[HADOOP-9536] HSSO Server - Certificate Authority and Publisher of Service Public Keys

• Type: Sub-task
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: security
• Assignee: Unassigned
• Reporter: Larry McCay
• Created: 01/May/13 18:01
• Updated: 01/May/13 18:01

Description

This task provides the Hadoop cluster with a central authority for issuing and signing PKI keypairs for all of the Hadoop services.

It will leverage the CMF for rolling, versioning and managing keystores and publishing the public keys for all registered Hadoop services.

This allows services to easily acquire a new public key for verifying tokens signed by each other when signing keys have been rolled.

Public keys are safe to distribute freely we will only want to insure that the service is requesting the published keys from the actual HSSO service. This will require the use of SSL or some other server authentication scheme to avoid spoofing.