[jira] (SPARK-16742) Kerberos support for Spark on Mesos

[Thomas Graves (JIRA)]

Title: Message Title

Thomas Graves commented on SPARK-16742   Re: Kerberos support for Spark on Mesos I skimmed over the existing design doc. From a security point of view it would be much better if you can just send tokens and not keytabs or TGT's. If keytabs are compromised user can use forever, if TGT is compromised user can use for X amount of time but can get other tokens for other services, if token is compromised its only for x amount of time for that particular service. I assume you already have something on the client side pushing new TGT's? If so it should be trivial to change to do tokens. Definitely sending over rpc to executors is better. I want to do both of those things on the yarn side (send over rpc and send only tokens). Add Comment   This message was sent by Atlassian JIRA (v6.3.15#6346-sha1:dbc023d)