentication: true
> ```
> 
> No matter what the handshake mechanism is (or lack of), once the Kerberos 
> token is received by Ambari, Ambari is to parse and validate the token.  If a 
> failure occurs, Ambari is to respond with the appropriate HTTP status and 
> related header(s).  Upon success, the user's principal name is retrieved and 
> converted into a _local_ user name.  The use of an auth-to-local rule set 
> processor may be needed to perform this translation.  Using this _local_ 
> username, an appropriate Ambari user account is located and used as the 
> authenticated users identity - details, privileges, etc Failure to find 
> an appropriate Ambari user account is to result in an authentication failure 
> response.
> 
> 
> Diffs
> -
> 
>   ambari-project/pom.xml 2615b46 
>   ambari-server/pom.xml 323ce22 
>   
> ambari-server/src/main/java/org/apache/ambari/server/configuration/Configuration.java
>  b2fa4c0 
>   
> ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelper.java
>  c4d21fc 
>   
> ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java
>  5bc5cd8 
>   
> ambari-server/src/main/java/org/apache/ambari/server/security/AmbariEntryPoint.java
>

Re: Review Request 51903: Atlas web UI alert after performing stack upgrade to HDP 2.5 and adding Atlas Service

2016-09-20 Thread Nate Cole 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/51903/#review149685
---



What's the status of this review?  Can it be marked Submitted?

- Nate Cole


On Sept. 15, 2016, 5:43 p.m., Alejandro Fernandez wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/51903/
> ---
> 
> (Updated Sept. 15, 2016, 5:43 p.m.)
> 
> 
> Review request for Ambari, Dmytro Grinenko, Dmitro Lisnichenko, Jonathan 
> Hurley, and Nate Cole.
> 
> 
> Bugs: AMBARI-18368
> https://issues.apache.org/jira/browse/AMBARI-18368
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> Steps to Reproduce:
> 
> * Install Ambari 2.2.2 with HDP 2.4 with HBase, Solr, and Hive (this is 
> important)
> * Perform EU/RU to HDP 2.5 
> * Add Atlas Service
> 
> Atlas Server log contains,
> 
> Caused by: 
> org.apache.solr.client.solrj.impl.HttpSolrClient$RemoteSolrException: Error 
> from server at 
> http://natu146-ehbs-dgm10toeriesec-u14-1.openstacklocal:8886/solr: Can not 
> find the specified config set: vertex_index  
> 
> Fix:
> The Hive RPM installs /usr/$stack/$version/atlas with some partial packages 
> that contain Hive hooks, while the Atlas RPM is responsible for installing 
> the full content.
> If the user does not have Atlas currently installed on their stack, then 
> /usr/$stack/current/atlas-client will be a broken symlink, and we should not 
> create the symlink /etc/atlas/conf -> /usr/$stack/current/atlas-client/conf .
> If we mistakenly create this symlink, then when the user performs an EU/RU 
> and then adds Atlas service then the Atlas RPM will not be able to copy its 
> artifacts into /etc/atlas/conf directory and therefore prevent Ambari from by 
> copying those unmanaged contents into /etc/atlas/$version/0
> 
> Further, when installing Atlas service, we must copy the artifacts from 
> /etc/atlas/conf.backup/* to /etc/atlas/conf (which is now a symlink to 
> /usr/hdp/current/atlas-client/conf/) with the no-clobber flag.
> 
> 
> Diffs
> -
> 
>   
> ambari-common/src/main/python/resource_management/libraries/functions/conf_select.py
>  c60b324 
>   
> ambari-server/src/test/python/stacks/2.0.6/hooks/after-INSTALL/test_after_install.py
>  06a366e 
> 
> Diff: https://reviews.apache.org/r/51903/diff/
> 
> 
> Testing
> ---
> 
> --
> Total run:1125
> Total errors:0
> Total failures:0
> OK
> 
> 
> Need to perform more tests on a live cluster.
> 
> 
> Thanks,
> 
> Alejandro Fernandez
> 
>

Re: Review Request 52068: Create authentication filter to perform Kerberos authentication for Ambari

2016-09-20 Thread Nate Cole 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52068/#review149684
---


Ship it!





ambari-server/pom.xml (lines 1403 - 1411)


How will this affect the size of Ambari?  The KerberosName class is pretty 
lightweight, so hopefully we don't need all of Hadoop Client for this.  Also, 
what's the reliance on ZK?


- Nate Cole


On Sept. 20, 2016, 10:41 a.m., Robert Levas wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/52068/
> ---
> 
> (Updated Sept. 20, 2016, 10:41 a.m.)
> 
> 
> Review request for Ambari, Jonathan Hurley, Myroslav Papirkovskyy, and Nate 
> Cole.
> 
> 
> Bugs: AMBARI-18406
> https://issues.apache.org/jira/browse/AMBARI-18406
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> Users should be able to authenticate to use Ambari by providing a Kerberos 
> token using SPNEGO - Simple and Protected GSSAPI Negotiation Mechanism.  This 
> includes access to the Ambari REST API as well as the Ambari web-based UI. 
> 
> The implementation should support the ability to perform the full SPNEGO 
> handshake as well as access requests directly providing the appropriate HTTP 
> header containing the Kerberos token. For example:
> 
> ```
> Authorization: Negotiate YIICcgY...r/vJcLO
> ```
> In the full handshake model
> - The client requests access to a web resource
> - The server responds with an HTTP 401 status (`Unauthorized`), including the 
> header `WWW-Authenticate: Negotiate`
> - The client generates the Kerberos data and creates a new request containing 
> the authentication header - `Authorization: Negotiate YIICcgY...r/vJcLO`
> 
> Since Ambari needs to generally return a HTTP status of 403 ({{Forbidden}}) 
> when authentication is needed, a _hint_ must be sent along with the request 
> indicate to Ambari that Kerberos authentication is desired.  If this _hint_ 
> is received, then Ambari will respond with the appropriate status and header 
> to initiate SPNEGO with the client. This _hint_ is an Ambari-specific header 
> named "X-Negotiate-Authentication" with the value of "true":
> 
> ```
> X-Negotiate-Authentication: true
> ```
> 
> No matter what the handshake mechanism is (or lack of), once the Kerberos 
> token is received by Ambari, Ambari is to parse and validate the token.  If a 
> failure occurs, Ambari is to respond with the appropriate HTTP status and 
> related header(s).  Upon success, the user's principal name is retrieved and 
> converted into a _local_ user name.  The use of an auth-to-local rule set 
> processor may be needed to perform this translation.  Using this _local_ 
> username, an appropriate Ambari user account is located and used as the 
> authenticated users identity - details, privileges, etc Failure to find 
> an appropriate Ambari user account is to result in an authentication failure 
> response.
> 
> 
> Diffs
> -
> 
>   ambari-project/pom.xml 2615b46 
>   ambari-server/pom.xml 323ce22 
>   
> ambari-server/src/main/java/org/apache/ambari/server/configuration/Configuration.java
>  b2fa4c0 
>   
> ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelper.java
>  c4d21fc 
>   
> ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java
>  5bc5cd8 
>   
> ambari-server/src/main/java/org/apache/ambari/server/security/AmbariEntryPoint.java
>  2028f46 
>   
> ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariAuthToLocalUserDetailsService.java
>  PRE-CREATION 
>   
> ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosAuthenticationFilter.java
>  PRE-CREATION 
>   
> ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosTicketValidator.java
>  PRE-CREATION 
>   
> ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/AbstractPrepareKerberosServerAction.java
>  b6b0713 
>   
> ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/ConfigureAmbariIdentitiesServerAction.java
>  PRE-CREATION 
>   
> ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/ConfigureAmbariIndetityServerAction.java
>  96540ef 
>   
> ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/CreatePrincipalsServerAction.java
>  e31e6ff 
>   
> ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/KerberosServerAction.java
>  db210e0 
>   ambari-server/src/main/resources/webapp/WEB-INF/spring-security.xml a86973c 
>   
> ambari-server/src/test/java/org/apache/ambari/server/controller/KerberosHelperTest.java
>

Re: Review Request 51894: View instance cloning functionality

2016-09-20 Thread Alexandr Antonenko 


> On Sept. 18, 2016, 11:51 a.m., Alexandr Antonenko wrote:
> > Ship It!
> 
> Sangeeta Ravindran wrote:
> Thank you Alexandr. Can you please help push the fix?
> 
> Sangeeta Ravindran wrote:
> Thanks Alexandr for pushing this.

np


- Alexandr


---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/51894/#review149364
---


On Sept. 16, 2016, 10:59 p.m., Sangeeta Ravindran wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/51894/
> ---
> 
> (Updated Sept. 16, 2016, 10:59 p.m.)
> 
> 
> Review request for Ambari, Alexandr Antonenko and Di Li.
> 
> 
> Bugs: AMBARI-18378
> https://issues.apache.org/jira/browse/AMBARI-18378
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> This task is for providing an option to clone / copy a view instance.
> A new "copy" icon will appear next to a view instance. Clicking on this opens 
> up the existing view with instance name and display name of the view appended 
> with _Copy.
> This will be useful when creating multiple view instances with mild 
> configuration differences between them.
> 
> 
> Diffs
> -
> 
>   
> ambari-admin/src/main/resources/ui/admin-web/app/scripts/controllers/ambariViews/CreateViewInstanceCtrl.js
>  20bd25c 
>   ambari-admin/src/main/resources/ui/admin-web/app/scripts/i18n.config.js 
> 0aefaba 
>   ambari-admin/src/main/resources/ui/admin-web/app/scripts/routes.js 239e39e 
>   
> ambari-admin/src/main/resources/ui/admin-web/app/views/ambariViews/create.html
>  924885f 
>   
> ambari-admin/src/main/resources/ui/admin-web/app/views/ambariViews/listTable.html
>  bc441cd 
>   
> ambari-admin/src/main/resources/ui/admin-web/test/unit/controllers/CreateViewInstanceCtrl.js
>  117021e 
> 
> Diff: https://reviews.apache.org/r/51894/diff/
> 
> 
> Testing
> ---
> 
> Manual testing with different types of view instances.
> Currently there are no automated tests for ambari-admin.
> 
> 
> File Attachments
> 
> 
> AMBARI-18378.patch
>   
> https://reviews.apache.org/media/uploaded/files/2016/09/16/cd344c4a-e087-46a3-953a-f8f8ae6f7764__AMBARI-18378.patch
> 
> 
> Thanks,
> 
> Sangeeta Ravindran
> 
>

Re: Review Request 52072: AMBARI-18390 : Configuration warnings during "Add Service" Wizard includes seemingly nonsensical heapsize recommendations for AMS heap sizes.

2016-09-20 Thread Aravindan Vijayan 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52072/
---

(Updated Sept. 20, 2016, 5:11 p.m.)


Review request for Ambari, Dmytro Sen, Sumit Mohanty, and Sid Wagle.


Bugs: AMBARI-18390
https://issues.apache.org/jira/browse/AMBARI-18390


Repository: ambari


Description
---

AMS stack validations for Metrics collector and HBase heap sizes based on 
unused memory on host were wrongly calculated.


Diffs (updated)
-

  ambari-server/src/main/resources/stacks/HDP/2.0.6/services/stack_advisor.py 
fd0dfed 

Diff: https://reviews.apache.org/r/52072/diff/


Testing
---

Manually tested.
Ambari-server python unit tests pass.


Thanks,

Aravindan Vijayan

Re: Review Request 52068: Create authentication filter to perform Kerberos authentication for Ambari

2016-09-20 Thread Jonathan Hurley 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52068/#review149673
---


Fix it, then Ship it!





ambari-server/src/main/java/org/apache/ambari/server/security/AmbariEntryPoint.java
 (lines 39 - 41)


Should this check to see if an auth token is already supplied in the 
request before returning the 401?



ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariAuthToLocalUserDetailsService.java
 (lines 121 - 126)


I think it's fine to keep this as-is for now; however is there a performant 
way that we can determine if there are more than 1 match and log a warning 
about it? Could really help debugging issues in the future.


- Jonathan Hurley


On Sept. 20, 2016, 10:41 a.m., Robert Levas wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/52068/
> ---
> 
> (Updated Sept. 20, 2016, 10:41 a.m.)
> 
> 
> Review request for Ambari, Jonathan Hurley, Myroslav Papirkovskyy, and Nate 
> Cole.
> 
> 
> Bugs: AMBARI-18406
> https://issues.apache.org/jira/browse/AMBARI-18406
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> Users should be able to authenticate to use Ambari by providing a Kerberos 
> token using SPNEGO - Simple and Protected GSSAPI Negotiation Mechanism.  This 
> includes access to the Ambari REST API as well as the Ambari web-based UI. 
> 
> The implementation should support the ability to perform the full SPNEGO 
> handshake as well as access requests directly providing the appropriate HTTP 
> header containing the Kerberos token. For example:
> 
> ```
> Authorization: Negotiate YIICcgY...r/vJcLO
> ```
> In the full handshake model
> - The client requests access to a web resource
> - The server responds with an HTTP 401 status (`Unauthorized`), including the 
> header `WWW-Authenticate: Negotiate`
> - The client generates the Kerberos data and creates a new request containing 
> the authentication header - `Authorization: Negotiate YIICcgY...r/vJcLO`
> 
> Since Ambari needs to generally return a HTTP status of 403 ({{Forbidden}}) 
> when authentication is needed, a _hint_ must be sent along with the request 
> indicate to Ambari that Kerberos authentication is desired.  If this _hint_ 
> is received, then Ambari will respond with the appropriate status and header 
> to initiate SPNEGO with the client. This _hint_ is an Ambari-specific header 
> named "X-Negotiate-Authentication" with the value of "true":
> 
> ```
> X-Negotiate-Authentication: true
> ```
> 
> No matter what the handshake mechanism is (or lack of), once the Kerberos 
> token is received by Ambari, Ambari is to parse and validate the token.  If a 
> failure occurs, Ambari is to respond with the appropriate HTTP status and 
> related header(s).  Upon success, the user's principal name is retrieved and 
> converted into a _local_ user name.  The use of an auth-to-local rule set 
> processor may be needed to perform this translation.  Using this _local_ 
> username, an appropriate Ambari user account is located and used as the 
> authenticated users identity - details, privileges, etc Failure to find 
> an appropriate Ambari user account is to result in an authentication failure 
> response.
> 
> 
> Diffs
> -
> 
>   ambari-project/pom.xml 2615b46 
>   ambari-server/pom.xml 323ce22 
>   
> ambari-server/src/main/java/org/apache/ambari/server/configuration/Configuration.java
>  b2fa4c0 
>   
> ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelper.java
>  c4d21fc 
>   
> ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java
>  5bc5cd8 
>   
> ambari-server/src/main/java/org/apache/ambari/server/security/AmbariEntryPoint.java
>  2028f46 
>   
> ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariAuthToLocalUserDetailsService.java
>  PRE-CREATION 
>   
> ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosAuthenticationFilter.java
>  PRE-CREATION 
>   
> ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosTicketValidator.java
>  PRE-CREATION 
>   
> ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/AbstractPrepareKerberosServerAction.java
>  b6b0713 
>   
> ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/ConfigureAmbariIdentitiesServerAction.java
>  PRE-CREATION 
>   
> ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/ConfigureAmbariIndetityServerAction.java
>  96540ef 
>   
>

Re: Review Request 51894: View instance cloning functionality

2016-09-20 Thread Sangeeta Ravindran 


> On Sept. 18, 2016, 11:51 a.m., Alexandr Antonenko wrote:
> > Ship It!
> 
> Sangeeta Ravindran wrote:
> Thank you Alexandr. Can you please help push the fix?

Thanks Alexandr for pushing this.


- Sangeeta


---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/51894/#review149364
---


On Sept. 16, 2016, 10:59 p.m., Sangeeta Ravindran wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/51894/
> ---
> 
> (Updated Sept. 16, 2016, 10:59 p.m.)
> 
> 
> Review request for Ambari, Alexandr Antonenko and Di Li.
> 
> 
> Bugs: AMBARI-18378
> https://issues.apache.org/jira/browse/AMBARI-18378
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> This task is for providing an option to clone / copy a view instance.
> A new "copy" icon will appear next to a view instance. Clicking on this opens 
> up the existing view with instance name and display name of the view appended 
> with _Copy.
> This will be useful when creating multiple view instances with mild 
> configuration differences between them.
> 
> 
> Diffs
> -
> 
>   
> ambari-admin/src/main/resources/ui/admin-web/app/scripts/controllers/ambariViews/CreateViewInstanceCtrl.js
>  20bd25c 
>   ambari-admin/src/main/resources/ui/admin-web/app/scripts/i18n.config.js 
> 0aefaba 
>   ambari-admin/src/main/resources/ui/admin-web/app/scripts/routes.js 239e39e 
>   
> ambari-admin/src/main/resources/ui/admin-web/app/views/ambariViews/create.html
>  924885f 
>   
> ambari-admin/src/main/resources/ui/admin-web/app/views/ambariViews/listTable.html
>  bc441cd 
>   
> ambari-admin/src/main/resources/ui/admin-web/test/unit/controllers/CreateViewInstanceCtrl.js
>  117021e 
> 
> Diff: https://reviews.apache.org/r/51894/diff/
> 
> 
> Testing
> ---
> 
> Manual testing with different types of view instances.
> Currently there are no automated tests for ambari-admin.
> 
> 
> File Attachments
> 
> 
> AMBARI-18378.patch
>   
> https://reviews.apache.org/media/uploaded/files/2016/09/16/cd344c4a-e087-46a3-953a-f8f8ae6f7764__AMBARI-18378.patch
> 
> 
> Thanks,
> 
> Sangeeta Ravindran
> 
>

Re: Review Request 52068: Create authentication filter to perform Kerberos authentication for Ambari

2016-09-20 Thread Robert Levas 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52068/
---

(Updated Sept. 20, 2016, 10:41 a.m.)


Review request for Ambari, Jonathan Hurley, Myroslav Papirkovskyy, and Nate 
Cole.


Bugs: AMBARI-18406
https://issues.apache.org/jira/browse/AMBARI-18406


Repository: ambari


Description
---

Users should be able to authenticate to use Ambari by providing a Kerberos 
token using SPNEGO - Simple and Protected GSSAPI Negotiation Mechanism.  This 
includes access to the Ambari REST API as well as the Ambari web-based UI. 

The implementation should support the ability to perform the full SPNEGO 
handshake as well as access requests directly providing the appropriate HTTP 
header containing the Kerberos token. For example:

```
Authorization: Negotiate YIICcgY...r/vJcLO
```
In the full handshake model
- The client requests access to a web resource
- The server responds with an HTTP 401 status (`Unauthorized`), including the 
header `WWW-Authenticate: Negotiate`
- The client generates the Kerberos data and creates a new request containing 
the authentication header - `Authorization: Negotiate YIICcgY...r/vJcLO`

Since Ambari needs to generally return a HTTP status of 403 ({{Forbidden}}) 
when authentication is needed, a _hint_ must be sent along with the request 
indicate to Ambari that Kerberos authentication is desired.  If this _hint_ is 
received, then Ambari will respond with the appropriate status and header to 
initiate SPNEGO with the client. This _hint_ is an Ambari-specific header named 
"X-Negotiate-Authentication" with the value of "true":

```
X-Negotiate-Authentication: true
```

No matter what the handshake mechanism is (or lack of), once the Kerberos token 
is received by Ambari, Ambari is to parse and validate the token.  If a failure 
occurs, Ambari is to respond with the appropriate HTTP status and related 
header(s).  Upon success, the user's principal name is retrieved and converted 
into a _local_ user name.  The use of an auth-to-local rule set processor may 
be needed to perform this translation.  Using this _local_ username, an 
appropriate Ambari user account is located and used as the authenticated users 
identity - details, privileges, etc Failure to find an appropriate Ambari 
user account is to result in an authentication failure response.


Diffs
-

  ambari-project/pom.xml 2615b46 
  ambari-server/pom.xml 323ce22 
  
ambari-server/src/main/java/org/apache/ambari/server/configuration/Configuration.java
 b2fa4c0 
  
ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelper.java
 c4d21fc 
  
ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java
 5bc5cd8 
  
ambari-server/src/main/java/org/apache/ambari/server/security/AmbariEntryPoint.java
 2028f46 
  
ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariAuthToLocalUserDetailsService.java
 PRE-CREATION 
  
ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosAuthenticationFilter.java
 PRE-CREATION 
  
ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosTicketValidator.java
 PRE-CREATION 
  
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/AbstractPrepareKerberosServerAction.java
 b6b0713 
  
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/ConfigureAmbariIdentitiesServerAction.java
 PRE-CREATION 
  
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/ConfigureAmbariIndetityServerAction.java
 96540ef 
  
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/CreatePrincipalsServerAction.java
 e31e6ff 
  
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/KerberosServerAction.java
 db210e0 
  ambari-server/src/main/resources/webapp/WEB-INF/spring-security.xml a86973c 
  
ambari-server/src/test/java/org/apache/ambari/server/controller/KerberosHelperTest.java
 3c97ce9 
  
ambari-server/src/test/java/org/apache/ambari/server/security/authentication/kerberos/AmbariAuthToLocalUserDetailsServiceTest.java
 PRE-CREATION 
  
ambari-server/src/test/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosAuthenticationFilterTest.java
 PRE-CREATION 
  
ambari-server/src/test/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosTicketValidatorTest.java
 PRE-CREATION 

Diff: https://reviews.apache.org/r/52068/diff/


Testing (updated)
---

Manual testing

# Local test results: 

[INFO] 
[INFO] BUILD SUCCESS
[INFO] 
[INFO] Total time: 1:10:14.923s
[INFO] Finished at: Mon Sep 19 19:27:33

Re: Review Request 52044: Analyze and Optimize Ambari Server Unit Tests - Group 6

2016-09-20 Thread Vitalyi Brodetskyi 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52044/
---

(Updated Вер. 20, 2016, 2:16 після полудня)


Review request for Ambari, Andrew Onischuk, Dmitro Lisnichenko, and Sumit 
Mohanty.


Bugs: AMBARI-18420
https://issues.apache.org/jira/browse/AMBARI-18420


Repository: ambari


Description
---

||Test||Count||Time (s)||
|org.apache.ambari.server.orm.dao.AlertDispatchDAOTest|26|62.096|
|org.apache.ambari.server.serveraction.upgrades.ConfigureActionTest 
|17|51.291|
|org.apache.ambari.server.orm.TestOrmImpl|11|33.667|
|org.apache.ambari.server.state.ServiceTest|9|30.218|
|org.apache.ambari.server.controller.test.BufferedThreadPoolExecutorCompletionServiceTest|4|36.114|


Diffs (updated)
-

  
ambari-server/src/main/java/org/apache/ambari/server/orm/dao/HostConfigMappingDAO.java
 77ff4a2 
  
ambari-server/src/test/java/org/apache/ambari/server/agent/TestHeartbeatMonitor.java
 b6f5ec2 
  
ambari-server/src/test/java/org/apache/ambari/server/controller/test/BufferedThreadPoolExecutorCompletionServiceTest.java
 ede1f1f 
  ambari-server/src/test/java/org/apache/ambari/server/orm/TestOrmImpl.java 
ce1c7e6 
  
ambari-server/src/test/java/org/apache/ambari/server/orm/dao/AlertDispatchDAOTest.java
 2518e0a 
  
ambari-server/src/test/java/org/apache/ambari/server/security/authorization/TestUsers.java
 9b9fee5 
  
ambari-server/src/test/java/org/apache/ambari/server/serveraction/upgrades/ConfigureActionTest.java
 be0aeef 
  
ambari-server/src/test/java/org/apache/ambari/server/serveraction/upgrades/UpgradeActionTest.java
 cb63b0f 
  ambari-server/src/test/java/org/apache/ambari/server/state/ServiceTest.java 
79fe0e9 
  
ambari-server/src/test/java/org/apache/ambari/server/state/svccomphost/ServiceComponentHostTest.java
 afcc90e 
  
ambari-server/src/test/java/org/apache/ambari/server/upgrade/UpgradeCatalog210Test.java
 50ba3ef 

Diff: https://reviews.apache.org/r/52044/diff/


Testing
---

mvn clean test


Thanks,

Vitalyi Brodetskyi

Re: Review Request 52044: Analyze and Optimize Ambari Server Unit Tests - Group 6

2016-09-20 Thread Andrew Onischuk 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52044/#review149663
---


Ship it!




Ship It!

- Andrew Onischuk


On Sept. 20, 2016, 2:16 p.m., Vitalyi Brodetskyi wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/52044/
> ---
> 
> (Updated Sept. 20, 2016, 2:16 p.m.)
> 
> 
> Review request for Ambari, Andrew Onischuk, Dmitro Lisnichenko, and Sumit 
> Mohanty.
> 
> 
> Bugs: AMBARI-18420
> https://issues.apache.org/jira/browse/AMBARI-18420
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> ||Test||Count||Time (s)||
> |org.apache.ambari.server.orm.dao.AlertDispatchDAOTest|26|62.096|
> |org.apache.ambari.server.serveraction.upgrades.ConfigureActionTest   
> |17|51.291|
> |org.apache.ambari.server.orm.TestOrmImpl|11|33.667|
> |org.apache.ambari.server.state.ServiceTest|9|30.218|
> |org.apache.ambari.server.controller.test.BufferedThreadPoolExecutorCompletionServiceTest|4|36.114|
> 
> 
> Diffs
> -
> 
>   
> ambari-server/src/main/java/org/apache/ambari/server/orm/dao/HostConfigMappingDAO.java
>  77ff4a2 
>   
> ambari-server/src/test/java/org/apache/ambari/server/agent/TestHeartbeatMonitor.java
>  b6f5ec2 
>   
> ambari-server/src/test/java/org/apache/ambari/server/controller/test/BufferedThreadPoolExecutorCompletionServiceTest.java
>  ede1f1f 
>   ambari-server/src/test/java/org/apache/ambari/server/orm/TestOrmImpl.java 
> ce1c7e6 
>   
> ambari-server/src/test/java/org/apache/ambari/server/orm/dao/AlertDispatchDAOTest.java
>  2518e0a 
>   
> ambari-server/src/test/java/org/apache/ambari/server/security/authorization/TestUsers.java
>  9b9fee5 
>   
> ambari-server/src/test/java/org/apache/ambari/server/serveraction/upgrades/ConfigureActionTest.java
>  be0aeef 
>   
> ambari-server/src/test/java/org/apache/ambari/server/serveraction/upgrades/UpgradeActionTest.java
>  cb63b0f 
>   ambari-server/src/test/java/org/apache/ambari/server/state/ServiceTest.java 
> 79fe0e9 
>   
> ambari-server/src/test/java/org/apache/ambari/server/state/svccomphost/ServiceComponentHostTest.java
>  afcc90e 
>   
> ambari-server/src/test/java/org/apache/ambari/server/upgrade/UpgradeCatalog210Test.java
>  50ba3ef 
> 
> Diff: https://reviews.apache.org/r/52044/diff/
> 
> 
> Testing
> ---
> 
> mvn clean test
> 
> 
> Thanks,
> 
> Vitalyi Brodetskyi
> 
>

Re: Review Request 51599: AMBARI-18292 Support dispatching notifications of assigned alert states for script-based alert dispatcher

2016-09-20 Thread yao lei 


> On 九月 3, 2016, 7:17 p.m., Jonathan Hurley wrote:
> > This is not the correct way to accomplish this. Instead, when you create 
> > the alert target, you can specify which alert states the alert target cares 
> > about:
> > 
> > ```
> > {
> >   "AlertTarget": {
> > "name": "Simple",
> > "description": "This target does not work and is only an exmaple of 
> > setting states",
> > "alert_states": ["OK", "WARNING"]
> > "notification_type": "FOO",
> > "groups": [1,2,3]
> >   }
> > }
> > ```
> > 
> > This is also accomplished through the Web Client when created/editing the 
> > target.
> 
> yao lei wrote:
> thanks for your explaination.
> Do your mean that we can creating or editing the  alert target on web ui?
> 
> Jonathan Hurley wrote:
> Yes you can.
> 
> yao lei wrote:
> Thanks your reply.
> I think i need to upgrade my current ambari  2.1.1
> 
> yao lei wrote:
> Hi,jhurley.
> I am sorry to bother you again.
> I can't find the operation on Web Client to create alert target which 
> notification_type is ALERT_SCRIPT.
> It seems that Ambari only support creating/editing alert notifications of 
> type EMAIL/SNMP  ( Alerts -> Actions -> Manage Notifications -> Icon plus -> 
> Create Alert Notification)
> My Ambari verison now is 2.4.0.1
> 
> Jonathan Hurley wrote:
> That's correct - creating a SCRIPT type dispatcher is not supported in 
> the web client yet. I believe the web client is working on scoping an alert 
> wizard for 2.5.0, but until then you'd need to use a POST to create it.

Thanks,got it.
I have just committed a patch to support creating/editing a SCRIPT type 
dispatcher in web client  : )
I will appreciate it if you could review my patch 
(https://issues.apache.org/jira/browse/AMBARI-18423)


- yao


---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/51599/#review147727
---


On 九月 3, 2016, 2:36 p.m., yao lei wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/51599/
> ---
> 
> (Updated 九月 3, 2016, 2:36 p.m.)
> 
> 
> Review request for Ambari and Jonathan Hurley.
> 
> 
> Bugs: AMBARI-18292
> https://issues.apache.org/jira/browse/AMBARI-18292
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> By default, Ambari allow all notifications of all kinds of alert states 
> (OK,WARNING,CRITICAL,UNKNOWN) to dispatch in script-based alert dispatcher.
> However, sometimes we hope to filter notification of some alert states 
> This patch will resolve this by setting 
> 'notification.dispatch.alert.script.states' in ambari.properties as following:
> 
> #Only dispatch WARNING and CRITICAL state notification 
> notification.dispatch.alert.script.states=WARNING,CRITICAL
> 
> If you don't set this property that means all notifications will be 
> dispatched.
> 
> I think making the desired alerts notifications configurable may be useful 
> for Ambari users.
> 
> 
> Diffs
> -
> 
>   
> ambari-server/src/main/java/org/apache/ambari/server/notifications/dispatchers/AlertScriptDispatcher.java
>  907588d 
>   
> ambari-server/src/test/java/org/apache/ambari/server/notifications/dispatchers/AlertScriptDispatcherTest.java
>  9e0e406 
> 
> Diff: https://reviews.apache.org/r/51599/diff/
> 
> 
> Testing
> ---
> 
> Tested
> 
> Running 
> org.apache.ambari.server.notifications.dispatchers.AlertScriptDispatcherTest
> Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 2.096 sec - in
> 
> 
> Thanks,
> 
> yao lei
> 
>

Re: Review Request 52044: Analyze and Optimize Ambari Server Unit Tests - Group 6

2016-09-20 Thread Dmitro Lisnichenko 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52044/#review149645
---


Ship it!





ambari-server/src/test/java/org/apache/ambari/server/controller/test/BufferedThreadPoolExecutorCompletionServiceTest.java
 (line 34)


lol


- Dmitro Lisnichenko


On Sept. 20, 2016, 11:59 a.m., Vitalyi Brodetskyi wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/52044/
> ---
> 
> (Updated Sept. 20, 2016, 11:59 a.m.)
> 
> 
> Review request for Ambari, Andrew Onischuk, Dmitro Lisnichenko, and Sumit 
> Mohanty.
> 
> 
> Bugs: AMBARI-18420
> https://issues.apache.org/jira/browse/AMBARI-18420
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> ||Test||Count||Time (s)||
> |org.apache.ambari.server.orm.dao.AlertDispatchDAOTest|26|62.096|
> |org.apache.ambari.server.serveraction.upgrades.ConfigureActionTest   
> |17|51.291|
> |org.apache.ambari.server.orm.TestOrmImpl|11|33.667|
> |org.apache.ambari.server.state.ServiceTest|9|30.218|
> |org.apache.ambari.server.controller.test.BufferedThreadPoolExecutorCompletionServiceTest|4|36.114|
> 
> 
> Diffs
> -
> 
>   
> ambari-server/src/main/java/org/apache/ambari/server/orm/dao/HostConfigMappingDAO.java
>  77ff4a2 
>   
> ambari-server/src/test/java/org/apache/ambari/server/agent/TestHeartbeatMonitor.java
>  b6f5ec2 
>   
> ambari-server/src/test/java/org/apache/ambari/server/controller/test/BufferedThreadPoolExecutorCompletionServiceTest.java
>  ede1f1f 
>   ambari-server/src/test/java/org/apache/ambari/server/orm/TestOrmImpl.java 
> ce1c7e6 
>   
> ambari-server/src/test/java/org/apache/ambari/server/orm/dao/AlertDispatchDAOTest.java
>  2518e0a 
>   
> ambari-server/src/test/java/org/apache/ambari/server/security/authorization/TestUsers.java
>  9b9fee5 
>   
> ambari-server/src/test/java/org/apache/ambari/server/serveraction/upgrades/ConfigureActionTest.java
>  be0aeef 
>   
> ambari-server/src/test/java/org/apache/ambari/server/serveraction/upgrades/UpgradeActionTest.java
>  cb63b0f 
>   ambari-server/src/test/java/org/apache/ambari/server/state/ServiceTest.java 
> 79fe0e9 
>   
> ambari-server/src/test/java/org/apache/ambari/server/state/svccomphost/ServiceComponentHostTest.java
>  afcc90e 
>   
> ambari-server/src/test/java/org/apache/ambari/server/upgrade/UpgradeCatalog210Test.java
>  50ba3ef 
> 
> Diff: https://reviews.apache.org/r/52044/diff/
> 
> 
> Testing
> ---
> 
> mvn clean test
> 
> 
> Thanks,
> 
> Vitalyi Brodetskyi
> 
>

Re: Review Request 52038: AMBARI-18418 StackServiceDirectory debug messages are logged with placeholders

2016-09-20 Thread Oliver Szabo 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52038/#review149633
---


Ship it!




Ship It!

- Oliver Szabo


On Sept. 19, 2016, 2:28 p.m., Attila Doroszlai wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/52038/
> ---
> 
> (Updated Sept. 19, 2016, 2:28 p.m.)
> 
> 
> Review request for Ambari, Balázs Bence Sári, Jayush Luniya, Oliver Szabo, 
> and Sebastian Toader.
> 
> 
> Bugs: AMBARI-18418
> https://issues.apache.org/jira/browse/AMBARI-18418
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> Replaced String.format placeholders with Log4J placeholders
> 
> 
> Diffs
> -
> 
>   
> ambari-server/src/main/java/org/apache/ambari/server/stack/StackServiceDirectory.java
>  a8b4632 
> 
> Diff: https://reviews.apache.org/r/52038/diff/
> 
> 
> Testing
> ---
> 
> * Set `log4j.rootLogger=DEBUG,file` in 
> `/etc/ambari-server/conf/log4j.properties`
>  * Start Ambari server (no cluster needed)
>  * Verify `StackServiceDirectory` messages contain service name, stack name, 
> not %s placeholders
>Example:
>  wrong: `19 Sep 2016 14:01:08,380 DEBUG [main] StackServiceDirectory:159 
> - Service package folder %s for service %s for stack %s does not exist.`
>  good: `19 Sep 2016 14:07:22,651 DEBUG [main] StackServiceDirectory:159 - 
> Service package folder 
> /var/lib/ambari-server/resources/stacks/HDP/2.4/services/ACCUMULO/package for 
> service ACCUMULO for stack HDP-2.4 does not exist.`
> 
> 
> Thanks,
> 
> Attila Doroszlai
> 
>

Re: Review Request 52038: AMBARI-18418 StackServiceDirectory debug messages are logged with placeholders

2016-09-20 Thread Balázs Bence Sári 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52038/#review149632
---


Ship it!




Ship It!

- Balázs Bence Sári


On Sept. 19, 2016, 2:28 p.m., Attila Doroszlai wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/52038/
> ---
> 
> (Updated Sept. 19, 2016, 2:28 p.m.)
> 
> 
> Review request for Ambari, Balázs Bence Sári, Jayush Luniya, Oliver Szabo, 
> and Sebastian Toader.
> 
> 
> Bugs: AMBARI-18418
> https://issues.apache.org/jira/browse/AMBARI-18418
> 
> 
> Repository: ambari
> 
> 
> Description
> ---
> 
> Replaced String.format placeholders with Log4J placeholders
> 
> 
> Diffs
> -
> 
>   
> ambari-server/src/main/java/org/apache/ambari/server/stack/StackServiceDirectory.java
>  a8b4632 
> 
> Diff: https://reviews.apache.org/r/52038/diff/
> 
> 
> Testing
> ---
> 
> * Set `log4j.rootLogger=DEBUG,file` in 
> `/etc/ambari-server/conf/log4j.properties`
>  * Start Ambari server (no cluster needed)
>  * Verify `StackServiceDirectory` messages contain service name, stack name, 
> not %s placeholders
>Example:
>  wrong: `19 Sep 2016 14:01:08,380 DEBUG [main] StackServiceDirectory:159 
> - Service package folder %s for service %s for stack %s does not exist.`
>  good: `19 Sep 2016 14:07:22,651 DEBUG [main] StackServiceDirectory:159 - 
> Service package folder 
> /var/lib/ambari-server/resources/stacks/HDP/2.4/services/ACCUMULO/package for 
> service ACCUMULO for stack HDP-2.4 does not exist.`
> 
> 
> Thanks,
> 
> Attila Doroszlai
> 
>

Re: Review Request 52044: Analyze and Optimize Ambari Server Unit Tests - Group 6

2016-09-20 Thread Vitalyi Brodetskyi 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/52044/
---

(Updated Вер. 20, 2016, 8:59 до полудня)


Review request for Ambari, Andrew Onischuk, Dmitro Lisnichenko, and Sumit 
Mohanty.


Bugs: AMBARI-18420
https://issues.apache.org/jira/browse/AMBARI-18420


Repository: ambari


Description
---

||Test||Count||Time (s)||
|org.apache.ambari.server.orm.dao.AlertDispatchDAOTest|26|62.096|
|org.apache.ambari.server.serveraction.upgrades.ConfigureActionTest 
|17|51.291|
|org.apache.ambari.server.orm.TestOrmImpl|11|33.667|
|org.apache.ambari.server.state.ServiceTest|9|30.218|
|org.apache.ambari.server.controller.test.BufferedThreadPoolExecutorCompletionServiceTest|4|36.114|


Diffs (updated)
-

  
ambari-server/src/main/java/org/apache/ambari/server/orm/dao/HostConfigMappingDAO.java
 77ff4a2 
  
ambari-server/src/test/java/org/apache/ambari/server/agent/TestHeartbeatMonitor.java
 b6f5ec2 
  
ambari-server/src/test/java/org/apache/ambari/server/controller/test/BufferedThreadPoolExecutorCompletionServiceTest.java
 ede1f1f 
  ambari-server/src/test/java/org/apache/ambari/server/orm/TestOrmImpl.java 
ce1c7e6 
  
ambari-server/src/test/java/org/apache/ambari/server/orm/dao/AlertDispatchDAOTest.java
 2518e0a 
  
ambari-server/src/test/java/org/apache/ambari/server/security/authorization/TestUsers.java
 9b9fee5 
  
ambari-server/src/test/java/org/apache/ambari/server/serveraction/upgrades/ConfigureActionTest.java
 be0aeef 
  
ambari-server/src/test/java/org/apache/ambari/server/serveraction/upgrades/UpgradeActionTest.java
 cb63b0f 
  ambari-server/src/test/java/org/apache/ambari/server/state/ServiceTest.java 
79fe0e9 
  
ambari-server/src/test/java/org/apache/ambari/server/state/svccomphost/ServiceComponentHostTest.java
 afcc90e 
  
ambari-server/src/test/java/org/apache/ambari/server/upgrade/UpgradeCatalog210Test.java
 50ba3ef 

Diff: https://reviews.apache.org/r/52044/diff/


Testing
---

mvn clean test


Thanks,

Vitalyi Brodetskyi