You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@accumulo.apache.org by "Josh Elser (JIRA)" <ji...@apache.org> on 2016/05/09 16:56:12 UTC
[jira] [Commented] (ACCUMULO-4306) Support Kerberos authentication
terminating at Accumulo
[ https://issues.apache.org/jira/browse/ACCUMULO-4306?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15276611#comment-15276611 ]
Josh Elser commented on ACCUMULO-4306:
--------------------------------------
Been talking with Bill about this offline for quite some time now. While I find it strange that Accumulo would be the only one running with Kerberos enabled, I can't necessarily find fault in this approach to make this work. UGI is kind of wonky to begin with and a Subject-based approach would be a little more straightforward as an added benefit.
> Support Kerberos authentication terminating at Accumulo
> -------------------------------------------------------
>
> Key: ACCUMULO-4306
> URL: https://issues.apache.org/jira/browse/ACCUMULO-4306
> Project: Accumulo
> Issue Type: Improvement
> Components: core, rpc
> Reporter: William Slacum
> Assignee: William Slacum
> Labels: authentication, kerberos
> Fix For: 1.8.0
>
>
> We currently support Kerberos authentication via SASL+GSSAPI. Due to an implementation detail, turning it on requires also enabling Kerberos for HDFS.
> This ticket proposes changing the implementation to avoid needing to turn on Kerberos authentication for HDFS, but still (optionally) using it. Mostly, I think this boils down to replacing uses of {{UserGroupInformation}} with {{Subject}} references. There are couple places (specifically around creating delegation tokens for use with a Kerberos-enabled Hadoop cluster) where `UserGroupInformation` may need to stick around.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)