Uploaded image for project: 'Oozie'
  1. Oozie
  2. OOZIE-2165

Job log fetching can fail in Oozie HA mode when using doAs impersonation

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 4.1.0
    • Fix Version/s: 4.3.0
    • Component/s: HA
    • Labels:
      None

      Description

      From https://issues.cloudera.org/browse/HUE-2608

      "Oozie logs in Hue does not work well when Oozie is configured in HA mode. Essentially, DoAs user doesn't work for HA request. This happens because in HA one server will call other server as "tomcat user".

      http://oozie-server:4080/oozie/v2/job/jobid1-oozie_CB-W?show=log&allservers=false&doAs=sumeet&user.name=hue
      will be http://oozie-server:4080/oozie/v2/job/jobid1-oozie_CB-W?show=log&allservers=false&doAs=sumeet&user.name=oozie

      Potential fixes can be to add oozie as proxy user or drop doAs user from server to server call. Since the request is already authenticated, it should ok to call other server with oozie user. http://oozie-server:4080/oozie/v2/job/jobid1-oozie_CB-W?show=log&allservers=false&user.name=oozie"

        Attachments

        1. OOZIE-2165-1.patch
          3 kB
          Satish Subhashrao Saley
        2. OOZIE-2165-2.patch
          3 kB
          Satish Subhashrao Saley

          Activity

            People

            • Assignee:
              satishsaley Satish Subhashrao Saley
              Reporter:
              romainr Romain Rigaux
            • Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: