You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@impala.apache.org by "Tim Armstrong (Code Review)" <ge...@cloudera.org> on 2020/03/04 05:12:18 UTC

[Impala-ASF-CR] IMPALA-9456: allow disabling kerberos selectively 

Tim Armstrong has uploaded this change for review. ( http://gerrit.cloudera.org:8080/15351


Change subject: IMPALA-9456: allow disabling kerberos selectively
......................................................................

IMPALA-9456: allow disabling kerberos selectively

There are specific use cases where we need to talk to kerberized
services (HMS, etc) and want to keep our TGT up to date using Impala's
kinit infrastructure, but don't want to kerberize all connections.

Adds --skip_internal_kerberos_auth and --skip_external_kerberos_auth
to disable Kerberos authentication for incoming connections even if
--principal is set. The daemon does a kinit and keeps tickets
up-to-date with the background thread even if kerberos is disabled
for all incoming connections.

Behaviour only changes when those flags are toggled.

The change required restructuring the code a bit, specifically
pulling the call to InitKerberosForServer() out of
SecureAuthProvider, which I think is a net improvement that makes
the control flow clearer.

Testing:
Add unit tests to:
* confirm that the kinit occurs even with auth disabled.
* confirm that incoming KRPC connections do not require authentication.

I would have liked to add automated tests for thrift interfaces but did
not have the infrastructure to unit-test it. I think the changes I made
are fairly low risk because they do not increase the number of code paths
in AuthManager::Init() and can be verified by inspection. The tests I
would have liked to add are:
* confirm that incoming external connections do not require auth
* confirm that internal thrift connections do not require auth.

Manually started kerberized minicluster with internal/external kerberos
disabled, e.g. with the command line:

  start-impala-cluster.py
      --impalad_args=--skip_external_kerberos_auth=true
      --impalad_args=--skip_internal_kerberos_auth=true
      --state_store_args=--skip_internal_kerberos_auth=true
      --catalogd_args=--skip_internal_kerberos_auth=true

Confirmed that impala-shell connected without -k when
--skip_external_kerberos_auth=true and requires -k otherwise.
Confirmed that we could run queries against HDFS tables even
with internal and external auth disabled. Checked logs to see
that tickets were reacquired.

  I0303 08:33:49.319911 16079 init.cc:303] Successfully reacquired a new kerberos TGT

Tested that a partially kerberised minicluster worked as expected, i.e.
that impalad <-> catalog/statestore connections can have auth disabled
so that the impalad can authenticate even if it does not have the right
principal set. The first start-impala-cluster.py command below succeeds
but the second and third fail because they cannot authenticate with the
catalog and statestore respectively because the processes did not kinit
as the impala principal.

  kinit -kt impala.keytab tarmstrong/localhost@EXAMPLE.COM
  start-impala-cluster.py --impalad_args='--principal="" --be_principal=""
      --keytab_file="" --krb5_ccname="/tmp/krb5cc_1000"'
      --state_store_args=--skip_internal_kerberos_auth=true
      --catalogd_args=--skip_internal_kerberos_auth=true
  kinit -kt impala.keytab tarmstrong/localhost@EXAMPLE.COM
  start-impala-cluster.py --impalad_args='--principal="" --be_principal=""
      --keytab_file="" --krb5_ccname="/tmp/krb5cc_1000"'
      --state_store_args=--skip_internal_kerberos_auth=false
      --catalogd_args=--skip_internal_kerberos_auth=true
  kinit -kt impala.keytab tarmstrong/localhost@EXAMPLE.COM
  start-impala-cluster.py --impalad_args='--principal="" --be_principal=""
      --keytab_file="" --krb5_ccname="/tmp/krb5cc_1000"'
      --state_store_args=--skip_internal_kerberos_auth=false
      --catalogd_args=--skip_internal_kerberos_auth=true

Change-Id: I3b1c641e05e588287e4d9d9cd8389d96fc71cf74
---
M be/src/common/global-flags.cc
M be/src/rpc/auth-provider.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication.cc
M be/src/rpc/rpc-mgr-kerberized-test.cc
M be/src/rpc/rpc-mgr.cc
M be/src/util/auth-util.h
7 files changed, 128 insertions(+), 52 deletions(-)



  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/51/15351/2
-- 
To view, visit http://gerrit.cloudera.org:8080/15351
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I3b1c641e05e588287e4d9d9cd8389d96fc71cf74
Gerrit-Change-Number: 15351
Gerrit-PatchSet: 2
Gerrit-Owner: Tim Armstrong <ta...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>

[Impala-ASF-CR] IMPALA-9456: allow disabling kerberos selectively

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/15351 )

Change subject: IMPALA-9456: allow disabling kerberos selectively
......................................................................


Patch Set 4:

Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/5469/ DRY_RUN=false


-- 
To view, visit http://gerrit.cloudera.org:8080/15351
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I3b1c641e05e588287e4d9d9cd8389d96fc71cf74
Gerrit-Change-Number: 15351
Gerrit-PatchSet: 4
Gerrit-Owner: Tim Armstrong <ta...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Sahil Takiar <st...@cloudera.com>
Gerrit-Reviewer: Tim Armstrong <ta...@cloudera.com>
Gerrit-Comment-Date: Wed, 11 Mar 2020 20:19:42 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-9456: allow disabling kerberos selectively

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/15351 )

Change subject: IMPALA-9456: allow disabling kerberos selectively
......................................................................


Patch Set 3:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/5463/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/15351
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I3b1c641e05e588287e4d9d9cd8389d96fc71cf74
Gerrit-Change-Number: 15351
Gerrit-PatchSet: 3
Gerrit-Owner: Tim Armstrong <ta...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Sahil Takiar <st...@cloudera.com>
Gerrit-Reviewer: Tim Armstrong <ta...@cloudera.com>
Gerrit-Comment-Date: Mon, 09 Mar 2020 22:28:55 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-9456: allow disabling kerberos selectively

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/15351 )

Change subject: IMPALA-9456: allow disabling kerberos selectively
......................................................................


Patch Set 4: Verified+1


-- 
To view, visit http://gerrit.cloudera.org:8080/15351
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I3b1c641e05e588287e4d9d9cd8389d96fc71cf74
Gerrit-Change-Number: 15351
Gerrit-PatchSet: 4
Gerrit-Owner: Tim Armstrong <ta...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Sahil Takiar <st...@cloudera.com>
Gerrit-Reviewer: Tim Armstrong <ta...@cloudera.com>
Gerrit-Comment-Date: Thu, 12 Mar 2020 01:13:17 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-9456: allow disabling kerberos selectively

Posted by "Sahil Takiar (Code Review)" <ge...@cloudera.org>.
Sahil Takiar has posted comments on this change. ( http://gerrit.cloudera.org:8080/15351 )

Change subject: IMPALA-9456: allow disabling kerberos selectively
......................................................................


Patch Set 3: Code-Review+2


-- 
To view, visit http://gerrit.cloudera.org:8080/15351
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I3b1c641e05e588287e4d9d9cd8389d96fc71cf74
Gerrit-Change-Number: 15351
Gerrit-PatchSet: 3
Gerrit-Owner: Tim Armstrong <ta...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Sahil Takiar <st...@cloudera.com>
Gerrit-Reviewer: Tim Armstrong <ta...@cloudera.com>
Gerrit-Comment-Date: Wed, 11 Mar 2020 19:04:40 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-9456: allow disabling kerberos selectively

Posted by "Tim Armstrong (Code Review)" <ge...@cloudera.org>.
Tim Armstrong has posted comments on this change. ( http://gerrit.cloudera.org:8080/15351 )

Change subject: IMPALA-9456: allow disabling kerberos selectively
......................................................................


Patch Set 2:

(5 comments)

http://gerrit.cloudera.org:8080/#/c/15351/2/be/src/common/global-flags.cc
File be/src/common/global-flags.cc:

http://gerrit.cloudera.org:8080/#/c/15351/2/be/src/common/global-flags.cc@55
PS2, Line 55: DEFINE_bool(skip_internal_kerberos_auth, false,
            :     "(Advanced) skip kerberos authentication for incoming internal connections from "
            :     "other daemons within the Impala cluster (i.e. impalads, statestored, catalogd). "
            :     "Must be set to the same value across all daemons. Only has an effect if --principal "
            :     "is set, i.e. Kerberos is enabled.");
            : DEFINE_bool(skip_external_kerberos_auth, false,
            :     "(Advanced) skip kerberos authentication for incoming external connections to "
            :     "this daemon, e.g. clients connecting to the HS2 interface. Only has an effect "
            :     "if --principal is set, i.e. Kerberos is enabled.");
> what category does impalad-HMS connections fall into?
Neither - those are outgoing connections.


http://gerrit.cloudera.org:8080/#/c/15351/2/be/src/rpc/authentication.cc
File be/src/rpc/authentication.cc:

http://gerrit.cloudera.org:8080/#/c/15351/2/be/src/rpc/authentication.cc@a958
PS2, Line 958: 
> i think the docs for this method in authentication.h need to be updated to 
Done


http://gerrit.cloudera.org:8080/#/c/15351/2/be/src/rpc/authentication.cc@1231
PS2, Line 1231:  // Flags     | Internal | External
              :   // --------- | -------- | --------
              :   // None      | NoAuth   | NoAuth
              :   // LDAP only | NoAuth   | Sasl(ldap)
              :   // Kerb only | Sasl(be) | Sasl(fe)
              :   // Both      | Sasl(be) | Sasl(fe+ldap)
> does this table need to be updated? it seems there are a few more options n
I updated this comment a little bit. I didn't try to expand the table (16 rows would get unwieldy), but I think the impact of those flags on the table is easily explained.


http://gerrit.cloudera.org:8080/#/c/15351/2/be/src/rpc/authentication.cc@1293
PS2, Line 1293:  
> "and"
Done


http://gerrit.cloudera.org:8080/#/c/15351/2/be/src/rpc/authentication.cc@1295
PS2, Line 1295: kerberos_internal_principal
> what about the renew thread for the external principal?
Added a comment to explain why it's not needed. Basically servers in kerberos do not need to kinit because they don't need to acquire tickets for outbound connections.

This is the same behaviour as before this patch but with less indirection - external_auth_provider has is_internal_ = false, which means needs_kinit_ = false.



-- 
To view, visit http://gerrit.cloudera.org:8080/15351
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I3b1c641e05e588287e4d9d9cd8389d96fc71cf74
Gerrit-Change-Number: 15351
Gerrit-PatchSet: 2
Gerrit-Owner: Tim Armstrong <ta...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Sahil Takiar <st...@cloudera.com>
Gerrit-Reviewer: Tim Armstrong <ta...@cloudera.com>
Gerrit-Comment-Date: Mon, 09 Mar 2020 21:43:41 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-9456: allow disabling kerberos selectively

Posted by "Tim Armstrong (Code Review)" <ge...@cloudera.org>.
Tim Armstrong has posted comments on this change. ( http://gerrit.cloudera.org:8080/15351 )

Change subject: IMPALA-9456: allow disabling kerberos selectively
......................................................................


Patch Set 4: Code-Review+2


-- 
To view, visit http://gerrit.cloudera.org:8080/15351
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I3b1c641e05e588287e4d9d9cd8389d96fc71cf74
Gerrit-Change-Number: 15351
Gerrit-PatchSet: 4
Gerrit-Owner: Tim Armstrong <ta...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Sahil Takiar <st...@cloudera.com>
Gerrit-Reviewer: Tim Armstrong <ta...@cloudera.com>
Gerrit-Comment-Date: Wed, 11 Mar 2020 20:19:29 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-9456: allow disabling kerberos selectively

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/15351 )

Change subject: IMPALA-9456: allow disabling kerberos selectively
......................................................................

IMPALA-9456: allow disabling kerberos selectively

There are specific use cases where we need to talk to kerberized
services (HMS, etc) and want to keep our TGT up to date using Impala's
kinit infrastructure, but don't want to kerberize all connections.

Adds --skip_internal_kerberos_auth and --skip_external_kerberos_auth
to disable Kerberos authentication for incoming connections even if
--principal is set. The daemon does a kinit and keeps tickets
up-to-date with the background thread even if kerberos is disabled
for all incoming connections.

Behaviour only changes when those flags are toggled.

The change required restructuring the code a bit, specifically
pulling the call to InitKerberosForServer() out of
SecureAuthProvider, which I think is a net improvement that makes
the control flow clearer.

Testing:
Add unit tests to:
* confirm that the kinit occurs even with auth disabled.
* confirm that incoming KRPC connections do not require authentication.

I would have liked to add automated tests for thrift interfaces but did
not have the infrastructure to unit-test it. I think the changes I made
are fairly low risk because they do not increase the number of code paths
in AuthManager::Init() and can be verified by inspection. The tests I
would have liked to add are:
* confirm that incoming external connections do not require auth
* confirm that internal thrift connections do not require auth.

Manually started kerberized minicluster with internal/external kerberos
disabled, e.g. with the command line:

  start-impala-cluster.py
      --impalad_args=--skip_external_kerberos_auth=true
      --impalad_args=--skip_internal_kerberos_auth=true
      --state_store_args=--skip_internal_kerberos_auth=true
      --catalogd_args=--skip_internal_kerberos_auth=true

Confirmed that impala-shell connected without -k when
--skip_external_kerberos_auth=true and requires -k otherwise.
Confirmed that we could run queries against HDFS tables even
with internal and external auth disabled. Checked logs to see
that tickets were reacquired.

  I0303 08:33:49.319911 16079 init.cc:303] Successfully reacquired a new kerberos TGT

Tested that a partially kerberised minicluster worked as expected, i.e.
that impalad <-> catalog/statestore connections can have auth disabled
so that the impalad can authenticate even if it does not have the right
principal set. The first start-impala-cluster.py command below succeeds
but the second and third fail because they cannot authenticate with the
catalog and statestore respectively because the processes did not kinit
as the impala principal.

  kinit -kt impala.keytab tarmstrong/localhost@EXAMPLE.COM
  start-impala-cluster.py --impalad_args='--principal="" --be_principal=""
      --keytab_file="" --krb5_ccname="/tmp/krb5cc_1000"'
      --state_store_args=--skip_internal_kerberos_auth=true
      --catalogd_args=--skip_internal_kerberos_auth=true
  kinit -kt impala.keytab tarmstrong/localhost@EXAMPLE.COM
  start-impala-cluster.py --impalad_args='--principal="" --be_principal=""
      --keytab_file="" --krb5_ccname="/tmp/krb5cc_1000"'
      --state_store_args=--skip_internal_kerberos_auth=false
      --catalogd_args=--skip_internal_kerberos_auth=true
  kinit -kt impala.keytab tarmstrong/localhost@EXAMPLE.COM
  start-impala-cluster.py --impalad_args='--principal="" --be_principal=""
      --keytab_file="" --krb5_ccname="/tmp/krb5cc_1000"'
      --state_store_args=--skip_internal_kerberos_auth=false
      --catalogd_args=--skip_internal_kerberos_auth=true

Change-Id: I3b1c641e05e588287e4d9d9cd8389d96fc71cf74
Reviewed-on: http://gerrit.cloudera.org:8080/15351
Reviewed-by: Tim Armstrong <ta...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
---
M be/src/common/global-flags.cc
M be/src/rpc/auth-provider.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication.cc
M be/src/rpc/rpc-mgr-kerberized-test.cc
M be/src/rpc/rpc-mgr.cc
M be/src/util/auth-util.h
7 files changed, 138 insertions(+), 54 deletions(-)

Approvals:
  Tim Armstrong: Looks good to me, approved
  Impala Public Jenkins: Verified

-- 
To view, visit http://gerrit.cloudera.org:8080/15351
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I3b1c641e05e588287e4d9d9cd8389d96fc71cf74
Gerrit-Change-Number: 15351
Gerrit-PatchSet: 5
Gerrit-Owner: Tim Armstrong <ta...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Sahil Takiar <st...@cloudera.com>
Gerrit-Reviewer: Tim Armstrong <ta...@cloudera.com>

[Impala-ASF-CR] IMPALA-9456: allow disabling kerberos selectively

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/15351 )

Change subject: IMPALA-9456: allow disabling kerberos selectively
......................................................................


Patch Set 2:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/5414/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/15351
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I3b1c641e05e588287e4d9d9cd8389d96fc71cf74
Gerrit-Change-Number: 15351
Gerrit-PatchSet: 2
Gerrit-Owner: Tim Armstrong <ta...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 04 Mar 2020 05:59:03 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-9456: allow disabling kerberos selectively

Posted by "Tim Armstrong (Code Review)" <ge...@cloudera.org>.
Hello Sahil Takiar, Impala Public Jenkins, 

I'd like you to reexamine a change. Please visit

    http://gerrit.cloudera.org:8080/15351

to look at the new patch set (#3).

Change subject: IMPALA-9456: allow disabling kerberos selectively
......................................................................

IMPALA-9456: allow disabling kerberos selectively

There are specific use cases where we need to talk to kerberized
services (HMS, etc) and want to keep our TGT up to date using Impala's
kinit infrastructure, but don't want to kerberize all connections.

Adds --skip_internal_kerberos_auth and --skip_external_kerberos_auth
to disable Kerberos authentication for incoming connections even if
--principal is set. The daemon does a kinit and keeps tickets
up-to-date with the background thread even if kerberos is disabled
for all incoming connections.

Behaviour only changes when those flags are toggled.

The change required restructuring the code a bit, specifically
pulling the call to InitKerberosForServer() out of
SecureAuthProvider, which I think is a net improvement that makes
the control flow clearer.

Testing:
Add unit tests to:
* confirm that the kinit occurs even with auth disabled.
* confirm that incoming KRPC connections do not require authentication.

I would have liked to add automated tests for thrift interfaces but did
not have the infrastructure to unit-test it. I think the changes I made
are fairly low risk because they do not increase the number of code paths
in AuthManager::Init() and can be verified by inspection. The tests I
would have liked to add are:
* confirm that incoming external connections do not require auth
* confirm that internal thrift connections do not require auth.

Manually started kerberized minicluster with internal/external kerberos
disabled, e.g. with the command line:

  start-impala-cluster.py
      --impalad_args=--skip_external_kerberos_auth=true
      --impalad_args=--skip_internal_kerberos_auth=true
      --state_store_args=--skip_internal_kerberos_auth=true
      --catalogd_args=--skip_internal_kerberos_auth=true

Confirmed that impala-shell connected without -k when
--skip_external_kerberos_auth=true and requires -k otherwise.
Confirmed that we could run queries against HDFS tables even
with internal and external auth disabled. Checked logs to see
that tickets were reacquired.

  I0303 08:33:49.319911 16079 init.cc:303] Successfully reacquired a new kerberos TGT

Tested that a partially kerberised minicluster worked as expected, i.e.
that impalad <-> catalog/statestore connections can have auth disabled
so that the impalad can authenticate even if it does not have the right
principal set. The first start-impala-cluster.py command below succeeds
but the second and third fail because they cannot authenticate with the
catalog and statestore respectively because the processes did not kinit
as the impala principal.

  kinit -kt impala.keytab tarmstrong/localhost@EXAMPLE.COM
  start-impala-cluster.py --impalad_args='--principal="" --be_principal=""
      --keytab_file="" --krb5_ccname="/tmp/krb5cc_1000"'
      --state_store_args=--skip_internal_kerberos_auth=true
      --catalogd_args=--skip_internal_kerberos_auth=true
  kinit -kt impala.keytab tarmstrong/localhost@EXAMPLE.COM
  start-impala-cluster.py --impalad_args='--principal="" --be_principal=""
      --keytab_file="" --krb5_ccname="/tmp/krb5cc_1000"'
      --state_store_args=--skip_internal_kerberos_auth=false
      --catalogd_args=--skip_internal_kerberos_auth=true
  kinit -kt impala.keytab tarmstrong/localhost@EXAMPLE.COM
  start-impala-cluster.py --impalad_args='--principal="" --be_principal=""
      --keytab_file="" --krb5_ccname="/tmp/krb5cc_1000"'
      --state_store_args=--skip_internal_kerberos_auth=false
      --catalogd_args=--skip_internal_kerberos_auth=true

Change-Id: I3b1c641e05e588287e4d9d9cd8389d96fc71cf74
---
M be/src/common/global-flags.cc
M be/src/rpc/auth-provider.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication.cc
M be/src/rpc/rpc-mgr-kerberized-test.cc
M be/src/rpc/rpc-mgr.cc
M be/src/util/auth-util.h
7 files changed, 138 insertions(+), 54 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/51/15351/3
-- 
To view, visit http://gerrit.cloudera.org:8080/15351
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I3b1c641e05e588287e4d9d9cd8389d96fc71cf74
Gerrit-Change-Number: 15351
Gerrit-PatchSet: 3
Gerrit-Owner: Tim Armstrong <ta...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Sahil Takiar <st...@cloudera.com>

[Impala-ASF-CR] IMPALA-9456: allow disabling kerberos selectively

Posted by "Sahil Takiar (Code Review)" <ge...@cloudera.org>.
Sahil Takiar has posted comments on this change. ( http://gerrit.cloudera.org:8080/15351 )

Change subject: IMPALA-9456: allow disabling kerberos selectively
......................................................................


Patch Set 2:

(5 comments)

http://gerrit.cloudera.org:8080/#/c/15351/2/be/src/common/global-flags.cc
File be/src/common/global-flags.cc:

http://gerrit.cloudera.org:8080/#/c/15351/2/be/src/common/global-flags.cc@55
PS2, Line 55: DEFINE_bool(skip_internal_kerberos_auth, false,
            :     "(Advanced) skip kerberos authentication for incoming internal connections from "
            :     "other daemons within the Impala cluster (i.e. impalads, statestored, catalogd). "
            :     "Must be set to the same value across all daemons. Only has an effect if --principal "
            :     "is set, i.e. Kerberos is enabled.");
            : DEFINE_bool(skip_external_kerberos_auth, false,
            :     "(Advanced) skip kerberos authentication for incoming external connections to "
            :     "this daemon, e.g. clients connecting to the HS2 interface. Only has an effect "
            :     "if --principal is set, i.e. Kerberos is enabled.");
what category does impalad-HMS connections fall into?


http://gerrit.cloudera.org:8080/#/c/15351/2/be/src/rpc/authentication.cc
File be/src/rpc/authentication.cc:

http://gerrit.cloudera.org:8080/#/c/15351/2/be/src/rpc/authentication.cc@a958
PS2, Line 958: 
i think the docs for this method in authentication.h need to be updated to reflect this change


http://gerrit.cloudera.org:8080/#/c/15351/2/be/src/rpc/authentication.cc@1231
PS2, Line 1231:  // Flags     | Internal | External
              :   // --------- | -------- | --------
              :   // None      | NoAuth   | NoAuth
              :   // LDAP only | NoAuth   | Sasl(ldap)
              :   // Kerb only | Sasl(be) | Sasl(fe)
              :   // Both      | Sasl(be) | Sasl(fe+ldap)
does this table need to be updated? it seems there are a few more options now since --skip_internal_kerberos_auth and --skip_external_kerberos_auth can change if Internal or External auth are enabled


http://gerrit.cloudera.org:8080/#/c/15351/2/be/src/rpc/authentication.cc@1293
PS2, Line 1293:  
"and"


http://gerrit.cloudera.org:8080/#/c/15351/2/be/src/rpc/authentication.cc@1295
PS2, Line 1295: kerberos_internal_principal
what about the renew thread for the external principal?



-- 
To view, visit http://gerrit.cloudera.org:8080/15351
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I3b1c641e05e588287e4d9d9cd8389d96fc71cf74
Gerrit-Change-Number: 15351
Gerrit-PatchSet: 2
Gerrit-Owner: Tim Armstrong <ta...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Sahil Takiar <st...@cloudera.com>
Gerrit-Comment-Date: Fri, 06 Mar 2020 23:48:50 +0000
Gerrit-HasComments: Yes