Uploaded image for project: 'Flume'
  1. Flume
  2. FLUME-2343

Add user impersonation to DatasetSink

    Details

    • Type: Improvement
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: v1.4.0
    • Fix Version/s: v1.5.0
    • Component/s: Sinks+Sources
    • Labels:
      None

      Description

      Users creating datasets with the DatasetSink rather than the HDFS sink will still need user impersonation and authentication to HDFS using a flume principal.

        Activity

        Hide
        rdblue Ryan Blue added a comment -

        This patch adds user impersonation using a utility class for kerberos functions, KerberosUtil.

        I originally added a `DatasetWriter` implementation that ran all FS operations as the proxy user, but apparently that isn't necessary. The `FileSystem` instance must be created with the desired privileges and all actions using that `FileSystem` will use the privileges it was created with (also see this discussion). Only the `Dataset` loading must be wrapped by `doAs`, which doesn't agree with the HDFS implementation but works when I test against a quickstart VM.

        Show
        rdblue Ryan Blue added a comment - This patch adds user impersonation using a utility class for kerberos functions, KerberosUtil. I originally added a `DatasetWriter` implementation that ran all FS operations as the proxy user, but apparently that isn't necessary. The `FileSystem` instance must be created with the desired privileges and all actions using that `FileSystem` will use the privileges it was created with (also see this discussion ). Only the `Dataset` loading must be wrapped by `doAs`, which doesn't agree with the HDFS implementation but works when I test against a quickstart VM.
        Hide
        hshreedharan Hari Shreedharan added a comment -

        +1. Running tests now.

        Show
        hshreedharan Hari Shreedharan added a comment - +1. Running tests now.
        Hide
        jira-bot ASF subversion and git services added a comment -

        Commit 96b090b5117c34bba9f5104b47d005fe1c10c775 in flume's branch refs/heads/trunk from Hari Shreedharan
        [ https://git-wip-us.apache.org/repos/asf?p=flume.git;h=96b090b ]

        FLUME-2343. Add Kerberos and user impersonation support to Dataset Sink.

        (Ryan Blue via Hari Shreedharan)

        Show
        jira-bot ASF subversion and git services added a comment - Commit 96b090b5117c34bba9f5104b47d005fe1c10c775 in flume's branch refs/heads/trunk from Hari Shreedharan [ https://git-wip-us.apache.org/repos/asf?p=flume.git;h=96b090b ] FLUME-2343 . Add Kerberos and user impersonation support to Dataset Sink. (Ryan Blue via Hari Shreedharan)
        Hide
        jira-bot ASF subversion and git services added a comment -

        Commit b292d24a868cd67645c4ef423e1717706cddc202 in flume's branch refs/heads/flume-1.5 from Hari Shreedharan
        [ https://git-wip-us.apache.org/repos/asf?p=flume.git;h=b292d24 ]

        FLUME-2343. Add Kerberos and user impersonation support to Dataset Sink.

        (Ryan Blue via Hari Shreedharan)

        Show
        jira-bot ASF subversion and git services added a comment - Commit b292d24a868cd67645c4ef423e1717706cddc202 in flume's branch refs/heads/flume-1.5 from Hari Shreedharan [ https://git-wip-us.apache.org/repos/asf?p=flume.git;h=b292d24 ] FLUME-2343 . Add Kerberos and user impersonation support to Dataset Sink. (Ryan Blue via Hari Shreedharan)
        Hide
        hshreedharan Hari Shreedharan added a comment -

        Committed! Thanks Ryan!

        Show
        hshreedharan Hari Shreedharan added a comment - Committed! Thanks Ryan!
        Hide
        hudson Hudson added a comment -

        SUCCESS: Integrated in flume-trunk #563 (See https://builds.apache.org/job/flume-trunk/563/)
        FLUME-2343. Add Kerberos and user impersonation support to Dataset Sink. (hshreedharan: http://git-wip-us.apache.org/repos/asf/flume/repo/?p=flume.git&a=commit&h=96b090b5117c34bba9f5104b47d005fe1c10c775)

        • flume-ng-sinks/flume-dataset-sink/src/main/java/org/apache/flume/sink/kite/KerberosUtil.java
        • flume-ng-doc/sphinx/FlumeUserGuide.rst
        • flume-ng-sinks/flume-dataset-sink/src/main/java/org/apache/flume/sink/kite/DatasetSinkConstants.java
        • flume-ng-sinks/flume-dataset-sink/src/main/java/org/apache/flume/sink/kite/DatasetSink.java
        Show
        hudson Hudson added a comment - SUCCESS: Integrated in flume-trunk #563 (See https://builds.apache.org/job/flume-trunk/563/ ) FLUME-2343 . Add Kerberos and user impersonation support to Dataset Sink. (hshreedharan: http://git-wip-us.apache.org/repos/asf/flume/repo/?p=flume.git&a=commit&h=96b090b5117c34bba9f5104b47d005fe1c10c775 ) flume-ng-sinks/flume-dataset-sink/src/main/java/org/apache/flume/sink/kite/KerberosUtil.java flume-ng-doc/sphinx/FlumeUserGuide.rst flume-ng-sinks/flume-dataset-sink/src/main/java/org/apache/flume/sink/kite/DatasetSinkConstants.java flume-ng-sinks/flume-dataset-sink/src/main/java/org/apache/flume/sink/kite/DatasetSink.java

          People

          • Assignee:
            rdblue Ryan Blue
            Reporter:
            rdblue Ryan Blue
          • Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development