You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-dev@hadoop.apache.org by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org> on 2007/08/09 22:17:42 UTC
[jira] Created: (HADOOP-1701) Provide a simple authentication
service and a user management service
Provide a simple authentication service and a user management service
---------------------------------------------------------------------
Key: HADOOP-1701
URL: https://issues.apache.org/jira/browse/HADOOP-1701
Project: Hadoop
Issue Type: New Feature
Reporter: Tsz Wo (Nicholas), SZE
Assignee: Tsz Wo (Nicholas), SZE
In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
- Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
- Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
!http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
- Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: 1701_20070827c_framework.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20071009api.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a security framework design
Posted by "Robert Chansler (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Robert Chansler updated HADOOP-1701:
------------------------------------
Component/s: dfs
> Provide a security framework design
> -----------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Components: dfs
> Affects Versions: 0.15.0
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Fix For: 0.16.0
>
> Attachments: 1701_20071109.patch
>
>
> Only provide a security framework as described below. A simple implementation will be provided in HADOOP-2229.
> h4._Previous Description_
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20070822b_framework.patch
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070822b_framework.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: 1701_20070809.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: guides20070828.pdf
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070827c_framework.patch, design20070828.pdf, guides20070828.pdf
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: 1701_20070823framework.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070827framework.patch, guides20070822b.pdf
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: guides20070827.pdf
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070827b_framework.patch, guides20070827.pdf
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20070813b.patch
The previous uploaded file is not correct. Please see 1701_20070813b.patch
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070813b.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Allen Wittenauer (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12520110 ]
Allen Wittenauer commented on HADOOP-1701:
------------------------------------------
Some thoughts/concerns...
1) While I realize the first pass was to not actually have passwords, I think it would be beneficial to at least have fields for passwords in such things as users.txt and have the actual authentication stuff just ignore the password field. People will want to automate, and not having the placeholders there will make life hard as things progress.
2) If the plan is for POSIX-like, where is the default gid in this file as well? Where do group definitions live?
3) Negative user ids are/were used in UNIX, and in particular, for nobody on NFS. Using something similar to NFSv4 ID Domains could deal with the issues of private/public username space without having to resort to uid reservations. Additionally, have we looked into support NFSv4-style ACLs? It would be good to be as compatible as possible with NFSv4 to open the door for a NFSv4.1 implementation down the road, IMHO.
4) What's the plan for default ownership, etc, during upgrade? What's the equivalent of chown, chgrp, etc? Sticky bits?
5) I'd like to keep the default user configurable. I can see where it would be useful to change it under certain conditions, especially when tied to something to like Kerberos.
6) What are the 'rules' governing usernames? What are the legal characters? Length? What are the rules governing uids? [It would be good to look at POSIX for guidance here.]
7) What happens when the user database gets large? What kind of memory footprint will be required per user? For example, what happens if we have 100,000 users defined?
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070813c.patch, users.txt
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20070827framework.patch
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070827framework.patch, guides20070822b.pdf
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Owen O'Malley (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12521633 ]
Owen O'Malley commented on HADOOP-1701:
---------------------------------------
1. Please don't use WritableFactory. ReflectionUtils.newInstance() is the preferred interface.
2. What would be the usage of Ticket.getSubject() ?
3. I think that Ticket.getPrincipal() should be getTarget() to be clear about which Principal is returned.
4. I suspect that SecurityImpl should not be a public class.
5. I think that we should support a single mechanism to get the username. It looks like you are planning on a two level structure.
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070821framework.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Hairong Kuang (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12542022 ]
Hairong Kuang commented on HADOOP-1701:
---------------------------------------
One question about the API design. Why "login" is a method of AuthenticationModule but "logout" is a method of LoginCredential? Does it more natural to put both of them in AuthenticationModule? Also it seems Principal has implemented all interface methods so it does not need to be an abstract class.
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20071109.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12542030 ]
Tsz Wo (Nicholas), SZE commented on HADOOP-1701:
------------------------------------------------
> Why "login" is a method of AuthenticationModule but "logout" is a method of LoginCredential? Does it more natural to put both of them in AuthenticationModule?
I think it is possible to put "logout" in AuthenticationModule.
> Also it seems Principal has implemented all interface methods so it does not need to be an abstract class.
It is good to keep Principal method since it is an abstract concept.
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20071109.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: design20070828.pdf
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070827c_framework.patch, design20070828.pdf, guides20070828.pdf
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20070815.patch
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070815.patch, users.txt
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: 1701_20070815.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20070822framework.patch
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070822framework.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: simple20070828.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20071009api.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: 1701_20071109.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: 1701_20070827framework.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070827b_framework.patch, guides20070822b.pdf
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12521176 ]
Tsz Wo (Nicholas), SZE commented on HADOOP-1701:
------------------------------------------------
Below are my responses to the comments. Sorry for being late.
*For Dhruba's comments:*
(1) We will have a very flexible mechanism to obtain usernames. It will support
* get the username from OS
* get the username specified in conf
* get username by an arbitrary rule
I will let you know the details later.
(2) Since UID is kind of system dependent, we will use username as parameter for intermediate communication. We also generate some serial numbers in NameNode for efficient storage. These serial numbers will be used in NameNode internally and are not visible outside NameNode.
*For Allen's comments:*
# We are going to get ride authentication server and user management in the first phase. See also (2) below
# We will assume that when users run Hadoop clients, they are logged in to a network system (e.g. Unix). We use the user account and group information maintained by the network system. Then, we do not need any user/group management in Hadoop.
# See (2) in the response for Dhruba's comments.
# In the Hadoop 0.13, the files are stored in the home directories of each user. Then, the default owner of all files under a home directory (/home/XXXX) will be the user (i.e. XXXX). For the files not inside a home directory, it would be root.
# I agree. See also (1) in the response for Dhruba's comments.
# I plan to let administrator to setup a regular expression in conf.
# Currently, it is not an issue since we don't have user management. Our goal is to support at least 10k users/groups later on.
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070815.patch, users.txt
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: 1701_20070822b_framework.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: guides20070822b.pdf
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12521640 ]
Tsz Wo (Nicholas), SZE commented on HADOOP-1701:
------------------------------------------------
1) I did not really use WritableFactory in the framework. I will revert it.
2) getSubject(...) is useful for java.security API, for example, access control. It just initializes the principals to the Subject.
3) getPrincipal(...) is really misleading: it means getIssuer(...)
4) I just need somewhere to put the public methods, like hadoopLogin(...) . Of course, I can create a new class for that purpose.
5) I want to provide a general mechanism to get username. We might only need a Collector interface and conf always specifies a subclass.
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070821framework.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12521944 ]
Tsz Wo (Nicholas), SZE commented on HADOOP-1701:
------------------------------------------------
1701_20070822framework.patch
- Changed username mechanism and the default is reading from OS
- removed getSubject()
- renamed getPrincipal(...) to getIssuer(...)
- Split SecurityImpl into two classes, Security and Impl. Impl has to be public since the subclasses usually are not in the same package.
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070822framework.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: 1701_20070827b_framework.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: guides20070827.pdf
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HADOOP-1701) Provide a security framework design
Posted by "Sanjay Radia (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12546460 ]
Sanjay Radia commented on HADOOP-1701:
--------------------------------------
The concept of an abstract ticket along with the loginCredentials and Security factory in the attached patch can allow us to create a portable layer for plugging in different authentication technologies.
Java already has such a portable plug-in layer for authentication and authrization: Java's Jaas and GSS APIs. If we can leverage these APIs then we will have free access to the various JAAS and GSS plug-in for Kerberos, LDAP, Unix etc. Furthermore I believe GSS is cross language.
The problem is that we don't have the time to figure this all out how to exactly use the Java APIs for release 0.16 and we want to get permissions into 0.16.
From what I have seen, I am not sure if the patch's ticket, loginCredentials and Security factory abstractions will help - they do not seem to fit into the java authentication APIs. Java provides some basic constructs: subject, loginModule and loginContext . Subject overlaps partly with our concept of ticket. The loginModule/Context overlaps with our security factory. If we use the Java APIs then the HDFS code mostly does *not* need to touch the "tickets" (except when we pass it to the job tracker).
Of course we are free to ignore the entire java framework and build our own. But that is a big undertaking.
I propose that we do NOT define the type Ticket and the loginCredentials and Security factory for now.
For now the class called UserGroupInfo (see Hadoop 2229) which extends writable is sufficient.
The userGroupInfo can be passed across at connection establishment.
For example, for the socket creation, the socket factory can take a parameter of type writable:
getClientSocketFactory(Writable authenticationInfo);
The writable authenticationInfo can be written into the socket and read at the other end.
Currently we simply need to make the UserGroupInfo to be writable.
I don't think the rpc layer needs to do anything besides read and write the authenticationInfo (which is really the tickets).
After we get some basic permission-checking feature into HDFS, lets try and see if we can fit this into the Java security framework. If we find that it does not then I suggest we define our own framework along the lines of this patch.
> Provide a security framework design
> -----------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Affects Versions: 0.15.0
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Fix For: 0.16.0
>
> Attachments: 1701_20071109.patch
>
>
> Only provide a security framework as described below. A simple implementation will be provided in HADOOP-2229.
> h4._Previous Description_
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: 1701_20070813c.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070815.patch, users.txt
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: guides20070822b.pdf
Updated javadoc and the pdf
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070822b_framework.patch, guides20070822b.pdf
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20070821framework.patch
1701_20070821framework.patch contains only a general framework.
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070821framework.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "dhruba borthakur (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12519539 ]
dhruba borthakur commented on HADOOP-1701:
------------------------------------------
We would like to see a document that lists out the design and usage model of this approach. In particular:
1. Upgrade process from current disk format to the new
2. How does a dfs user specify to the dfs client what user he/she is. Does the dfs shell pick the user from environment variables or from a conf file?
3. default permissions for files
4. are there permissions with file, directories or both?
5. where is the user-database stored? is it a flat file? where is the file located?is it versioned?
6. The namenode can be configured to store fsimage in multiple directories. Does this affect where user-db is stored? how do we handle HAC failure?
6. how does the administrator modify the user database? do changes have immediate effect?
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070809.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: guides20070822.pdf
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070821framework.patch, guides20070822.pdf
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Raghu Angadi (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12527651 ]
Raghu Angadi commented on HADOOP-1701:
--------------------------------------
Is there any open source project that uses Java security frame work for the security similar to we want to use? The current HDFS use case is to get user info for every RPC call.
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070827c_framework.patch, design20070828.pdf, guides20070828.pdf, simple20070828.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "dhruba borthakur (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12520043 ]
dhruba borthakur commented on HADOOP-1701:
------------------------------------------
I browsed the API description. Looks good. Minor comments:
1. I wonder if the default user-name should be hard-coded into the code rather that it being a configuration variable. Currently, you have login.username to define the default anonymous username.
2. Maybe the special uids be negative values (instead of reserving < 1000000) This will allow us to make the hadoop-uids match with the user's unix uids. Unix-uids typically are positive integers. It might also facilitate easy integration with most LDAP installations.
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070813c.patch, users.txt
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: 1701_20070813b.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: 1701_20071009api.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20071109.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: design20070828.pdf)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20071009api.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: guides20070828.pdf)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20071009api.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20071009api.patch
API updated with current trunk
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20071009api.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Doug Cutting (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12521924 ]
Doug Cutting commented on HADOOP-1701:
--------------------------------------
I agree with Owen that we should just have a Collector interface and a default implementation that reads from the config and/or OS. Also, isn't it more secure to use UnixSystem#getUserName() than the system property, since normal users cannot modify the former?
My preference would be to have the default only use the OS. That would make it slightly harder for folks to pretend to be someone else without changing, e.g., JobClient or DFSClient, no? If it's just a config property then anyone can specify root on the command line. We should make the default a bit harder than that to beat, no?
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070821framework.patch, guides20070822.pdf
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: users.txt)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: simple20070828.patch
- {{design20070828.pdf}}
is a Security Design document for the big picture
- {{guides20070828.pdf}}
is a API & Developer Guides document for Phase 1
- {{1701_20070827c_framework.patch}}
is the framework API
- {{simple20070828.patch}}
is a simple implementation
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070827c_framework.patch, design20070828.pdf, guides20070828.pdf, simple20070828.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20070827c_framework.patch
add groups to the framework
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070827c_framework.patch, guides20070827.pdf
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: guides20070822b.pdf)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070827b_framework.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20070823framework.patch
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070823framework.patch, guides20070822b.pdf
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20070827b_framework.patch
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070827b_framework.patch, guides20070822b.pdf
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Christophe Taton (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12520340 ]
Christophe Taton commented on HADOOP-1701:
------------------------------------------
Some answers:
2) To keep the changes small, we do not implement groups for now (owner + others only)
3) I'll have a look on this. One concern during the design of this has been to provide an extensible infrastructure for authentication and authorization, with a first attempt to provide simplified POSIX permissions. Providing new/other authorization mechanisms is (to my mind) very easy with the given infrastructure (you have to extend the HFilePermission class that will be attached to INodes and to write your own Policy provider).
4) When upgrading from a previous HDFS without permissions, the default is that files are owner by root and their permissions are rwx---rwx.
Moreover, all entities (e.g. Fsck, JSP pages) will run as root in a first step.
There are get/setPermissions() operation that use POSIXFilePermissions parameters (contains the owner id and the file mode).
The sticky bit is also not implemented yet (this is a functionality I really need though).
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070815.patch, users.txt
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20070813c.patch
modified the bin/hadoop script so that simple.HAC and UserAdmin can be executed by
- {{./bin/hadoop hac}}
- {{./bin/hadoop useradmin}}
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070813c.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20071109.patch
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20071109.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: users.txt
User DB can be initialized by uploading a text file. {{users.txt}} is a sample.
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070813c.patch, users.txt
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: 1701_20070822framework.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070822b_framework.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a security framework design
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Fix Version/s: 0.16.0
Description:
Only provide a security framework as described below. A simple implementation will be provided in HADOOP-2229.
h4._Previous Description_
In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
- Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
- Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
!http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
- Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
was:
In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
- Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
- Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
!http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
- Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
Affects Version/s: 0.15.0
Summary: Provide a security framework design (was: Provide a simple authentication service and a user management service)
> Provide a security framework design
> -----------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Affects Versions: 0.15.0
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Fix For: 0.16.0
>
> Attachments: 1701_20071109.patch
>
>
> Only provide a security framework as described below. A simple implementation will be provided in HADOOP-2229.
> h4._Previous Description_
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20071109.patch
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20071109.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: guides20070822.pdf)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: 1701_20070813.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070813b.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20070809.patch
You can find the security framework and a simple implementation in 1701_20070809.patch but it is not yet completed:
- Need a shell for user management
- Add login to some components like FsShell
- Change the junit test.
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070809.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: 1701_20070813.patch
- Added UserAdmin
- Updated SimpleHAC junit tests
Still missing:
- junit tests for UserAdmin
- Add login to some components like FsShell
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070813.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: guides20070827.pdf)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
> Attachments: 1701_20070827c_framework.patch
>
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-1701) Provide a simple authentication
service and a user management service
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-1701?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-1701:
-------------------------------------------
Attachment: (was: 1701_20070821framework.patch)
> Provide a simple authentication service and a user management service
> ---------------------------------------------------------------------
>
> Key: HADOOP-1701
> URL: https://issues.apache.org/jira/browse/HADOOP-1701
> Project: Hadoop
> Issue Type: New Feature
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Tsz Wo (Nicholas), SZE
>
> In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.
> - Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.
> - Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.
> !http://java.sun.com/javase/6/docs/technotes/guides/security/overview/images/3.jpg!
> - Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.