[
https://issues.apache.org/jira/browse/HADOOP-2184?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Raghu Angadi updated HADOOP-2184:
---------------------------------
Attachment: HADOOP-2184-demo.patch
Attached a "demo" patch. This is not really meant for inclusion but shows how
this feature works. Some of the changes in the patch are temporary.
- User ticket passed through {{getProxy()}} call. This will change once we have
HADOOP-1701 and friends. Thats ok.
- The main meat : when ticket is set, RPC Client invokes a RPC call every time
it opens a new socket.
-- Since this RPC is internal, it uses another InvocationHandler so that we
still use all the RPC utilities.
-- Some rearrangement of code in ipc pacakge.
-- Now a 'connection' is identified by remote address and ticket instead of
just by remote address.
- VersionProtocolWithTicket is temporary to this patch in order to avoid
changing all the implementors of VersionsedProtocol.
- As an example use, {{open()}} in NameNode prints the user name.
- {{Client.TempTicket}} is just a place holder for 'real ticket'.
> RPC Support for user permissions and authentication.
> ----------------------------------------------------
>
> Key: HADOOP-2184
> URL: https://issues.apache.org/jira/browse/HADOOP-2184
> Project: Hadoop
> Issue Type: New Feature
> Components: ipc
> Affects Versions: 0.15.0
> Reporter: Tsz Wo (Nicholas), SZE
> Assignee: Raghu Angadi
> Fix For: 0.16.0
>
> Attachments: HADOOP-2184-demo.patch
>
>
> Update 11/13/2007: What is proposed for 0.16.0 :
> The client can set a user ticket (as defined in HADOOP-1701) for each
> connection and that ticket is made available to RPC calls at the server. The
> client can replace the ticket at any time. The main advantage is that rest of
> the the client RPCs don't need to be aware of the user tickets.
> What RPC would ideally support in future :
> In the current version of RPC, there is no authentication or data protection.
> We propose to change the RPC framework, so that secure communication is
> possible.
> The new RPC should:
> - Compatible with current RPC
> - Allow a pluggable security implementations (see HADOOP-1701)
> - Support both secure and non-secure modes.
> Here is a rough idea:
> - Store security information (e.g. username, keys) in a ticket
> - Use the ticket to establish a RPC connection
> - Create secure sockets by the (subclass of) SocketFactory corresponding to
> the selected security implementations
> - Send the data and RPC parameters with the secure sockets
> When authentication is supported, the RPC callee should also initialize
> caller information during RPC setup and execute the RPC on the caller's
> behalf.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
