[
https://issues.apache.org/jira/browse/AMBARI-26632?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jialiang Cai reassigned AMBARI-26632:
-------------------------------------
Assignee: Jialiang Cai
> Complete React parity for Kerberos administration workflows
> -----------------------------------------------------------
>
> Key: AMBARI-26632
> URL: https://issues.apache.org/jira/browse/AMBARI-26632
> Project: Ambari
> Issue Type: Improvement
> Reporter: Jialiang Cai
> Assignee: Jialiang Cai
> Priority: Major
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> <!---
> Licensed to the Apache Software Foundation (ASF) under one or more
> contributor license agreements. See the NOTICE file distributed with
> this work for additional information regarding copyright ownership.
> The ASF licenses this file to You under the Apache License, Version 2.0
> (the "License"); you may not use this file except in compliance with
> the License. You may obtain a copy of the License at
> http://www.apache.org/licenses/LICENSE-2.0
> Unless required by applicable law or agreed to in writing, software
> distributed under the License is distributed on an "AS IS" BASIS,
> WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
> See the License for the specific language governing permissions and
> limitations under the License.
> -->
> h2. Problem
> The React Kerberos UI exposes the primary Enable, Disable, identity,
> credential,
> and keytab screens, but the implementation does not yet provide a reliable
> equivalent to the Classic Ember workflow. KDC mode forcing, resource creation,
> Step 3 client installation, Stack Advisor, descriptor fallback, long-running
> request recovery, formal exit cleanup, Disable failure paths, credential error
> propagation, and Regenerate convergence have incomplete or incorrect behavior.
> This issue covers the complete non-Metrics Kerberos module defined by the 81
> feature IDs in {{docs/frontend-refactor/ember-baseline/08-kerberos.md}}. The
> React
> comparison and runtime matrix are recorded in
> {{docs/frontend-refactor/react-current/08-kerberos-gap.md}}.
> h2. Scope
> * Preserve permission and feature gates, security-status loading,
> installed-service warnings, and optional pre-Kerberize checks.
> * Preserve the Classic Disable deep link and wizard-owner exclusion across
> routes and navigation.
> * Implement MIT, Active Directory, IPA, and Manual mode visibility, forced
> values, prerequisites, and navigation.
> * Make Step 2 resource/config/session creation ordered, failure-propagating,
> retryable, and duplicate-safe.
> * Install KERBEROS_CLIENT through the Classic INIT versus initialized
> branches and run service/heartbeat checks with Retry and Ignore Errors.
> * Load, recommend, edit, create/update, and recover Kerberos descriptor
> values without losing the current form.
> * Preserve mode-specific confirmation and Manual CSV responsibility with
> visible download failure.
> * Stop services, perform ATS compatibility cleanup, force-retry Kerberize,
> and start/test services with persisted request recovery.
> * Complete or exit the wizard through atomic recovery-state cleanup and
> formal best-effort unkerberize/service deletion.
> * Serialize recovery checkpoints before completion/discard reset and expose
> load/save Retry without replaying mutations.
> * Implement Disable sequencing, unkerberize Skip, idempotent service removal,
> service-check policy, and completion gating.
> * Align identity management, automatic/Manual Regenerate, persistent KDC
> credential management, and invalid-session replay.
> * Add focused tests for request shapes, mode branches, failure ordering,
> polling/recovery, credential CRUD, and compatibility fixes.
> * Record cross-module Add Service, Add Host/component, Service/Host,
> Reassign, HA, and Federation acceptance boundaries.
> h2. Acceptance Criteria
> * All 81 baseline IDs have a mutually exclusive status and evidence in the
> React comparison.
> * The Kerberos routes require {{CLUSTER.TOGGLE_KERBEROS}} and
> {{enableToggleKerberos}}; CSV retains its independent upgrade authorization.
> * A non-owner cannot see or enter Kerberos while another user owns a wizard,
> and every completion/discard path clears ownership.
> * Step 1 uses the Classic prerequisite sets and shows the ONEFS item only
> when ONEFS is installed.
> * Manual and IPA forced configuration values are included in the submitted
> desired configs.
> * Step 2 stops after any failed prerequisite, retains input, unlocks Retry,
> and never reports false success.
> * Step 3 reads component state and submits exactly one of service
> installation or named host-component installation.
> * Stack Advisor is called only for a first Step 4 load, recommendations are
> applied before display, and saved form recovery avoids duplicate
> recommendation.
> * Descriptor create/update fallback is limited to the expected 409/404
> response and remains one awaited promise.
> * Steps 3, 6, 7, and 8 recover request IDs and poll existing work instead of
> repeating mutations.
> * Exit from Steps 1-7 attempts unkerberize and KERBEROS deletion before
> clearing state; Step 8 never rolls back enabled security.
> * Disable exposes the identity-management Skip only after unkerberize failure
> and cannot hang on obsolete-service deletion.
> * Disable deep linking opens the same guarded flow, and Complete reloads the
> current security type on the canonical route.
> * Credential CRUD failures remain errors, retain input, and never replay the
> protected operation.
> * Regenerate tracks its returned request and starts optional component
> restart only after successful completion.
> * Submission failure or tracker close releases Regenerate so a later action
> submits a new request.
> * Every timer and request poll is invalidated on terminal state, retry,
> dependency change, or unmount.
> * Focused frontend tests, TypeScript, build, lint, baseline validation, and
> helper tests pass or have pre-existing failures documented exactly.
> * The real-cluster runtime matrix passes before operational parity is claimed.
> h2. Partial Cross-Module Boundaries
> {{KRB-X-001}} through {{KRB-X-005}} require integration with the Add Service,
> Add
> Host/Hosts, Services, Reassign, HA, and Federation modules. This issue
> validates
> the shared KDC-session and Regenerate contracts but does not duplicate those
> modules' wizard or component code.
> Disable refresh/server-restart recovery and Manual principal/keytab
> fulfillment
> cannot be closed by static frontend tests. They remain explicit runtime gates.
> h2. Out of Scope
> * Metrics pages, charts, widgets, metric polling, Metrics APIs, and any
> Metrics-specific Kerberos presentation.
> * Reproducing the broken Classic Step 3 Rollback or unreachable Skip controls.
> * Adding a user action for the Classic Step 7 test-only unkerberize method.
> * Reproducing false-success credential behavior or the undefined descriptor
> fallback callback.
> * Rewriting Add Service, Add Host, Reassign, HA, Federation, or global
> Background Operations in this issue.
> h2. Compatibility Decisions
> React treats prerequisite and credential failures as failures instead of
> continuing like Classic. Descriptor fallback is atomic. CSV and ATS failures
> are
> recoverable. Regenerate follows its own request rather than unrelated global
> operation counts. Disable does not clear Add Service state. These are
> deliberate
> correctness fixes and are not missing parity.
> The unusual API-root pre-Kerberize GET and direct Step 7 force-retry semantics
> are retained because they are executable Classic contracts.
> h2. Verification Boundary
> Unit and component tests cannot prove MIT, Active Directory, IPA, or Manual
> KDC
> operation. They also cannot prove server-side principal/keytab effects,
> service
> restart convergence, websocket/background presentation, or refresh after a
> server restart. Do not mark this issue operationally complete until the
> runtime
> matrix in {{08-kerberos-gap.md}} has been executed against real environments.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
