[HADOOP-8465] hadoop-auth should support ephemeral authentication

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0-alpha
• Fix Version/s: 2.0.2-alpha
• Component/s: security
• Hadoop Flags: Reviewed
• Assignee: Alejandro Abdelnur
• Reporter: Alejandro Abdelnur
• Created: 01/Jun/12 20:38
• Updated: 02/May/13 02:29
• Resolved: 13/Jun/12 02:26

Description

Currently, once a client is authenticated the generated authentication-token (& cookie) are valid for a given (service configurable) lifespan.

Once the authentication-token (& cookie) is issued, the authentication logic will not be triggered until the authentication-token expires.

This behavior does not work well with delegation tokens expected behavior where delegation tokens can be canceled at any time.

Having ephemeral authentication (which is check on every request) would address this issue.

Issue Links

• depends upon: HADOOP-8458 Add management hook to AuthenticationHandler to enable delegation token operations support
• is required by: HDFS-3113 httpfs does not support delegation tokens