[HADOOP-8779] Use tokens regardless of authentication type

• Type: New Feature
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.0.2-alpha, 3.0.0-alpha1
• Component/s: fs, security
• Target Version/s: 2.0.2-alpha
• Assignee: Daryn Sharp
• Reporter: Daryn Sharp
• Created: 07/Sep/12 17:03
• Updated: 12/May/16 18:24

Description

Security is a combination of authentication and authorization (tokens). Authorization may be granted independently of the authentication model. Tokens should be used regardless of simple or kerberos authentication.

Issue Links

• depends upon: HADOOP-9299 kerberos name resolution is kicking in even when kerberos is not configured
• is related to: HADOOP-8758 Support for pluggable token implementations
• is required by: HADOOP-8991 Add support for SASL PLAIN authentication
• relates to: HADOOP-9392 Token based authentication and Single Sign On
• relates to: HADOOP-9671 Improve Hadoop security - Use cases, Threat Model and Problems
• relates to: HBASE-7081 Consider SASL improvements
• requires: HDFS-4056 Always start the NN's SecretManager

Sub-Tasks

• Remove security conditionals from FileSystems: Open
• Allow client to specify internal authentication: Open
• Add support for SASL PLAIN authentication: Patch Available
• Authentication method is wrong if no TGT is present: Patch Available
• Enable spnego filters only if kerberos is enabled: Patch Available