[HADOOP-11207] DelegationTokenAuthenticationHandler needs to support DT operations for proxy user

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.6.0
• Component/s: security
• Target Version/s: 2.6.0
• Hadoop Flags: Reviewed
• Assignee: Zhijie Shen
• Reporter: Zhijie Shen
• Created: 15/Oct/14 21:49
• Updated: 01/Dec/14 03:07
• Resolved: 17/Oct/14 22:58

Description

Currently, DelegationTokenAuthenticationHandler only support DT operations for the request user after it passes the authentication. However, it should also support the request user to do DT operations on behalf of the proxy user.

Timeline server is using the authentication filter for DT operations instead of traditional RPC-based ones. It needs this feature to enable the proxy user to use the timeline service (YARN-2676).

Issue Links

• blocks: YARN-2676 Timeline authentication filter should add support for proxy user
• relates to: HDFS-7262 WebHDFS should use proxy doAs support in DelegationTokenAuthenticationHandler for token-management calls
• relates to: HADOOP-10771 Refactor HTTP delegation support out of httpfs to common