Re: Kerberos for Streaming & Kafka

2016-03-29 Thread Maximilian Michels
Hi Eron, Thank you for your feedback! Indeed, we have seen in the past, that Hadoop's Delegation Tokens are not meant to renewed over a long period. Plus, they have a number of subtle bugs in older versions that sometimes prevent renewal. What you suggest, sounds like a good approach to me. It

RE: Kerberos for Streaming & Kafka

2016-03-25 Thread Eron Wright
(fixed bad formatting) Hi, Given the other thread about per-job Kerberos identity, now's a good time to discuss some problems with the current delegation-token approach, since the answer could bear on the per-job enhancement. I see two problems: 1. Delegation tokens expire. For a continuous

Kerberos for Streaming & Kafka

2016-03-24 Thread Eron Wright
Hi, Given the other thread about per-job Kerberos identity, now's a good time to discuss some problems with the current delegation-token approach, since the answer could bear on the per-job enhancement. Two problems:Delegation tokens expire. For a continuous streaming job to survive, the