You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@metron.apache.org by "ASF GitHub Bot (JIRA)" <ji...@apache.org> on 2017/04/18 21:52:41 UTC
[jira] [Commented] (METRON-859) Use REST application with Kerberos
[ https://issues.apache.org/jira/browse/METRON-859?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15973583#comment-15973583 ]
ASF GitHub Bot commented on METRON-859:
---------------------------------------
GitHub user merrimanr opened a pull request:
https://github.com/apache/incubator-metron/pull/535
METRON-859: Use REST application with Kerberos
## Contributor Comments
This PR enables the REST application to function in a Kerberized cluster. Testing instructions are as follows:
1. Follow the instructions in /incubator-metron/metron-deployment/vagrant/Kerberos-setup.md to Kerberize Metron in full dev.
2. Follow the instructions in the "Quick Dev" section of /incubator-metron/metron-interface/metron-rest/README.md to deploy and start the REST application "locally on the Quick Dev host" (full dev host in this case). Make sure you use the start command for a Kerberos enabled cluster (the one with the -Djava.security.auth.login.config parameter).
3. Navigate to http://node1:8082/swagger-ui.html and exercise the various endpoints. The endpoints should function normally and there should be no security-related errors returned.
The REST application uses keytabs to authenticate the various services. A summary of where these come from for each service:
- Kafka and Zookeeper principals/keytabs come from the client_jaas.conf file created during Kerberos setup
- HDFS and Storm principals/keytabs come from the Spring kerberos.principal and kerberos.keytab properties (should there be separate properties for each service?)
Unit tests were added for new Kerberos related code but integration tests still assume a non-Kerberized testing environment. I believe adjusting our integration testing framework to support Kerberos is out of scope for this PR and I'm not sure it's even possible.
This was also tested for regressions against a non-Kerberized cluster (start command is differently obviously).
## Pull Request Checklist
Thank you for submitting a contribution to Apache Metron (Incubating).
Please refer to our [Development Guidelines](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=61332235) for the complete guide to follow for contributions.
Please refer also to our [Build Verification Guidelines](https://cwiki.apache.org/confluence/display/METRON/Verifying+Builds?show-miniview) for complete smoke testing guides.
In order to streamline the review of the contribution we ask you follow these guidelines and ask you to double check the following:
### For all changes:
- [x] Is there a JIRA ticket associated with this PR? If not one needs to be created at [Metron Jira](https://issues.apache.org/jira/browse/METRON/?selectedTab=com.atlassian.jira.jira-projects-plugin:summary-panel).
- [x] Does your PR title start with METRON-XXXX where XXXX is the JIRA number you are trying to resolve? Pay particular attention to the hyphen "-" character.
- [x] Has your PR been rebased against the latest commit within the target branch (typically master)?
### For code changes:
- [x] Have you included steps to reproduce the behavior or problem that is being changed or addressed?
- [x] Have you included steps or a guide to how the change may be verified and tested manually?
- [x] Have you ensured that the full suite of tests and checks have been executed in the root incubating-metron folder via:
```
mvn -q clean integration-test install && build_utils/verify_licenses.sh
```
- [x] Have you written or updated unit tests and or integration tests to verify your changes?
- [x] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [x] Have you verified the basic functionality of the build by building and running locally with Vagrant full-dev environment or the equivalent?
### For documentation related changes:
- [x] Have you ensured that format looks appropriate for the output in which it is rendered by building and verifying the site-book? If not then run the following commands and the verify changes via `site-book/target/site/index.html`:
```
cd site-book
bin/generate-md.sh
mvn site:site
```
#### Note:
Please ensure that once the PR is submitted, you check travis-ci for build issues and submit an update to your PR as soon as possible.
It is also recommened that [travis-ci](https://travis-ci.org) is set up for your personal repository such that your branches are built there before submitting a pull request.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/merrimanr/incubator-metron METRON-859
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/incubator-metron/pull/535.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #535
----
commit 17e3b273bda19d5365e177c1bc8d00fbb226e378
Author: merrimanr <me...@gmail.com>
Date: 2017-04-18T15:24:08Z
updated rpm build ansible task
commit 525b384dd9703acd6003ae07c879e1bee5813c9a
Author: merrimanr <me...@gmail.com>
Date: 2017-04-18T17:27:56Z
Added Kerberos support to the REST application
commit 03d4e48f8a59dc05758bfb7d917db4f4c9ec594e
Author: merrimanr <me...@gmail.com>
Date: 2017-04-18T21:16:41Z
Merge remote-tracking branch 'mirror/master' into METRON-859
commit 20144bcee36caa55237ea3d61f266d9673b7cccb
Author: merrimanr <me...@gmail.com>
Date: 2017-04-18T21:35:10Z
Changed principle to principal
----
> Use REST application with Kerberos
> ----------------------------------
>
> Key: METRON-859
> URL: https://issues.apache.org/jira/browse/METRON-859
> Project: Metron
> Issue Type: New Feature
> Reporter: Ryan Merriman
>
> The REST application should work in a kerberized cluster.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)