[HADOOP-15862] ABFS to support a Delegation Token provider which marshalls current Oauth secrets

• Type: Sub-task
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.2.0
• Component/s: fs/adl
• Assignee: Unassigned
• Reporter: Steve Loughran
• Created: 17/Oct/18 13:18
• Updated: 27/Feb/24 11:09

Description

ABFS has an extension point for generating delegation tokens, presumably the implementation is actually using Kerberos to generate some secrets to pass around.

HADOOP-14556 shows how an object store can actually implement DTs which marshall full credentials over the wire to remote services, so allowing users to submit queries to shared clusters. This isn't as secure as kerberos, but does let users access their private data.

(This JIRA is avoiding worrying about session & role auth, just taking the config options for login and marshalling as a DT)

Issue Links

• depends upon: HADOOP-16068 ABFS Authentication and Delegation Token plugins to optionally be bound to specific URI of the store
• relates to: HADOOP-14556 S3A to support Delegation Tokens
• relates to: MAPREDUCE-7154 TokenCache.obtainTokensForNamenodes() to get DTs even when security is off