[HADOOP-6581] Add authenticated TokenIdentifiers to UGI so that they can be used for authorization

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Component/s: ipc, security
• Hadoop Flags: Reviewed
• Assignee: Kan Zhang
• Reporter: Kan Zhang
• Created: 21/Feb/10 02:17
• Updated: 28/May/10 11:23
• Resolved: 26/May/10 20:32

Description

When token is used for authentication over RPC, information other than username may be needed for access authorization. This information is typically specified in TokenIdentifier. This is especially true for block tokens used for client-to-datanode accesses, where authorization is based on access permissions specified in TokenIdentifier, and not on username. Block tokens used to be called access tokens and one can think of them as capability tokens. See HADOOP-4359 for more info.

Issue Links

• blocks: HDFS-992 Re-factor block access token implementation to conform to the generic Token interface in Common
• incorporates: HADOOP-6782 TestAvroRpc fails with avro-1.3.1 and avro-1.3.2
• is related to: HADOOP-4487 Security features for Hadoop