[AMBARI-19187] Disable security hook

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.5.0
• Fix Version/s: 2.5.0
• Component/s: ambari-agent, ambari-server
• External issue URL: https://issues.apache.org/jira/browse/AMBARI-19187
• Assignee: Attila Magyar
• Reporter: Attila Magyar
• Created: 13/Dec/16 10:23
• Updated: 23/Dec/16 18:48
• Resolved: 23/Dec/16 18:48

Description

Hadoop components need to establish a secure connection with ZooKeeper when Kerberos is enabled. This involves the setup of the correct authentication (JAAS config file) and authorization (per-component Kerberos-backed ACLs on the znodes) between the service and ZooKeeper. Most services are able to set these ACLs based on their config when the user enable kerberos.

When we disable kerberos again, the sasl ACL should be removed otherwise the services won't be able to access their znodes.

This issue is about introducing a new command (DISABLE_SECURITY) that will be sent by the ambari server to the services upon the dekerberiztion process. When a service receives this command it will be able to do the zookeeper secure to unsecure migration process (e.g. removing sasl ACLs).

Issue Links

• links to: review board