[
https://issues.apache.org/jira/browse/HADOOP-8572?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13408606#comment-13408606
]
Guillaume Nodet commented on HADOOP-8572:
-----------------------------------------
Well, looking at trunk, it seems this patch isn't really needed as the
getCurrentUser() looks like:
{code}
public synchronized
static UserGroupInformation getCurrentUser() throws IOException {
AccessControlContext context = AccessController.getContext();
Subject subject = Subject.getSubject(context);
if (subject == null || subject.getPrincipals(User.class).isEmpty()) {
return getLoginUser();
} else {
return new UserGroupInformation(subject);
}
}
{code}
which means the current Subject is ignored if it does not contain the User
principal.
I guess this also solves my problem though I'm slightly more worried about the
current trunk, as if people want to integrate with the JAAS layer and deny
access to hadooop, I'm not sure how that can be done anymore, given hadoop will
always fallback to the login user.
> Have the ability to force the use of the login user
> ----------------------------------------------------
>
> Key: HADOOP-8572
> URL: https://issues.apache.org/jira/browse/HADOOP-8572
> Project: Hadoop Common
> Issue Type: Improvement
> Reporter: Guillaume Nodet
> Attachments: HADOOP-8572.patch
>
>
> In Karaf, most of the code is run under the "karaf" user. When a user ssh
> into Karaf, commands will be executed under that user.
> Deploying hadoop inside Karaf requires that the authenticated Subject has the
> required hadoop principals set, which forces the reconfiguration of the whole
> security layer, even at dev time.
> My patch proposes the introduction of a new configuration property
> {{hadoop.security.force.login.user}} which if set to true (it would default
> to false to keep the current behavior), would force the use of the login user
> instead of using the authenticated subject (which is what happen when there's
> no authenticated subject at all). This greatly simplifies the use of hadoop
> in such environments where security isn't really needed (at dev time).
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
