[
https://issues.apache.org/jira/browse/YARN-4632?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15121283#comment-15121283
]
Steve Loughran commented on YARN-4632:
--------------------------------------
Dan, thanks for the details. I believe I did mention in passing in my talk that
the RM renews things (it has to, to handle AM restart even after an interval >
token expiry).
I've just created YARN-4653 to cover writing up yarn security properly; I'll
pull your text in
> Replacing _HOST in RM_PRINCIPAL should not be the responsibility of the
> client code
> -----------------------------------------------------------------------------------
>
> Key: YARN-4632
> URL: https://issues.apache.org/jira/browse/YARN-4632
> Project: Hadoop YARN
> Issue Type: Improvement
> Components: api, resourcemanager
> Affects Versions: 2.7.1
> Reporter: Daniel Templeton
> Assignee: Daniel Templeton
> Priority: Critical
>
> It is currently the client's responsibility to call
> {{SecurityUtil.getServerPrincipal()}} to replace the _HOST placeholder in any
> principal name used for a delegation token. This is a non-optional operation
> and should not be pushed onto the client.
> All client apps that followed the distributed shell as the canonical example
> failed to do the replacement because distributed shell fails to do the
> replacement. (See YARN-4629.) Rather than fixing the whole world, since the
> whole world use distributed shell as a model, let's move the operation into
> YARN where it belongs.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
