[SQOOP-1471] Use Hadoop CredentialProvider API to encyrpt passwords at rest

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.4.4, 1.4.5
• Fix Version/s: 1.4.6

Environment

Hadoop 2.6.0+

• Assignee: Venkat Ranganathan
• Reporter: Venkat Ranganathan
• Created: 25/Aug/14 23:39
• Updated: 08/Oct/14 22:07
• Resolved: 08/Oct/14 21:01

Description

HADOOP-10607 introduces an API to isolate password Storage from applications. This can be used to provide the DB password in a secure fashion to Sqoop users.

The DB passwords can be assigned an alias and stored in a keystore and the alias can be provided to Sqoop.
Option to provide the password on the command line (using --password-alias) option can be introduced as well as enhance the secure file option that we currently have to provide a new password loader that resolves the alias from keystore.

We need to detect the availability of the Credential Provider feature and use it and fail gracefully otherwise

Issue Links

• links to: review board link