[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[
https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16815756#comment-16815756
]
Eric Yang commented on HADOOP-16023:
{quote}Gotcha. Is it worth adding an extra config item that allows applying the
'L' globally? It is cumbersome to do this in krb5.conf (ie. it requires doing
it by character){quote}
+1 for a flag to convert name to case insensitive idea.
> Support system /etc/krb5.conf for auth_to_local rules
> -
>
> Key: HADOOP-16023
> URL: https://issues.apache.org/jira/browse/HADOOP-16023
> Project: Hadoop Common
> Issue Type: Improvement
>Reporter: Bolke de Bruin
>Assignee: Bolke de Bruin
>Priority: Major
> Labels: security
>
> Hadoop has long maintained its own configuration for Kerberos' auth_to_local
> rules. To the user this is counter intuitive and increases the complexity of
> maintaining a secure system as the normal way of configuring these
> auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf.
> With HADOOP-15996 there is now support for configuring how Hadoop should
> evaluate auth_to_local rules. A "system" mechanism should be added.
> It should be investigated how to properly parse krb5.conf. JDK seems to be
> lacking as it is unable to obtain auth_to_local rules due to a bug in its
> parser. Apache Kerby has an implementation that could be used. A native (C)
> version is also a possibility.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
-
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[
https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16815727#comment-16815727
]
Bolke de Bruin commented on HADOOP-16023:
-
{quote}[~bolke] The current MIT rule mechanism isn't behave exactly how MIT
Kerberos behave because it depends on Hadoop auth_to_local instead of
krb5.conf. I think it is classified as bug fix to get it right, rather than
creating a third mechanism.
{quote}
Gotcha. Is it worth adding an extra config item that allows applying the 'L'
globally? It is cumbersome to do this in krb5.conf (ie. it requires doing it by
character)
{quote}Can you also review HADOOP-16214? Your review will be helpful. Thanks
{quote}
will do
> Support system /etc/krb5.conf for auth_to_local rules
> -
>
> Key: HADOOP-16023
> URL: https://issues.apache.org/jira/browse/HADOOP-16023
> Project: Hadoop Common
> Issue Type: Improvement
>Reporter: Bolke de Bruin
>Assignee: Bolke de Bruin
>Priority: Major
> Labels: security
>
> Hadoop has long maintained its own configuration for Kerberos' auth_to_local
> rules. To the user this is counter intuitive and increases the complexity of
> maintaining a secure system as the normal way of configuring these
> auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf.
> With HADOOP-15996 there is now support for configuring how Hadoop should
> evaluate auth_to_local rules. A "system" mechanism should be added.
> It should be investigated how to properly parse krb5.conf. JDK seems to be
> lacking as it is unable to obtain auth_to_local rules due to a bug in its
> parser. Apache Kerby has an implementation that could be used. A native (C)
> version is also a possibility.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
-
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16813616#comment-16813616 ] Eric Yang commented on HADOOP-16023: [~daryn] When RM's hadoop auth_to_local, maps johnSmith to johnsmith. Node manager receives the UGI call, and starts container-executor using johnsmith [username string|https://github.com/apache/hadoop/blob/trunk/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/native/container-executor/impl/main.c#L673]. User johnSmith's program reads ~/.ssh/id_rsa key, and print it to log. This is the default behavior when using LinuxContainerExecutor. There is no setting required. > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16813408#comment-16813408 ] Daryn Sharp commented on HADOOP-16023: -- The container launches as the user determined by the RM's hadoop auth_to_local rules. NM system kerberos translation are not applied for the setuid. Is there a configuration of which I'm not aware? > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16812863#comment-16812863 ] Eric Yang commented on HADOOP-16023: [~daryn] auth_to_local maps the user name to unix name. When container-executor runs the task, it will be based on unix name. If OS has both users: johnsmith and johnSmith, MIT Kerberos will allow both users to work in the OS. Where Hadoop auth_to_local will map johnSmith to johnsmith. Container spawned in Hadoop will run with uid/gid of johnsmith instead of johnSmith implicitly. We can prevent this error in MIT kerberos rule mapping mechanism by removing the implicit conversion. > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16812844#comment-16812844 ] Daryn Sharp commented on HADOOP-16023: -- Maybe I'm missing something. How are the system's auth_to_local rules used or relevant to the container executor? > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16812627#comment-16812627 ] Eric Yang commented on HADOOP-16023: [~bolke] The current MIT rule mechanism isn't behave exactly how MIT Kerberos behave because it depends on Hadoop auth_to_local instead of krb5.conf. I think it is classified as bug fix to get it right, rather than creating a third mechanism. > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[
https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16812596#comment-16812596
]
Eric Yang commented on HADOOP-16023:
{quote}Our krb5.conf auth_to_local rules never match the hadoop rules. The
re-writes of principals that apply to the hdfs namespace or yarn service users
are orthogonal to the system's users.{quote}
Do you configure container-executor for your Hadoop jobs? If you do, and
system auth_to_local is different from Hadoop's auth_to_local, you can have
username conflicts in the system level. Whether this is on purpose or not, it
depends on your environment. The options are not being taken away as long as
we don't bridge system and Hadoop rules to hide the unique behavior that Hadoop
rules can convert upper case username to lower case.
> Support system /etc/krb5.conf for auth_to_local rules
> -
>
> Key: HADOOP-16023
> URL: https://issues.apache.org/jira/browse/HADOOP-16023
> Project: Hadoop Common
> Issue Type: Improvement
>Reporter: Bolke de Bruin
>Assignee: Bolke de Bruin
>Priority: Major
> Labels: security
>
> Hadoop has long maintained its own configuration for Kerberos' auth_to_local
> rules. To the user this is counter intuitive and increases the complexity of
> maintaining a secure system as the normal way of configuring these
> auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf.
> With HADOOP-15996 there is now support for configuring how Hadoop should
> evaluate auth_to_local rules. A "system" mechanism should be added.
> It should be investigated how to properly parse krb5.conf. JDK seems to be
> lacking as it is unable to obtain auth_to_local rules due to a bug in its
> parser. Apache Kerby has an implementation that could be used. A native (C)
> version is also a possibility.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
-
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[
https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16812494#comment-16812494
]
Daryn Sharp commented on HADOOP-16023:
--
{quote}It would really help if you can explain a use case when you would want
to have two different remaps for the same realm?{quote}
Our krb5.conf auth_to_local rules never match the hadoop rules. The re-writes
of principals that apply to the hdfs namespace or yarn service users are
orthogonal to the system's users.
{quote}supporting multiple realms as per your example is I think a new
mechanism, as both current mechanisms do not allow for that. So it would
require a "system" mechanism support.{quote}
It's not new. We have always used multiple realms in multiple environments.
> Support system /etc/krb5.conf for auth_to_local rules
> -
>
> Key: HADOOP-16023
> URL: https://issues.apache.org/jira/browse/HADOOP-16023
> Project: Hadoop Common
> Issue Type: Improvement
>Reporter: Bolke de Bruin
>Assignee: Bolke de Bruin
>Priority: Major
> Labels: security
>
> Hadoop has long maintained its own configuration for Kerberos' auth_to_local
> rules. To the user this is counter intuitive and increases the complexity of
> maintaining a secure system as the normal way of configuring these
> auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf.
> With HADOOP-15996 there is now support for configuring how Hadoop should
> evaluate auth_to_local rules. A "system" mechanism should be added.
> It should be investigated how to properly parse krb5.conf. JDK seems to be
> lacking as it is unable to obtain auth_to_local rules due to a bug in its
> parser. Apache Kerby has an implementation that could be used. A native (C)
> version is also a possibility.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
-
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16811960#comment-16811960 ] Eric Yang commented on HADOOP-16023: [~bolke] Hadoop only supports lower case username, therefore, MIT kerberos auth_to_local will not work fully when there is capital letters in the principal. I think bridging Hadoop rule and MIT Kerberos rules is a dicey proposition. I would prefer to keep them separated, and let Admin handle this in their user database management to reduce unexpected behavior. Majority of the use cases are covered in the following 2 options: 1. Microsoft AD and Hadoop both opt in for using case insensitive username. If FreeIPA is used in the middle to bridge AD and Hadoop, then there is no friction by parsing multi-realms auth_to_local from krb5.conf. 2. If user created their own FreeIPA server (single realm) with capitalized usernames but they would like to map to lower case characters, they can use existing Hadoop rules. The clear distinction may help admin to decide which option to use. Thought? Can you also review HADOOP-16214? Your review will be helpful. Thanks > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[
https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16811675#comment-16811675
]
Bolke de Bruin commented on HADOOP-16023:
-
[~eyang] getting back to this. Yes that format should be supported, please note
that by default the 'L' parameter is not supported in this case as normal
Kerberos is not aware of it and it would make the krb5.conf invalid. I have
been thinking about this a little bit more: instead of making this a rule
mechanism we could also make it pickup the rules from /etc/krb5.conf with the
special rule in hadoop's config of "\{SYSTEM}", which should then only be
allowed as the first and last rule.
This would make it available to both mechanisms and be more true to its nature
as it is not really the system's mechanism that is applied.
> Support system /etc/krb5.conf for auth_to_local rules
> -
>
> Key: HADOOP-16023
> URL: https://issues.apache.org/jira/browse/HADOOP-16023
> Project: Hadoop Common
> Issue Type: Improvement
>Reporter: Bolke de Bruin
>Assignee: Bolke de Bruin
>Priority: Major
> Labels: security
>
> Hadoop has long maintained its own configuration for Kerberos' auth_to_local
> rules. To the user this is counter intuitive and increases the complexity of
> maintaining a secure system as the normal way of configuring these
> auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf.
> With HADOOP-15996 there is now support for configuring how Hadoop should
> evaluate auth_to_local rules. A "system" mechanism should be added.
> It should be investigated how to properly parse krb5.conf. JDK seems to be
> lacking as it is unable to obtain auth_to_local rules due to a bug in its
> parser. Apache Kerby has an implementation that could be used. A native (C)
> version is also a possibility.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
-
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[
https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16761308#comment-16761308
]
Eric Yang commented on HADOOP-16023:
Good to know JDK parser is working as designed. Is this the format that will
be supported?
{code}
EXAMPLE.COM = {
auth_to_local = RULE:[1:$1@$0](.*@.*EXAMPLE.COM)s/@.*//
auth_to_local = DEFAULT
}
EXAMPLE2.COM = {
auth_to_local = RULE:[1:$1@$0](.*@.*EXAMPLE2.COM)s/@.*//
auth_to_local = DEFAULT
}
{code}
> Support system /etc/krb5.conf for auth_to_local rules
> -
>
> Key: HADOOP-16023
> URL: https://issues.apache.org/jira/browse/HADOOP-16023
> Project: Hadoop Common
> Issue Type: Improvement
>Reporter: Bolke de Bruin
>Assignee: Bolke de Bruin
>Priority: Major
> Labels: security
>
> Hadoop has long maintained its own configuration for Kerberos' auth_to_local
> rules. To the user this is counter intuitive and increases the complexity of
> maintaining a secure system as the normal way of configuring these
> auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf.
> With HADOOP-15996 there is now support for configuring how Hadoop should
> evaluate auth_to_local rules. A "system" mechanism should be added.
> It should be investigated how to properly parse krb5.conf. JDK seems to be
> lacking as it is unable to obtain auth_to_local rules due to a bug in its
> parser. Apache Kerby has an implementation that could be used. A native (C)
> version is also a possibility.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
-
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[
https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16761280#comment-16761280
]
Bolke de Bruin commented on HADOOP-16023:
-
I initially thought that the following is allowed:
{code:java}
ATHENA.MIT.EDU = {
auth_to_local = {
rule1
rule2
}
}
{code}
Don't worry about it as it is not relevant and actually makes it easier. The
krb5.conf parser of the JDK is fine and we can use the evaluator of Hadoop for
the rules, I just had been staring at too many man pages and krb5.conf's.
> Support system /etc/krb5.conf for auth_to_local rules
> -
>
> Key: HADOOP-16023
> URL: https://issues.apache.org/jira/browse/HADOOP-16023
> Project: Hadoop Common
> Issue Type: Improvement
>Reporter: Bolke de Bruin
>Assignee: Bolke de Bruin
>Priority: Major
> Labels: security
>
> Hadoop has long maintained its own configuration for Kerberos' auth_to_local
> rules. To the user this is counter intuitive and increases the complexity of
> maintaining a secure system as the normal way of configuring these
> auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf.
> With HADOOP-15996 there is now support for configuring how Hadoop should
> evaluate auth_to_local rules. A "system" mechanism should be added.
> It should be investigated how to properly parse krb5.conf. JDK seems to be
> lacking as it is unable to obtain auth_to_local rules due to a bug in its
> parser. Apache Kerby has an implementation that could be used. A native (C)
> version is also a possibility.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
-
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16761270#comment-16761270 ] Eric Yang commented on HADOOP-16023: [~bolke] Can you elaborate on mistaken in the allowed formats? If we can make Hadoop parser work with krb5.conf, it is probably better choice. > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16761222#comment-16761222 ] Bolke de Bruin commented on HADOOP-16023: - [~eyang] sorry some updates # Patch landed in Kerby to add extra support, but might ask to revert it as I was mistaken in the allowed formats # The JDK issue was inccorect So that means we can use the JDK (8+) version to rely on system configured krb5.conf and use Hadoop's parsing. This is quite easy and should probably be the best course for now. (a) I've worked on making it fully native, but that requires wrapping quite a lot of the c library (basically the whole .h file). (b) So in the next week or 2 I should be able to free up some time to do (a) unless you think (b) makes more sense. > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16761176#comment-16761176 ] Eric Yang commented on HADOOP-16023: [~bolke] Any update? > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[
https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16737537#comment-16737537
]
Eric Yang commented on HADOOP-16023:
[~bolke] {quote}is that really a concern?{quote}
The chance of Oracle going after Apache is slim to none. I think it is safe as
long as Hadoop isn't the only project that uses jna. The barer of
responsibility is ASF and not individual contributor.
> Support system /etc/krb5.conf for auth_to_local rules
> -
>
> Key: HADOOP-16023
> URL: https://issues.apache.org/jira/browse/HADOOP-16023
> Project: Hadoop Common
> Issue Type: Improvement
>Reporter: Bolke de Bruin
>Assignee: Bolke de Bruin
>Priority: Major
> Labels: security
>
> Hadoop has long maintained its own configuration for Kerberos' auth_to_local
> rules. To the user this is counter intuitive and increases the complexity of
> maintaining a secure system as the normal way of configuring these
> auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf.
> With HADOOP-15996 there is now support for configuring how Hadoop should
> evaluate auth_to_local rules. A "system" mechanism should be added.
> It should be investigated how to properly parse krb5.conf. JDK seems to be
> lacking as it is unable to obtain auth_to_local rules due to a bug in its
> parser. Apache Kerby has an implementation that could be used. A native (C)
> version is also a possibility.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
-
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16737461#comment-16737461 ] Bolke de Bruin commented on HADOOP-16023: - [~daryn] I understand that. Obviously, if it is configured as "system" or "native" with documentation that it just does that it would be on purpose. It would really help if you can explain a use case when you would want to have two different remaps for the same realm? From my perspective it is currently a maintenance burden to maintain two sets of auth_to_local rules that are the same, but also have their different quirks when they are evaluated. ACL type of checks should really be handled at a different layer imho. In any case if you want such behavior you now can with the "hadoop" and "mit" mechanisms. [~eyang] is that really a concern? JNA is already used within Apache Cassandra and Apache Druid (incubating), so I assume the risk is already taken by the ASF (if any). Anyways, I'll try to make it work and lets see how it behaves. Using the parsers of Kerby or the JDK (after they are fixed) is always a possibility. > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16737287#comment-16737287 ] Daryn Sharp commented on HADOOP-16023: -- This needs to be extremely carefully considered. System rules may be completely different than hadoop rules. It's all about context. A hadoop admin and a system admin may each configure remaps the other would never allow or may be completely irrelevant. Hadoop can remap to a short user that does not exist at the system level. > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16736328#comment-16736328 ] Eric Yang commented on HADOOP-16023: [~bolke] Some Apache projects are using dual license libraries. (e.g. HBase uses jruby). Most of the time, this is not an issue, however, com.sun.jna package name is an area of concern. [Oracle and Google lawsuit|https://en.wikipedia.org/wiki/Oracle_America,_Inc._v._Google,_Inc.] is a related example that Oracle might seek damages that subject to non-fair use of Java API packages. There is a tiny risk to use jna library. > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16735295#comment-16735295 ] Bolke de Bruin commented on HADOOP-16023: - [~aceric] [~lmccay] how would you feel about including the JNA library ([https://github.com/java-native-access/jna,] Dual LGPL2.0, AL 2.0 licensed). I could make auth_to_local work and have it exactly behave as the system library would. Otherwise we would always be dependent on a knock-off parser and evaluator. > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16734439#comment-16734439 ] Bolke de Bruin commented on HADOOP-16023: - This is the bug id for the jdk: [JDK-8216173|http://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8216173] > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-16023) Support system /etc/krb5.conf for auth_to_local rules
[ https://issues.apache.org/jira/browse/HADOOP-16023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16733895#comment-16733895 ] Bolke de Bruin commented on HADOOP-16023: - I noticed that both the JDK and Apache Kerby have issues in their parsers. I have raised an issue with the JDK. Working on a patch for Apache Kerby. > Support system /etc/krb5.conf for auth_to_local rules > - > > Key: HADOOP-16023 > URL: https://issues.apache.org/jira/browse/HADOOP-16023 > Project: Hadoop Common > Issue Type: Improvement >Reporter: Bolke de Bruin >Assignee: Bolke de Bruin >Priority: Major > Labels: security > > Hadoop has long maintained its own configuration for Kerberos' auth_to_local > rules. To the user this is counter intuitive and increases the complexity of > maintaining a secure system as the normal way of configuring these > auth_to_local rules is done in the site wide krb5.conf usually /etc/krb5.conf. > With HADOOP-15996 there is now support for configuring how Hadoop should > evaluate auth_to_local rules. A "system" mechanism should be added. > It should be investigated how to properly parse krb5.conf. JDK seems to be > lacking as it is unable to obtain auth_to_local rules due to a bug in its > parser. Apache Kerby has an implementation that could be used. A native (C) > version is also a possibility. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
