[
https://issues.apache.org/jira/browse/HADOOP-10769?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14052059#comment-14052059
]
Larry McCay commented on HADOOP-10769:
--------------------------------------
Hey [~atm] - Sorry for the "convoluted" statement - that came across stronger
than I intended. I just really don't like the instanceof check in there to
return an instance of an extension or null. I do understand the motivation but
think that something simpler would be better.
Your proposal is actually very similar to my context proposal but limited to
delegation tokens. In general, I am in favor of this approach. Do you think
that we could make it more generic though? Out of curiosity, why does it return
an array of Tokens?
If we were to open it up to include other things, like keys or passwords, etc
then we could just make it an add credentials method call:
{{HashMap<String,Object> addToCredentials(HashMap<String,Object> props,
Credentials creds)}}
or
{{HashMap<String,Object> setupCredentials(HashMap<String,Object> props,
Credentials creds)}}
Where renewer would be in the props when a given provider expects it.
But we could also include the keyversions of the keys we know about at
submission time and they be added.
We could provide the names of passwords that may be needed by a given provider
as well.
Still not sure how the returned tokens are used in your proposal but they could
be returned in the hashmap in this proposal - as well as anything else that
would make sense.
We would just need a couple well-known property names to represent:
* renewer
* keyversions
* passwords
* returned tokens?
Does that make any sense?
> Add getDelegationToken() method to KeyProvider
> ----------------------------------------------
>
> Key: HADOOP-10769
> URL: https://issues.apache.org/jira/browse/HADOOP-10769
> Project: Hadoop Common
> Issue Type: Improvement
> Components: security
> Affects Versions: 3.0.0
> Reporter: Alejandro Abdelnur
> Assignee: Arun Suresh
>
> The KeyProvider API needs to return delegation tokens to enable access to the
> KeyProvider from processes without Kerberos credentials (ie Yarn containers).
> This is required for HDFS encryption and KMS integration.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
