Uploaded image for project: 'Hadoop Common'
  1. Hadoop Common
  2. HADOOP-10183

Allow use of UPN style principals in keytab files

    XMLWordPrintableJSON

    Details

    • Type: Improvement
    • Status: Patch Available
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 2.2.0
    • Fix Version/s: None
    • Component/s: security
    • Labels:

      Description

      Hadoop currently only allows SPN style (E.g. hdfs/node.fqdn@REALM) principals in keytab files in a cluster configured with Kerberos security. This cause the burden of creating multiple principals and keytabs for each node of the cluster. Active Directory allows the use of single principal across multiple hosts if the SPNs for different hosts have been setup correctly on the principal. With this scheme we have the server side using keytab file with UPN style (E.g. hdfs@REALM) principal for a given service for all the nodes of the cluster. The client side will request service tickets with SPN and it's own TGT and Active Directory will grant service tickets with the correct secret.

      This will simplify the use of principals and keytab files for Active Directory users with one principal for each service across all the nodes of the cluster.

      I have a patch to allow the use of UPN style principals in Hadoop. The patch will not affect the use of SPN style principals. I couldn't figure out a way to write test cases against MiniKDC so I have included the Oracle/Sun sample Sasl server and client code along with the configuration I used to confirm this scheme works.

        Attachments

        1. SaslTestServer.java
          10 kB
          Mubashir Kazia
        2. SaslTestClient.java
          8 kB
          Mubashir Kazia
        3. krb5.conf
          0.5 kB
          Mubashir Kazia
        4. jaas-krb5.conf
          0.3 kB
          Mubashir Kazia
        5. Jaas.java
          4 kB
          Mubashir Kazia
        6. hdfs.keytab
          0.3 kB
          Mubashir Kazia
        7. HADOOP-10183.patch.1
          6 kB
          Mubashir Kazia
        8. HADOOP-10183.patch
          6 kB
          Mubashir Kazia
        9. AppConnection.java
          5 kB
          Mubashir Kazia

          Issue Links

            Activity

              People

              • Assignee:
                mkazia Mubashir Kazia
                Reporter:
                mkazia Mubashir Kazia
              • Votes:
                0 Vote for this issue
                Watchers:
                9 Start watching this issue

                Dates

                • Created:
                  Updated: