Chris Douglas commented on YARN-3100:

bq. I agree with you that if construction of Q' fails, we possibly get a mix of 
Q' and Q ACLs, which happens in the existing code.

I think the existing code doesn't have this property. ACLs 
 from the config are stored in a [member 
 If construction fails, those ACLs aren't installed. The patch moves 
enforcement to the authorizer:
   public boolean hasAccess(QueueACL acl, UserGroupInformation user) {
     synchronized (this) {
-      if (acls.get(acl).isUserAllowed(user)) {
+      if (authorizer.checkPermission(toAccessType(acl), queueEntity, user)) {
         return true;
Which is updated during construction of the replacement queue hierarchy.

> Make YARN authorization pluggable
> ---------------------------------
>                 Key: YARN-3100
>                 URL: https://issues.apache.org/jira/browse/YARN-3100
>             Project: Hadoop YARN
>          Issue Type: Bug
>            Reporter: Jian He
>            Assignee: Jian He
>         Attachments: YARN-3100.1.patch, YARN-3100.2.patch
> The goal is to have YARN acl model pluggable so as to integrate other 
> authorization tool such as Apache Ranger, Sentry.
> Currently, we have 
> - admin ACL
> - queue ACL
> - application ACL
> - time line domain ACL
> - service ACL
> The proposal is to create a YarnAuthorizationProvider interface. Current 
> implementation will be the default implementation. Ranger or Sentry plug-in 
> can implement  this interface.
> Benefit:
> -  Unify the code base. With the default implementation, we can get rid of 
> each specific ACL manager such as AdminAclManager, ApplicationACLsManager, 
> QueueAclsManager etc.
> - Enable Ranger, Sentry to do authorization for YARN. 

This message was sent by Atlassian JIRA

Reply via email to