You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-dev@hadoop.apache.org by "Aaron T. Myers (JIRA)" <ji...@apache.org> on 2010/09/13 20:57:34 UTC
[jira] Created: (HADOOP-6951) Distinct minicluster services (e.g.
NN and JT) overwrite each other's service policies
Distinct minicluster services (e.g. NN and JT) overwrite each other's service policies
--------------------------------------------------------------------------------------
Key: HADOOP-6951
URL: https://issues.apache.org/jira/browse/HADOOP-6951
Project: Hadoop Common
Issue Type: Bug
Components: security
Reporter: Aaron T. Myers
Because the protocol -> ACL mapping in ServiceAuthorizationManager is static, services which are run in the same JVM have the potential to clobber the other's service authorization ACLs whenever ServiceAuthorizationManager.refresh() is called. This causes authorization failures if one tries to launch a 2NN connected to a minicluster with hadoop.security.authorization enabled. Seems like each service should have its own instance of a ServiceAuthorizationManager, instead of using static methods.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Reopened: (HADOOP-6951) Distinct minicluster services (e.g.
NN and JT) overwrite each other's service policies
Posted by "Tom White (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-6951?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tom White reopened HADOOP-6951:
-------------------------------
I've now reverted this in trunk.
> Distinct minicluster services (e.g. NN and JT) overwrite each other's service policies
> --------------------------------------------------------------------------------------
>
> Key: HADOOP-6951
> URL: https://issues.apache.org/jira/browse/HADOOP-6951
> Project: Hadoop Common
> Issue Type: Bug
> Components: security
> Reporter: Aaron T. Myers
> Assignee: Aaron T. Myers
> Fix For: 0.22.0
>
> Attachments: hadoop-6951.1.txt, hadoop-6951.2.txt, hadoop-6951.txt.0
>
>
> Because the protocol -> ACL mapping in ServiceAuthorizationManager is static, services which are run in the same JVM have the potential to clobber the other's service authorization ACLs whenever ServiceAuthorizationManager.refresh() is called. This causes authorization failures if one tries to launch a 2NN connected to a minicluster with hadoop.security.authorization enabled. Seems like each service should have its own instance of a ServiceAuthorizationManager, instead of using static methods.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (HADOOP-6951) Distinct minicluster services (e.g.
NN and JT) overwrite each other's service policies
Posted by "Tom White (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-6951?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tom White resolved HADOOP-6951.
-------------------------------
Resolution: Fixed
> Distinct minicluster services (e.g. NN and JT) overwrite each other's service policies
> --------------------------------------------------------------------------------------
>
> Key: HADOOP-6951
> URL: https://issues.apache.org/jira/browse/HADOOP-6951
> Project: Hadoop Common
> Issue Type: Bug
> Components: security
> Reporter: Aaron T. Myers
> Assignee: Aaron T. Myers
> Fix For: 0.22.0
>
> Attachments: hadoop-6951.1.txt, hadoop-6951.2.txt, hadoop-6951.txt.0
>
>
> Because the protocol -> ACL mapping in ServiceAuthorizationManager is static, services which are run in the same JVM have the potential to clobber the other's service authorization ACLs whenever ServiceAuthorizationManager.refresh() is called. This causes authorization failures if one tries to launch a 2NN connected to a minicluster with hadoop.security.authorization enabled. Seems like each service should have its own instance of a ServiceAuthorizationManager, instead of using static methods.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.