[HADOOP-17345] Work with externally managed user credentials

• Type: Task
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: security
• Assignee: Unassigned
• Reporter: Wei-Chiu Chuang
• Created: 03/Nov/20 18:09
• Updated: 03/Nov/20 18:10

Description

We don't have a good test coverage for externally managed user credentials. It's not clear how someone could ingest kerberos credentials or delegation tokens that are externally managed. It's not clear what services/file system implementation supports them.

File this Jira to track all relevant fixes/support/test/doc

1.  what is supported.
2.  test coverage
3.  document for best practices (how to do it right) 

Issue Links

• relates to: HADOOP-13805 UGI.getCurrentUser() fails if user does not have a keytab associated
• relates to: HDFS-15545 (S)Webhdfs will not use updated delegation tokens available in the ugi after the old ones expire