[
https://issues.apache.org/jira/browse/HADOOP-10769?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14052078#comment-14052078
]
Larry McCay commented on HADOOP-10769:
--------------------------------------
Well, it isn't much different than the original getDelegationToken proposal
this way.
So - you don't think that it makes sense to add a method that can move a list
of specified keyversions into the credentials object?
That seems to imply that all keys will be fetched at runtime rather than those
we know about at submission time being added then.
Incidentally, we wouldn't have to make *that* generic - we could come up with a
type safe context that includes the same properties:
* renewer
* keyversions
* passwords (can leave this one out until we need it)
* returned tokens (if they are needed)
Anyway, I've beaten this one to death.
Thanks for accommodating my nit-picking.
I think that I'll let [~owen.omalley] weigh in when he is back.
> Add getDelegationToken() method to KeyProvider
> ----------------------------------------------
>
> Key: HADOOP-10769
> URL: https://issues.apache.org/jira/browse/HADOOP-10769
> Project: Hadoop Common
> Issue Type: Improvement
> Components: security
> Affects Versions: 3.0.0
> Reporter: Alejandro Abdelnur
> Assignee: Arun Suresh
>
> The KeyProvider API needs to return delegation tokens to enable access to the
> KeyProvider from processes without Kerberos credentials (ie Yarn containers).
> This is required for HDFS encryption and KMS integration.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
