You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "Stephan Ewen (JIRA)" <ji...@apache.org> on 2017/01/11 20:22:16 UTC
[jira] [Resolved] (FLINK-5364) Rework JAAS configuration to support
user-supplied entries
[ https://issues.apache.org/jira/browse/FLINK-5364?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Stephan Ewen resolved FLINK-5364.
---------------------------------
Resolution: Fixed
Fix Version/s: 1.3.0
1.2.0
Fixed in
- 1.2.0 via 00193f7e238340cc18c57a44c7e6377432839373
- 1.3.0 via fc3a778c0cafe1adc9efbd8796a8bd64122e4ad2
> Rework JAAS configuration to support user-supplied entries
> ----------------------------------------------------------
>
> Key: FLINK-5364
> URL: https://issues.apache.org/jira/browse/FLINK-5364
> Project: Flink
> Issue Type: Bug
> Components: Cluster Management
> Reporter: Eron Wright
> Assignee: Eron Wright
> Priority: Critical
> Labels: kerberos, security
> Fix For: 1.2.0, 1.3.0
>
>
> Recent issues (see linked) have brought to light a critical deficiency in the handling of JAAS configuration.
> 1. the MapR distribution relies on an explicit JAAS conf, rather than in-memory conf used by stock Hadoop.
> 2. the ZK/Kafka/Hadoop security configuration is supposed to be independent (one can enable each element separately) but isn't.
> Perhaps we should rework the JAAS conf code to merge any user-supplied configuration with our defaults, rather than using an all-or-nothing approach.
> We should also address some recent regressions:
> 1. The HadoopSecurityContext should be installed regardless of auth mode, to login with UserGroupInformation, which:
> - handles the HADOOP_USER_NAME variable.
> - installs an OS-specific user principal (from UnixLoginModule etc.) unrelated to Kerberos.
> - picks up the HDFS/HBASE delegation tokens.
> 2. Fix the use of alternative authentication methods - delegation tokens and Kerberos ticket cache.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)