[HADOOP-4656] Add a user to groups mapping service

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.19.0
• Fix Version/s: 0.21.0
• Component/s: security
• Hadoop Flags: Reviewed
• Assignee: Boris Shkolnik
• Reporter: Arun Murthy
• Created: 13/Nov/08 22:15
• Updated: 03/Feb/14 10:56
• Resolved: 18/Dec/09 02:39

Description

Currently the IPC client sends the UGI which contains the user/group information for the Server. However this represents the groups for the user on the client-end. The more pertinent mapping from user to groups is actually the one seen by the Server. Hence the client should only send the user and we should add a 'group mapping service' so that the Server can query it for the mapping.

Issue Links

• blocks: HADOOP-4850 Fix IPC Client to not use UGI
• blocks: HADOOP-4343 Adding user and service-to-service authentication to Hadoop
• blocks: HDFS-685 Use the user-to-groups mapping service in the NameNode
• blocks: MAPREDUCE-1083 Use the user-to-groups mapping service in the JobTracker
• is duplicated by: HDFS-156 namenode doesn't start if group id cannot be resolved to name
• relates to: HADOOP-4487 Security features for Hadoop
• relates to: HADOOP-8943 Support multiple group mapping providers