[HADOOP-1701] Provide a security framework design

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Later
• Affects Version/s: 0.15.0
• Assignee: Unassigned
• Reporter: Tsz-wo Sze
• Created: 09/Aug/07 20:15
• Updated: 02/May/13 02:29
• Resolved: 22/Oct/08 20:43

Description

Only provide a security framework as described below. A simple implementation will be provided in HADOOP-2229.

Previous Description

In HADOOP-1298, we want to add user information and permission to the file system. It requires an authentication service and a user management service. We should provide a framework and a simple implementation in issue and extend it later. As discussed in HADOOP-1298, the framework should be extensible and pluggable.

• Extensible: possible to extend the framework to the other parts (e.g. map-reduce) of Hadoop.

• Pluggable: can easily switch security implementations. Below is a diagram borrowed from Java.

• Implement a Hadoop authentication center (HAC). In the first step, the mechanism of HAC is very simple, it keeps track a list of usernames (we only support users, will work on other principals later) in HAC and verify username in user login (yeah, no password). HAC can run inside NameNode or run as a stand alone server. We will probably use Kerberos to provide more sophisticated authentication service.

Issue Links

• is depended upon by: HADOOP-1741 Actual Hadoop security implementation with Kerberos
• is related to: HADOOP-1298 adding user info to file
• relates to: HADOOP-1298 adding user info to file