You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "Bharat Viswanadham (Jira)" <ji...@apache.org> on 2021/04/01 07:22:00 UTC
[jira] [Updated] (HDDS-5052) [SCM HA Security] Handle leader
changes between SCMInfo and getSCMSigned Cert in OM
[ https://issues.apache.org/jira/browse/HDDS-5052?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Bharat Viswanadham updated HDDS-5052:
-------------------------------------
Description:
This Jira is to handle leader change between getScmInfo and getScmSignedCert.
*Problem:*
*Leader is SCM1 - Returned SCMID is SCM1ID*
ScmInfo returns the leader SCMID
*Leader is SCM2 - SCM ID is SCM2ID*
getSCMSignedCert, during generate certificate it has a check compare the scmId passed in CSR, is same as current SCM scmID
In this case when the leader change between these 2 calls OM will fail to get a Certificate.
was:
This Jira is to handle leader change between getScmInfo and getScmSignedCert.
*Problem:*
*Leader is SCM1 - Returned SCMID is SCM1ID*
ScmInfo returns the leader SCMID
*Leader is SCM2 - SCM ID is SCM2ID*
getSCMSignedCert, during generate certificate it has a check compare the scmId passed in CSR, is same as current SCM scmID
In this case when the leader change between these 2 calls OM will fail to get a Certificate.
*Proposed Solution:*
getScmInfo returns primary SCM ID, and OM can pass this Primary SCM ID in CSR.
In this way, even if the leader changes OM can still get a certificate.
Note: primary SCM Id is the same across the SCM HA quorum nodes.
> [SCM HA Security] Handle leader changes between SCMInfo and getSCMSigned Cert in OM
> -----------------------------------------------------------------------------------
>
> Key: HDDS-5052
> URL: https://issues.apache.org/jira/browse/HDDS-5052
> Project: Apache Ozone
> Issue Type: Sub-task
> Components: SCM HA
> Reporter: Bharat Viswanadham
> Assignee: Bharat Viswanadham
> Priority: Major
> Labels: pull-request-available
>
> This Jira is to handle leader change between getScmInfo and getScmSignedCert.
> *Problem:*
> *Leader is SCM1 - Returned SCMID is SCM1ID*
> ScmInfo returns the leader SCMID
> *Leader is SCM2 - SCM ID is SCM2ID*
> getSCMSignedCert, during generate certificate it has a check compare the scmId passed in CSR, is same as current SCM scmID
> In this case when the leader change between these 2 calls OM will fail to get a Certificate.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org