You are viewing a plain text version of this content. The canonical link for it is here.
Posted to yarn-dev@hadoop.apache.org by Prabhu Joseph <pr...@gmail.com> on 2019/05/22 17:58:13 UTC
Impact of Not Enabling KerberosDelegationTokenAuthenticationHandler
Hi,
Was testing YARN RM with Http AuthenticationFilter set with
KerberosAuthenticationHandler which authenticates only through Kerberos and
not Delegation Token. Have observed everything like Yarn jobs, yarn
commands, UI and Rest API working fine with this setup with valid kerberos
ticket.
Want to understand where the impact is then when not using
KerberosDelegationTokenAuthenticationHandler.
Thanks,
Prabhu Joseph
Re: Impact of Not Enabling KerberosDelegationTokenAuthenticationHandler
Posted by Prabhu Josephraj <pj...@cloudera.com.INVALID>.
Hi Vinod,
Have a ResourceManager with Secure Http and
KerberosAuthenticationHandler. Have disabled
yarn.resourcemanager.webapp.delegation-token-auth.filter.enabled
(KerberosDelegationTokenAuthenticationHandler). So RM HttpServer will fail
the Http Requests having only Delegation Token and not Kerberos
Credentials. Will this
affect any other components / jobs. What are the areas which really require
KerberosDelegationTokenAuthenticationHandler for Http Secure Authentication.
Thanks,
Prabhu Joseph
On Thu, May 23, 2019 at 12:35 AM Vinod Kumar Vavilapalli <vi...@apache.org>
wrote:
> Not sure what your question really is.
>
> KerberosDelegationTokenAuthenticationHandler was created mainly to add
> delegation-token support on top of KerberosAuthenticationHandler.
>
> Thanks
> +Vinod
>
> > On May 22, 2019, at 10:58 AM, Prabhu Joseph <pr...@gmail.com>
> wrote:
> >
> > Hi,
> >
> > Was testing YARN RM with Http AuthenticationFilter set with
> > KerberosAuthenticationHandler which authenticates only through Kerberos
> and
> > not Delegation Token. Have observed everything like Yarn jobs, yarn
> > commands, UI and Rest API working fine with this setup with valid
> kerberos
> > ticket.
> >
> > Want to understand where the impact is then when not using
> > KerberosDelegationTokenAuthenticationHandler.
> >
> > Thanks,
> > Prabhu Joseph
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: common-dev-unsubscribe@hadoop.apache.org
> For additional commands, e-mail: common-dev-help@hadoop.apache.org
>
>
Re: Impact of Not Enabling KerberosDelegationTokenAuthenticationHandler
Posted by Prabhu Josephraj <pj...@cloudera.com.INVALID>.
Hi Vinod,
Have a ResourceManager with Secure Http and
KerberosAuthenticationHandler. Have disabled
yarn.resourcemanager.webapp.delegation-token-auth.filter.enabled
(KerberosDelegationTokenAuthenticationHandler). So RM HttpServer will fail
the Http Requests having only Delegation Token and not Kerberos
Credentials. Will this
affect any other components / jobs. What are the areas which really require
KerberosDelegationTokenAuthenticationHandler for Http Secure Authentication.
Thanks,
Prabhu Joseph
On Thu, May 23, 2019 at 12:35 AM Vinod Kumar Vavilapalli <vi...@apache.org>
wrote:
> Not sure what your question really is.
>
> KerberosDelegationTokenAuthenticationHandler was created mainly to add
> delegation-token support on top of KerberosAuthenticationHandler.
>
> Thanks
> +Vinod
>
> > On May 22, 2019, at 10:58 AM, Prabhu Joseph <pr...@gmail.com>
> wrote:
> >
> > Hi,
> >
> > Was testing YARN RM with Http AuthenticationFilter set with
> > KerberosAuthenticationHandler which authenticates only through Kerberos
> and
> > not Delegation Token. Have observed everything like Yarn jobs, yarn
> > commands, UI and Rest API working fine with this setup with valid
> kerberos
> > ticket.
> >
> > Want to understand where the impact is then when not using
> > KerberosDelegationTokenAuthenticationHandler.
> >
> > Thanks,
> > Prabhu Joseph
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: common-dev-unsubscribe@hadoop.apache.org
> For additional commands, e-mail: common-dev-help@hadoop.apache.org
>
>
Re: Impact of Not Enabling
KerberosDelegationTokenAuthenticationHandler
Posted by Vinod Kumar Vavilapalli <vi...@apache.org>.
Not sure what your question really is.
KerberosDelegationTokenAuthenticationHandler was created mainly to add delegation-token support on top of KerberosAuthenticationHandler.
Thanks
+Vinod
> On May 22, 2019, at 10:58 AM, Prabhu Joseph <pr...@gmail.com> wrote:
>
> Hi,
>
> Was testing YARN RM with Http AuthenticationFilter set with
> KerberosAuthenticationHandler which authenticates only through Kerberos and
> not Delegation Token. Have observed everything like Yarn jobs, yarn
> commands, UI and Rest API working fine with this setup with valid kerberos
> ticket.
>
> Want to understand where the impact is then when not using
> KerberosDelegationTokenAuthenticationHandler.
>
> Thanks,
> Prabhu Joseph
---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-dev-unsubscribe@hadoop.apache.org
For additional commands, e-mail: yarn-dev-help@hadoop.apache.org
Re: Impact of Not Enabling
KerberosDelegationTokenAuthenticationHandler
Posted by Vinod Kumar Vavilapalli <vi...@apache.org>.
Not sure what your question really is.
KerberosDelegationTokenAuthenticationHandler was created mainly to add delegation-token support on top of KerberosAuthenticationHandler.
Thanks
+Vinod
> On May 22, 2019, at 10:58 AM, Prabhu Joseph <pr...@gmail.com> wrote:
>
> Hi,
>
> Was testing YARN RM with Http AuthenticationFilter set with
> KerberosAuthenticationHandler which authenticates only through Kerberos and
> not Delegation Token. Have observed everything like Yarn jobs, yarn
> commands, UI and Rest API working fine with this setup with valid kerberos
> ticket.
>
> Want to understand where the impact is then when not using
> KerberosDelegationTokenAuthenticationHandler.
>
> Thanks,
> Prabhu Joseph
---------------------------------------------------------------------
To unsubscribe, e-mail: common-dev-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-dev-help@hadoop.apache.org