Uploaded image for project: 'Hadoop Common'
  1. Hadoop Common
  2. HADOOP-16779

Support dynamic change Kerberos user and KDC to access multiple Hadoop clusters

    XMLWordPrintableJSON

    Details

    • Type: Improvement
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: security
    • Labels:
      None

      Description

      Currently Hadoop relies on Kerberos to do authentication and authorization. For single user, we can initialize  clients with keytab files in command-line or Java program.

      But sometimes we need to access Hadoop as multiple users. For example, we build the web service to view users' HDFS files. We have authorization to get user name and use this user's keytab to login before requesting HDFS. However, this doesn't work for multiple Hadoop clusters and multiple KDC. 

      Currently the only way to do that is enable cross-realm for these KDC. But in some scenarios we can not change the configuration of KDC and want single process to switch the Kerberos user on the fly without much overhead.

      Here is the related discussion in StackOverflow:

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              tobe chendihao
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated: