[HADOOP-10791] AuthenticationFilter should support externalizing the secret for signing and provide rotation support

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.4.1
• Fix Version/s: 2.6.0
• Component/s: security
• Target Version/s: 2.6.0
• Hadoop Flags: Reviewed
• Assignee: Robert Kanter
• Reporter: Alejandro Abdelnur
• Created: 07/Jul/14 17:42
• Updated: 09/Feb/15 23:28
• Resolved: 05/Aug/14 21:25

Description

It should be possible to externalize the secret used to sign the hadoop-auth cookies.

In the case of WebHDFS the shared secret used by NN and DNs could be used. In the case of Oozie HA, the secret could be stored in Oozie HA control data in ZooKeeper.

In addition, it is desirable for the secret to change periodically, this means that the AuthenticationService should remember a previous secret for the max duration of hadoop-auth cookie.

Issue Links

• breaks: YARN-2388 TestTimelineWebServices fails on trunk after HADOOP-10791
• is depended upon by: OOZIE-1917 Authentication secret should be random by default and needs to coordinate with HA
• relates to: HADOOP-11567 Refresh HTTP Authentication secret without restarting the server

Sub-Tasks

• Create a ZooKeeper-backed secret provider: Closed