[
https://issues.apache.org/jira/browse/MAPREDUCE-5379?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13705830#comment-13705830
]
Daryn Sharp commented on MAPREDUCE-5379:
----------------------------------------
-1 on the proposal so far for these reasons:
# If the goal is traceability from a token to a job, how do you plan to handle
clients that lie or jobs that fail to propagate the conf value to a subjob?
# The core objection is the identifier _must_ be opaque to the client.
There's no guarantee the client can decode identifiers. The decodeIdentifier
method is only reliable for the issuing service's server. Notice that
decodeIdentifier may return null if the identifier's class is unavailable, or
throw an exception if the format changes. Ex. the identifier becomes a
protobuf or is encrypted.
Hadoop is committed to compatibility which is possible only if the client
doesn't assume it can decode a token identifier.
> Include FS delegation token ID in job conf
> ------------------------------------------
>
> Key: MAPREDUCE-5379
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-5379
> Project: Hadoop Map/Reduce
> Issue Type: Improvement
> Components: job submission, security
> Affects Versions: 2.1.0-beta
> Reporter: Sandy Ryza
> Assignee: Sandy Ryza
> Attachments: MAPREDUCE-5379.patch
>
>
> Making a job's FS delegation token ID accessible will allow external services
> to associate it with the file system operations it performs.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
