[
https://issues.apache.org/jira/browse/MAPREDUCE-2858?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13134405#comment-13134405
]
Robert Joseph Evans commented on MAPREDUCE-2858:
------------------------------------------------
That would work especially if I do them all as session cookies. There are some
limitations still, that would require some testing to be sure everything still
works. From what I have read IE and Firefox have a 50 cookie limit per domain,
Opera has 30, and Webkit supports enough cookies that if you put in too many
web servers start to error out. The path should take care of webkit sending
too many cookies to Jetty. There is something that feels a bit wrong about
potentially setting 50 or 60 cookies, but I cannot think of anything concrete
right now that would make me not do it.
> MRv2 WebApp Security
> --------------------
>
> Key: MAPREDUCE-2858
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2858
> Project: Hadoop Map/Reduce
> Issue Type: Sub-task
> Components: applicationmaster, mrv2, security
> Affects Versions: 0.23.0, 0.24.0
> Reporter: Luke Lu
> Assignee: Robert Joseph Evans
> Priority: Blocker
> Fix For: 0.23.0
>
> Attachments: MR-2858-branch-0.23.txt, MR-2858-branch-0.23.txt,
> MR-2858-branch-0.23.txt, MR-2858.txt, MR-2858.txt, MR-2858.txt
>
>
> In MRv2, while the system servers (ResourceManager (RM), NodeManager (NM) and
> NameNode (NN)) run as "trusted"
> system users, the application masters (AM) run as users who submit the
> application. While this offers great flexibility
> to run multiple version of mapreduce frameworks (including their UI) on the
> same Hadoop cluster, it has significant
> implication for the security of webapps (Please do not discuss company
> specific vulnerabilities here).
> Requirements:
> # Secure authentication for AM (for app/job level ACLs).
> # Webapp security should be optional via site configuration.
> # Support existing pluggable single sign on mechanisms.
> # Should not require per app/user configuration for deployment.
> # Should not require special site-wide DNS configuration for deployment.
> This the top jira for webapp security. A design doc/notes of threat-modeling
> and counter measures will be posted on the wiki.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
