[AMBARI-8480] Kerberos service components should indicate security state

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.0.0
• Fix Version/s: 2.0.0
• Component/s: ambari-server, stacks
• Labels: kerberos lifecycle security
• Epic Link: Ambari Automated Kerberization
• Assignee: Robert Levas
• Reporter: Robert Levas
• Created: 29/Nov/14 10:26
• Updated: 07/Jan/15 17:11
• Resolved: 07/Jan/15 15:57

Description

The Kerberos service components should indicate security state when queried by Ambari Agent via STATUS_COMMAND. Each component should determine it's state as follows:

KERBEROS_CLIENT

Indicators

• Command JSON
  • config['configurations']['cluster-env']['security_enabled']
    • = “true”
  • config['configurations']['cluster-env']['smokeuser_keytab']
    • not empty
    • path exists and is readable
    • required
  • config['configurations']['cluster-env']['smokeuser']
    • not empty
    • required

Pseudocode

if indicators imply security is on and validate
    if kinit(smoketest user) succeeds
        state = SECURED_KERBEROS
    else
        state = ERROR 
else
    state = UNSECURED

Issue Links

• requires: AMBARI-8343 Components should indicate Security State (via ambari-agent)
• links to: ReviewBoard