[HADOOP-4343] Adding user and service-to-service authentication to Hadoop

• Type: New Feature
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 0.20.203.0
• Assignee: Kan Zhang
• Reporter: Kan Zhang
• Created: 04/Oct/08 01:54
• Updated: 11/Aug/11 18:10
• Resolved: 11/Aug/11 18:07

Description

Currently, Hadoop services do not authenticate users or other services. As a result, Hadoop is subject to the following security risks.

1. A user can access an HDFS or M/R cluster as any other user. This makes it impossible to enforce access control in an uncooperative environment. For example, file permission checking on HDFS can be easily circumvented.

2. An attacker can masquerade as Hadoop services. For example, user code running on a M/R cluster can register itself as a new TaskTracker.

This JIRA is intended to be a tracking JIRA, where we discuss requirements, agree on a general approach and identify subtasks. Detailed design and implementation are the subject of those subtasks.

Issue Links

• is blocked by: HADOOP-4656 Add a user to groups mapping service
• is related to: HADOOP-4487 Security features for Hadoop
• relates to: HADOOP-5405 Adding support for HDFS proxy

Sub-Tasks

• adding delegation token implementation: Resolved