[HADOOP-8458] Add management hook to AuthenticationHandler to enable delegation token operations support

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0-alpha
• Fix Version/s: 2.0.2-alpha
• Component/s: security
• Hadoop Flags: Incompatible change, Reviewed
• Assignee: Alejandro Abdelnur
• Reporter: Alejandro Abdelnur
• Created: 31/May/12 17:45
• Updated: 02/May/13 02:29
• Resolved: 12/Jun/12 20:48

Description

Currently hadoop-auth AuthenticationHandler only authenticates a request.

While it can easily be extended to authenticate delegation tokens, it cannot handle the delegation token get/renew/cancel operations.

The motivation of this new feature is that the above delegation token operations should be handled by a security component (hadoop-auth) instead of a functional component (httpfs implementation). Ideally we should have a complete separation of concerns between delegation token management and FileSystem/MapReduce/YARN API, but we don't. This change is a step on that directory for HTTP based services (like HttpFS).

Issue Links

• is depended upon by: HADOOP-8465 hadoop-auth should support ephemeral authentication
• is required by: HDFS-3113 httpfs does not support delegation tokens