[
https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13026891#comment-13026891
]
Aaron T. Myers commented on MAPREDUCE-2457:
-------------------------------------------
Since we're now adding the concept of a "primary group," I wonder if we
shouldn't make this explicit, rather than just pick the first from the list.
i.e. change {{GroupMappingServiceProvider}} to add a {{public String
getPrimaryGroup(String user)}} method, and add a method to
{{UserGroupInformation}} to get the primary group of the user.
Thoughts?
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457-1.patch, MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on
> the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the
> 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler
> where it is common to use the group.name as pool name. Different from other
> properties, a special characteristic of the group.name is that its value
> cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the
> JobClient side. Instead, it should be done in the JobTracker when the JobConf
> is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
