[jira] [Assigned] (AMBARI-26632) Complete React parity for Kerberos administration workflows

["Jialiang Cai (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/AMBARI-26632?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jialiang Cai reassigned AMBARI-26632:
-------------------------------------

    Assignee: Jialiang Cai

> Complete React parity for Kerberos administration workflows
> -----------------------------------------------------------
>
>                 Key: AMBARI-26632
>                 URL: https://issues.apache.org/jira/browse/AMBARI-26632
>             Project: Ambari
>          Issue Type: Improvement
>            Reporter: Jialiang Cai
>            Assignee: Jialiang Cai
>            Priority: Major
>          Time Spent: 0.5h
>  Remaining Estimate: 0h
>
> <!---
>    Licensed to the Apache Software Foundation (ASF) under one or more
>    contributor license agreements.  See the NOTICE file distributed with
>    this work for additional information regarding copyright ownership.
>    The ASF licenses this file to You under the Apache License, Version 2.0
>    (the "License"); you may not use this file except in compliance with
>    the License.  You may obtain a copy of the License at
>        http://www.apache.org/licenses/LICENSE-2.0
>    Unless required by applicable law or agreed to in writing, software
>    distributed under the License is distributed on an "AS IS" BASIS,
>    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
>    See the License for the specific language governing permissions and
>    limitations under the License.
> -->
> h2. Problem
> The React Kerberos UI exposes the primary Enable, Disable, identity, credential,
> and keytab screens, but the implementation does not yet provide a reliable
> equivalent to the Classic Ember workflow. KDC mode forcing, resource creation,
> Step 3 client installation, Stack Advisor, descriptor fallback, long-running
> request recovery, formal exit cleanup, Disable failure paths, credential error
> propagation, and Regenerate convergence have incomplete or incorrect behavior.
> This issue covers the complete non-Metrics Kerberos module defined by the 81
> feature IDs in {{docs/frontend-refactor/ember-baseline/08-kerberos.md}}. The React
> comparison and runtime matrix are recorded in
> {{docs/frontend-refactor/react-current/08-kerberos-gap.md}}.
> h2. Scope
> * Preserve permission and feature gates, security-status loading, installed-service warnings, and optional pre-Kerberize checks.
> * Preserve the Classic Disable deep link and wizard-owner exclusion across routes and navigation.
> * Implement MIT, Active Directory, IPA, and Manual mode visibility, forced values, prerequisites, and navigation.
> * Make Step 2 resource/config/session creation ordered, failure-propagating, retryable, and duplicate-safe.
> * Install KERBEROS_CLIENT through the Classic INIT versus initialized branches and run service/heartbeat checks with Retry and Ignore Errors.
> * Load, recommend, edit, create/update, and recover Kerberos descriptor values without losing the current form.
> * Preserve mode-specific confirmation and Manual CSV responsibility with visible download failure.
> * Stop services, perform ATS compatibility cleanup, force-retry Kerberize, and start/test services with persisted request recovery.
> * Complete or exit the wizard through atomic recovery-state cleanup and formal best-effort unkerberize/service deletion.
> * Serialize recovery checkpoints before completion/discard reset and expose load/save Retry without replaying mutations.
> * Implement Disable sequencing, unkerberize Skip, idempotent service removal, service-check policy, and completion gating.
> * Align identity management, automatic/Manual Regenerate, persistent KDC credential management, and invalid-session replay.
> * Add focused tests for request shapes, mode branches, failure ordering, polling/recovery, credential CRUD, and compatibility fixes.
> * Record cross-module Add Service, Add Host/component, Service/Host, Reassign, HA, and Federation acceptance boundaries.
> h2. Acceptance Criteria
> * All 81 baseline IDs have a mutually exclusive status and evidence in the React comparison.
> * The Kerberos routes require {{CLUSTER.TOGGLE_KERBEROS}} and {{enableToggleKerberos}}; CSV retains its independent upgrade authorization.
> * A non-owner cannot see or enter Kerberos while another user owns a wizard, and every completion/discard path clears ownership.
> * Step 1 uses the Classic prerequisite sets and shows the ONEFS item only when ONEFS is installed.
> * Manual and IPA forced configuration values are included in the submitted desired configs.
> * Step 2 stops after any failed prerequisite, retains input, unlocks Retry, and never reports false success.
> * Step 3 reads component state and submits exactly one of service installation or named host-component installation.
> * Stack Advisor is called only for a first Step 4 load, recommendations are applied before display, and saved form recovery avoids duplicate recommendation.
> * Descriptor create/update fallback is limited to the expected 409/404 response and remains one awaited promise.
> * Steps 3, 6, 7, and 8 recover request IDs and poll existing work instead of repeating mutations.
> * Exit from Steps 1-7 attempts unkerberize and KERBEROS deletion before clearing state; Step 8 never rolls back enabled security.
> * Disable exposes the identity-management Skip only after unkerberize failure and cannot hang on obsolete-service deletion.
> * Disable deep linking opens the same guarded flow, and Complete reloads the current security type on the canonical route.
> * Credential CRUD failures remain errors, retain input, and never replay the protected operation.
> * Regenerate tracks its returned request and starts optional component restart only after successful completion.
> * Submission failure or tracker close releases Regenerate so a later action submits a new request.
> * Every timer and request poll is invalidated on terminal state, retry, dependency change, or unmount.
> * Focused frontend tests, TypeScript, build, lint, baseline validation, and helper tests pass or have pre-existing failures documented exactly.
> * The real-cluster runtime matrix passes before operational parity is claimed.
> h2. Partial Cross-Module Boundaries
> {{KRB-X-001}} through {{KRB-X-005}} require integration with the Add Service, Add
> Host/Hosts, Services, Reassign, HA, and Federation modules. This issue validates
> the shared KDC-session and Regenerate contracts but does not duplicate those
> modules' wizard or component code.
> Disable refresh/server-restart recovery and Manual principal/keytab fulfillment
> cannot be closed by static frontend tests. They remain explicit runtime gates.
> h2. Out of Scope
> * Metrics pages, charts, widgets, metric polling, Metrics APIs, and any Metrics-specific Kerberos presentation.
> * Reproducing the broken Classic Step 3 Rollback or unreachable Skip controls.
> * Adding a user action for the Classic Step 7 test-only unkerberize method.
> * Reproducing false-success credential behavior or the undefined descriptor fallback callback.
> * Rewriting Add Service, Add Host, Reassign, HA, Federation, or global Background Operations in this issue.
> h2. Compatibility Decisions
> React treats prerequisite and credential failures as failures instead of
> continuing like Classic. Descriptor fallback is atomic. CSV and ATS failures are
> recoverable. Regenerate follows its own request rather than unrelated global
> operation counts. Disable does not clear Add Service state. These are deliberate
> correctness fixes and are not missing parity.
> The unusual API-root pre-Kerberize GET and direct Step 7 force-retry semantics
> are retained because they are executable Classic contracts.
> h2. Verification Boundary
> Unit and component tests cannot prove MIT, Active Directory, IPA, or Manual KDC
> operation. They also cannot prove server-side principal/keytab effects, service
> restart convergence, websocket/background presentation, or refresh after a
> server restart. Do not mark this issue operationally complete until the runtime
> matrix in {{08-kerberos-gap.md}} has been executed against real environments.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ambari.apache.org
For additional commands, e-mail: issues-help@ambari.apache.org