[
https://issues.apache.org/jira/browse/HADOOP-8572?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13408579#comment-13408579
]
Guillaume Nodet commented on HADOOP-8572:
-----------------------------------------
I'm working on deploying Hadoop in OSGi (and Karaf in particular). Karaf has a
console which is similar has a unix shell where you can run commands (deploying
new osgi bundles, starting, stopping bundles and much more). This console is
also available remotely using an ssh client (Karaf embed a java sshd server).
In Karaf, we don't use any security manager, but we still have a user
authenticated and associated to the thread. The user is the one logged into
the console. When you install the hadoop osgi bundle (which I'm working on),
the karaf security layer and the hadoop security mechanism do not work well
together. The patch allows hadoop to just ignore the currently associated
Subject and always use the same mechanism as if no Subject was associated to
the thread (i.e. defaulting to use the OS login user).
I'll attach a patch asap.
> Have the ability to force the use of the login user
> ----------------------------------------------------
>
> Key: HADOOP-8572
> URL: https://issues.apache.org/jira/browse/HADOOP-8572
> Project: Hadoop Common
> Issue Type: Improvement
> Reporter: Guillaume Nodet
>
> In Karaf, most of the code is run under the "karaf" user. When a user ssh
> into Karaf, commands will be executed under that user.
> Deploying hadoop inside Karaf requires that the authenticated Subject has the
> required hadoop principals set, which forces the reconfiguration of the whole
> security layer, even at dev time.
> My patch proposes the introduction of a new configuration property
> {{hadoop.security.force.login.user}} which if set to true (it would default
> to false to keep the current behavior), would force the use of the login user
> instead of using the authenticated subject (which is what happen when there's
> no authenticated subject at all). This greatly simplifies the use of hadoop
> in such environments where security isn't really needed (at dev time).
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
