[MAPREDUCE-2858] MRv2 WebApp Security

• Type: Sub-task
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 0.23.0
• Fix Version/s: 0.23.0
• Component/s: applicationmaster, mrv2, security
• Target Version/s: 0.23.0

Release Note

A new server has been added to yarn. It is a web proxy that sits in front of the AM web UI. The server is controlled by the yarn.web-proxy.address config. If that config is set, and it points to an address that is different then the RM web interface then a separate proxy server needs to be launched.

This can be done by running

yarn-daemon.sh start proxyserver

If a separate proxy server is needed other configs also may need to be set, if security is enabled.
yarn.web-proxy.principal
yarn.web-proxy.keytab

The proxy server is stateless and should be able to support a VIP or other load balancing sitting in front of multiple instances of this server.

• Tags: webapp, mrv2, security
• Assignee: Robert Joseph Evans
• Reporter: Luke Lu
• Created: 18/Aug/11 21:57
• Updated: 15/Nov/11 00:49
• Resolved: 26/Oct/11 06:34

Description

In MRv2, while the system servers (ResourceManager (RM), NodeManager (NM) and NameNode (NN)) run as "trusted"
system users, the application masters (AM) run as users who submit the application. While this offers great flexibility
to run multiple version of mapreduce frameworks (including their UI) on the same Hadoop cluster, it has significant
implication for the security of webapps (Please do not discuss company specific vulnerabilities here).

Requirements:

1. Secure authentication for AM (for app/job level ACLs).
2. Webapp security should be optional via site configuration.
3. Support existing pluggable single sign on mechanisms.
4. Should not require per app/user configuration for deployment.
5. Should not require special site-wide DNS configuration for deployment.

This the top jira for webapp security. A design doc/notes of threat-modeling and counter measures will be posted on the wiki.

Issue Links

• is related to: MAPREDUCE-3174 app master UI goes away when app finishes - not very user friendly
• relates to: MAPREDUCE-3231 Improve Application Master And Job History UI Security