[
https://issues.apache.org/jira/browse/HDFS-3893?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13449282#comment-13449282
]
Todd Lipcon commented on HDFS-3893:
-----------------------------------
- Can you refactor the code which lists all of the NN principals in the
configuration into a new method in {{HAUtil}} perhaps? eg
{{HAUtil.getAllNamenodePrincipals}}? Or if it seems better, one that returns a
list of Configurations, one for each NN in the cluster?
{{HAUtil.getAllNameNodeConfs()}}. Seems like a lot of code to inline here in
the context of this servlet.
- Can you explain why we have two different principals, one for RPC and one for
SPNEGO? i.e what is "DFS_JOURNALNODE_INTERNAL_SPNEGO_USER_NAME_KEY"? I know I
put it there in the first place, but I was just cargo-culting and could stand
to learn something here.
- The SecurityUtil stuff in {{EditLogFileInputStream}} is a little gross. I
wouldn't expect to see it at this layer, especially not with the login user. I
think a slight improvement would be
{{UserGroupInformation.getCurrentUser().doAs()}} so that we support
non-login-user access if a daemon has multiple principals associated. Better
would be to figure out who the callers are and make sure that their main loops
are properly authenticated (eg how EditLogTailer has a {{doAs}} around its
loop).
- In the NN, do we also need to add login calls for {{initializeSharedEdits}}
and {{bootstrapStandby}}?
> QJM: Make QJM work with security enabled
> ----------------------------------------
>
> Key: HDFS-3893
> URL: https://issues.apache.org/jira/browse/HDFS-3893
> Project: Hadoop HDFS
> Issue Type: Sub-task
> Components: name-node, security
> Affects Versions: QuorumJournalManager (HDFS-3077)
> Reporter: Aaron T. Myers
> Assignee: Aaron T. Myers
> Attachments: HDFS-3893.patch
>
>
> Currently the QJM does not work when security is enabled. The quorum cannot
> be formatted, the NN and SBN cannot communicate with the JNs, and JNs cannot
> synchronize edit logs with each other.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
