[HADOOP-11683] Need a plugin API to translate long principal names to local OS user names arbitrarily

• Type: Improvement
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.6.0
• Component/s: security
• Target Version/s: 2.6.6

Release Note

The patch allows HadoopKerberosName to use a user name mapping pluggable API from parameter, hadoop.security.user.name.mapping, instead of the regular expression specified in parameter, hadoop.security.auth_to_local.

If user name is not found by the API or hadoop.security.user.mapping is not set, it will default back to hadoop.security.auth_to_local for compatibility.

• Assignee: roger mak
• Reporter: Sunny Cheung
• Created: 06/Mar/15 07:23
• Updated: 15/Dec/16 18:28

Description

We need a plugin API to translate long principal names (e.g. [e-mail]) to local OS user names (e.g. user123456) arbitrarily.

For some organizations the name translation is straightforward (e.g. [e-mail] to john_doe), and the hadoop.security.auth_to_local configurable mapping is sufficient to resolve this (see HADOOP-6526). However, in some other cases the name translation is arbitrary and cannot be generalized by a set of translation rules easily.