kerberos mapreduce question

[Koert Kuipers <ko...@tresata.com>]

with kerberos enabled a mapreduce job "runs as" the user that submitted it.
does this mean the user that submitted the job needs to have linux accounts
on all machines on the cluster?

how does mapreduce do this (run jobs as the user)? do the tasktrackers use
secure impersonation to run-as the user?

thanks! koert

Re: kerberos mapreduce question

[Alejandro Abdelnur <tu...@cloudera.com>]

If you provision your user/group information via LDAP to all your nodes it
is not a nightmare.

On Thu, Jun 7, 2012 at 7:49 AM, Koert Kuipers <ko...@tresata.com> wrote:

> thanks for your answer.
>
> so at a large place like say yahoo, or facebook, assuming they use
> kerberos, every analyst that uses hive has an account on every node of
> their large cluster? sounds like an admin nightmare to me
>
> On Thu, Jun 7, 2012 at 10:46 AM, Mapred Learn <mapred.learn@gmail.com
> >wrote:
>
> > Yes, User submitting a job needs to have an account on all the nodes.
> >
> > Sent from my iPhone
> >
> > On Jun 7, 2012, at 6:20 AM, Koert Kuipers <ko...@tresata.com> wrote:
> >
> > > with kerberos enabled a mapreduce job "runs as" the user that submitted
> > it.
> > > does this mean the user that submitted the job needs to have linux
> > accounts
> > > on all machines on the cluster?
> > >
> > > how does mapreduce do this (run jobs as the user)? do the tasktrackers
> > use
> > > secure impersonation to run-as the user?
> > >
> > > thanks! koert
> >
>



-- 
Alejandro

Re: kerberos mapreduce question

[slim tebourbi <sl...@gmail.com>]

Hi,
take a look at this :
http://hadoop.apache.org/common/docs/r1.0.3/Secure_Impersonation.html

I think that it can help you.

Slim Tebourbi.

2012/6/7 Koert Kuipers <ko...@tresata.com>

> thanks for your answer.
>
> so at a large place like say yahoo, or facebook, assuming they use
> kerberos, every analyst that uses hive has an account on every node of
> their large cluster? sounds like an admin nightmare to me
>
> On Thu, Jun 7, 2012 at 10:46 AM, Mapred Learn <mapred.learn@gmail.com
> >wrote:
>
> > Yes, User submitting a job needs to have an account on all the nodes.
> >
> > Sent from my iPhone
> >
> > On Jun 7, 2012, at 6:20 AM, Koert Kuipers <ko...@tresata.com> wrote:
> >
> > > with kerberos enabled a mapreduce job "runs as" the user that submitted
> > it.
> > > does this mean the user that submitted the job needs to have linux
> > accounts
> > > on all machines on the cluster?
> > >
> > > how does mapreduce do this (run jobs as the user)? do the tasktrackers
> > use
> > > secure impersonation to run-as the user?
> > >
> > > thanks! koert
> >
>

Re: kerberos mapreduce question

[Koert Kuipers <ko...@tresata.com>]

thanks for your answer.

so at a large place like say yahoo, or facebook, assuming they use
kerberos, every analyst that uses hive has an account on every node of
their large cluster? sounds like an admin nightmare to me

On Thu, Jun 7, 2012 at 10:46 AM, Mapred Learn <ma...@gmail.com>wrote:

> Yes, User submitting a job needs to have an account on all the nodes.
>
> Sent from my iPhone
>
> On Jun 7, 2012, at 6:20 AM, Koert Kuipers <ko...@tresata.com> wrote:
>
> > with kerberos enabled a mapreduce job "runs as" the user that submitted
> it.
> > does this mean the user that submitted the job needs to have linux
> accounts
> > on all machines on the cluster?
> >
> > how does mapreduce do this (run jobs as the user)? do the tasktrackers
> use
> > secure impersonation to run-as the user?
> >
> > thanks! koert
>

Re: kerberos mapreduce question

[Mapred Learn <ma...@gmail.com>]

Yes, User submitting a job needs to have an account on all the nodes.

Sent from my iPhone

On Jun 7, 2012, at 6:20 AM, Koert Kuipers <ko...@tresata.com> wrote:

> with kerberos enabled a mapreduce job "runs as" the user that submitted it.
> does this mean the user that submitted the job needs to have linux accounts
> on all machines on the cluster?
> 
> how does mapreduce do this (run jobs as the user)? do the tasktrackers use
> secure impersonation to run-as the user?
> 
> thanks! koert