[
https://issues.apache.org/jira/browse/AMBARI-8542?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14238691#comment-14238691
]
Hudson commented on AMBARI-8542:
--------------------------------
SUCCESS: Integrated in Ambari-trunk-Commit #1136 (See
[https://builds.apache.org/job/Ambari-trunk-Commit/1136/])
AMBARI-8542. Provide a way to parse and handle Kerberos descriptors (jspeidel:
http://git-wip-us.apache.org/repos/asf?p=ambari.git&a=commit&h=e7b8383b5af0a39b2530dbfc24563eefd7f781c7)
*
ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosPrincipalDescriptorTest.java
*
ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosKeytabDescriptorTest.java
*
ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosDescriptorTest.java
*
ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosIdentityDescriptor.java
*
ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/AbstractKerberosDescriptor.java
*
ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosServiceDescriptor.java
*
ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosConfigurationDescriptor.java
*
ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosDescriptorType.java
*
ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/AbstractKerberosDescriptorContainer.java
*
ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosComponentDescriptorTest.java
*
ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosPrincipalDescriptor.java
*
ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosConfigurationDescriptorTest.java
*
ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosIdentityDescriptorTest.java
*
ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosKeytabDescriptor.java
*
ambari-server/src/test/java/org/apache/ambari/server/state/kerberos/KerberosServiceDescriptorTest.java
*
ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosComponentDescriptor.java
*
ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosDescriptor.java
> Provide a way to parse and handle Kerberos descriptors
> ------------------------------------------------------
>
> Key: AMBARI-8542
> URL: https://issues.apache.org/jira/browse/AMBARI-8542
> Project: Ambari
> Issue Type: Task
> Components: ambari-server, stacks
> Affects Versions: 2.0.0
> Reporter: Robert Levas
> Assignee: Robert Levas
> Labels: kerberos, kerberos_descriptor, stack
> Fix For: 2.0.0
>
> Attachments: AMBARI-8542_01.patch, AMBARI-8542_02.patch,
> AMBARI-8542_02.patch
>
>
> Provide the ability to read in Kerberos descriptor files (kerberos.json) from
> the stack at various levels (stack-level, service-level) and to merge them
> into a single hierarchy. The composite Kerberos descriptor data will be used
> to control the UI (Kerberos Wizard - see AMBARI-7450).
> An example stack-level Kerberos Descriptor:
> {code}
> {
> "properties": {
> "realm": "${cluster-env/kerberos_domain}",
> "keytab_dir": "/etc/security/keytabs"
> },
> "identities": [
> {
> "name": "spnego",
> "principal": {
> "value": "HTTP/_HOST@${realm}"
> },
> "keytab": {
> "file": "${keytab_dir}/spnego.service.keytab",
> "owner": {
> "name": "root",
> "access": "r"
> },
> "group": {
> "name": "${cluster-env/user_group}",
> "access": "r"
> }
> }
> }
> ],
> "configurations": [
> ]
> }
> {code}
> An example service-level Kerberos Descriptor - HDFS:
> {code}
> {
> "configurations": [
> {
> "core-site": {
> "hadoop.security.authentication": "kerberos",
> "hadoop.rpc.protection": "authentication; integrity; privacy",
> "hadoop.security.authorization": "true"
> }
> }
> ],
> "components": [
> {
> "name": "NAMENODE",
> "identities": [
> {
> "name" : "namenode_nn",
> "principal": {
> "value": "nn/_HOST@${realm}",
> "configuration": "hdfs-site/dfs.namenode.kerberos.principal"
> },
> "keytab": {
> "file": "${keytab_dir}/nn.service.keytab",
> "owner": {
> "name": "${hadoop-env/hdfs_user}",
> "access": "r"
> },
> "group": {
> "name": "${cluster-env/user_group}",
> "access": ""
> },
> "configuration": "hdfs-site/dfs.namenode.keytab.file"
> }
> },
> {
> "name" : "namenode_host",
> "principal": {
> "value": "host/_HOST@${realm}",
> "configuration": "hdfs-site/dfs.namenode.kerberos.https.principal"
> },
> "keytab": {
> "file": "${keytab_dir}/host.keytab",
> "owner": {
> "name": "${hadoop-env/hdfs_user}",
> "access": "r"
> },
> "group": {
> "name": "${cluster-env/user_group}",
> "access": ""
> },
> "configuration": "hdfs-site/dfs.namenode.keytab.file"
> }
> },
> {
> "name" : "/spnego",
> "principal": {
> "configuration":
> "hdfs-site/dfs.web.authentication.kerberos.principal"
> },
> "keytab": {
> "configuration": "hdfs/dfs.web.authentication.kerberos.keytab"
> }
> }
> ]
> },
> {
> "name": "DATANODE",
> "identities": [
> {
> "name" : "datanode_dn",
> "principal": {
> "value": "dn/_HOST@${realm}",
> "configuration": "hdfs-site/dfs.namenode.kerberos.principal"
> },
> "keytab": {
> "file": "${keytab_dir}/dn.service.keytab",
> "owner": {
> "name": "${hadoop-env/hdfs_user}",
> "access": "r"
> },
> "group": {
> "name": "${cluster-env/user_group}",
> "access": ""
> },
> "configuration": "hdfs-site/dfs.namenode.keytab.file"
> }
> },
> {
> "name" : "datanode_host",
> "principal": {
> "value": "host/_HOST@${realm}",
> "configuration": "hdfs-site/dfs.datanode.kerberos.https.principal"
> },
> "keytab": {
> "file": "${keytab_dir}/host.keytab.file",
> "owner": {
> "name": "${hadoop-env/hdfs_user}",
> "access": "r"
> },
> "group": {
> "name": "${cluster-env/user_group}",
> "access": ""
> },
> "configuration": "hdfs-site/dfs.namenode.secondary.keytab.file"
> }
> }
> ]
> },
> {
> "name": "SECONDARY_NAMENODE",
> "identities": [
> {
> "name" : "secondary_namenode_nn",
> "principal": {
> "value": "nn/_HOST@${realm}",
> "configuration":
> "hdfs-site/dfs.namenode.secondary.kerberos.principal"
> },
> "keytab": {
> "file": "${keytab_dir}/snn.service.keytab",
> "owner": {
> "name": "${hadoop-env/hdfs_user}",
> "access": "r"
> },
> "group": {
> "name": "${cluster-env/user_group}",
> "access": ""
> },
> "configuration": "hdfs-site/dfs.namenode.secondary.keytab.file"
> }
> },
> {
> "name" : "secondary_namenode_host",
> "principal": {
> "value": "host/_HOST@${realm}",
> "configuration":
> "hdfs-site/dfs.namenode.secondary.kerberos.https.principal"
> },
> "keytab": {
> "file": "${keytab_dir}/host.keytab.file",
> "owner": {
> "name": "${hadoop-env/hdfs_user}",
> "access": "r"
> },
> "group": {
> "name": "${cluster-env/user_group}",
> "access": ""
> },
> "configuration": "hdfs-site/dfs.namenode.secondary.keytab.file"
> }
> },
> {
> "name" : "/spnego",
> "principal": {
> "configuration":
> "hdfs-site/dfs.web.authentication.kerberos.principal"
> },
> "keytab": {
> "configuration": "hdfs/dfs.web.authentication.kerberos.keytab"
> }
> }
> ]
> }
> ]
> }
> {code}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
