On Fri, Feb 28, 2020 at 6:21 AM Lars Francke wrote:
> Can we not allow specifying a keytab and principal together with proxy
> user but those are only used for the initial login to submit the job and
> are not shipped to the cluster? This way jobs wouldn't need to rely on the
> operating system.
I just wanted to bump this to see if anyone has any opinions on this?
On Fri, Feb 28, 2020 at 3:20 PM Lars Francke wrote:
> Hi,
>
> I understand that we forbid specifying "principal" & "proxy user" at the
> same time because the current logic would just stage the keytab and the
> proxy user
Hi,
I understand that we forbid specifying "principal" & "proxy user" at the
same time because the current logic would just stage the keytab and the
proxy user could then use that to gain full access circumventing any
security.
But we have a use-case for Livy where a different semantic would be
