[HADOOP-9296] Authenticating users from different realm without a trust relationship

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Won't Do
• Component/s: security
• Assignee: Benoy Antony
• Reporter: Benoy Antony
• Created: 11/Feb/13 17:57
• Updated: 16/Oct/17 19:46
• Resolved: 16/Oct/17 19:46

Description

Hadoop Masters (JobTracker and NameNode) and slaves (Data Node and TaskTracker) are part of the Hadoop domain, controlled by Hadoop Active Directory.
The users belong to the CORP domain, controlled by the CORP Active Directory.
In the absence of a one way trust from HADOOP DOMAIN to CORP DOMAIN, how will Hadoop Servers (JobTracker, NameNode) authenticate CORP users ?

The solution and implementation details are in the attachement

Issue Links

• is depended upon by: HBASE-7820 Authenticating users from different realm without a trust relationship
• relates to: HADOOP-9392 Token based authentication and Single Sign On

Sub-Tasks

• Ability to plugin custom authentication mechanisms based on Jaas and Sasl: In Progress