[HADOOP-11567] Refresh HTTP Authentication secret without restarting the server

• Type: Improvement
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.6.0
• Labels: BB2015-05-TBR
• Assignee: Benoy Antony
• Reporter: Benoy Antony
• Created: 09/Feb/15 23:27
• Updated: 17/Jul/15 19:06

Description

The AuthenticationFilter uses the secret read from a file specified via hadoop.http.authentication.signature.secret.file to sign the cookie containing user authentication information.
The secret is read only during initialization and hence needs a restart to update the secret.

ZKSignerSecretProvider can be used to rotate the secrets without restarting the servers, but it needs a zookeeper setup.
The jira is to refresh secret by updating the file.

Issue Links

• is related to: HADOOP-10791 AuthenticationFilter should support externalizing the secret for signing and provide rotation support
• is related to: HADOOP-10670 Allow AuthenticationFilters to load secret from signature secret files