You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "Wei-Chiu Chuang (Jira)" <ji...@apache.org> on 2026/01/21 17:03:00 UTC
[jira] [Updated] (HDDS-14469) CLONE - [Docs] Core Concepts -> Security -> Users/groups
[ https://issues.apache.org/jira/browse/HDDS-14469?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Wei-Chiu Chuang updated HDDS-14469:
-----------------------------------
Description:
Add a doc in v2 site for "Users and groups" under Core Concepts -> Security [https://ozone-site-v2.staged.apache.org/docs/core-concepts/security/]
There's not a corresponding v1 doc on this topic, so we need to come up with something.
Users -- every host in the cluster must have consistent mechanism to identify a user. If it's a Kerberized environment, a user name is mapped from the Kerberos principal. If it's a simple (unsecure) environment, a user is whatever a client it is.
Groups -- Groups mapping mechanism. Groups is only used for administrator privilege check.
If Ranger authorization is used, group resolution is performed at Ranger.
was:
Write for v2 doc [https://ozone-site-v2.staged.apache.org/docs/core-concepts/security/kerberos]
There's not a corresponding v1 doc on this topic, so we need to come up with something.
What is Kerberos authentication protocol?
What Kerberos does _not_ do
How Ozone uses Kerberos
* Client → Ozone authentication
* Service → Service authentication (internal)
Kerberos over HTTP using SPNEGO
> CLONE - [Docs] Core Concepts -> Security -> Users/groups
> --------------------------------------------------------
>
> Key: HDDS-14469
> URL: https://issues.apache.org/jira/browse/HDDS-14469
> Project: Apache Ozone
> Issue Type: Task
> Components: documentation
> Reporter: Wei-Chiu Chuang
> Priority: Major
>
> Add a doc in v2 site for "Users and groups" under Core Concepts -> Security [https://ozone-site-v2.staged.apache.org/docs/core-concepts/security/]
>
> There's not a corresponding v1 doc on this topic, so we need to come up with something.
> Users -- every host in the cluster must have consistent mechanism to identify a user. If it's a Kerberized environment, a user name is mapped from the Kerberos principal. If it's a simple (unsecure) environment, a user is whatever a client it is.
> Groups -- Groups mapping mechanism. Groups is only used for administrator privilege check.
> If Ranger authorization is used, group resolution is performed at Ranger.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org