You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@storm.apache.org by pt...@apache.org on 2016/05/24 20:48:30 UTC
[6/7] storm git commit: [STORM-1851] Fix default nimbus impersonation
authorizer config
[STORM-1851] Fix default nimbus impersonation authorizer config
"nimbus.impersonation.authorizer" is set to "ImpersonationAuthorizer" by default and this causes issues when a user tries to submit topology as a different user in secure mode since the "nimbus.impersonation.acl" configuration is not set by default. Users need to set nimbus.impersonation.acl first before they can submit topology as any user other than "storm" in secure mode.
Removing this config allows users to submit topologies in secure mode as any user by default. Users can set up impersonation by providing both authorizer and the acls via storm.yaml.
Signed-off-by: P. Taylor Goetz <pt...@gmail.com>
Project: http://git-wip-us.apache.org/repos/asf/storm/repo
Commit: http://git-wip-us.apache.org/repos/asf/storm/commit/4561e27d
Tree: http://git-wip-us.apache.org/repos/asf/storm/tree/4561e27d
Diff: http://git-wip-us.apache.org/repos/asf/storm/diff/4561e27d
Branch: refs/heads/1.0.x-branch
Commit: 4561e27dd3dd7a9aef93c958bdbf6830d6226c50
Parents: d7e024e
Author: Arun Mahadevan <ai...@hortonworks.com>
Authored: Thu May 19 17:04:05 2016 +0530
Committer: P. Taylor Goetz <pt...@gmail.com>
Committed: Tue May 24 16:47:56 2016 -0400
----------------------------------------------------------------------
conf/defaults.yaml | 1 -
docs/SECURITY.md | 2 +-
2 files changed, 1 insertion(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/storm/blob/4561e27d/conf/defaults.yaml
----------------------------------------------------------------------
diff --git a/conf/defaults.yaml b/conf/defaults.yaml
index 9e731d0..9b081a4 100644
--- a/conf/defaults.yaml
+++ b/conf/defaults.yaml
@@ -76,7 +76,6 @@ nimbus.topology.validator: "org.apache.storm.nimbus.DefaultTopologyValidator"
topology.min.replication.count: 1
topology.max.replication.wait.time.sec: 60
nimbus.credential.renewers.freq.secs: 600
-nimbus.impersonation.authorizer: "org.apache.storm.security.auth.authorizer.ImpersonationAuthorizer"
nimbus.queue.size: 100000
scheduler.display.resource: false
http://git-wip-us.apache.org/repos/asf/storm/blob/4561e27d/docs/SECURITY.md
----------------------------------------------------------------------
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index b3ec303..98c55d3 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -391,7 +391,7 @@ A storm client may submit requests on behalf of another user. For example, if a
it can do so by leveraging the impersonation feature.In order to submit topology as some other user , you can use `StormSubmitter.submitTopologyAs` API. Alternatively you can use `NimbusClient.getConfiguredClientAs`
to get a nimbus client as some other user and perform any nimbus action(i.e. kill/rebalance/activate/deactivate) using this client.
-To ensure only authorized users can perform impersonation you should start nimbus with `nimbus.impersonation.authorizer` set to `org.apache.storm.security.auth.authorizer.ImpersonationAuthorizer`.
+Impersonation authorization is disabled by default which means any user can perform impersonation. To ensure only authorized users can perform impersonation you should start nimbus with `nimbus.impersonation.authorizer` set to `org.apache.storm.security.auth.authorizer.ImpersonationAuthorizer`.
The `ImpersonationAuthorizer` uses `nimbus.impersonation.acl` as the acl to authorize users. Following is a sample nimbus config for supporting impersonation:
```yaml