[TRAFODION-2055] Automate Kerberos ticket expiration and renewal for a cluster

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.1 (pre-incubation)
• Component/s: sql-security
• Assignee: Roberta Marton
• Reporter: Roberta Marton
• Created: 10/Jun/16 15:42
• Updated: 16/May/17 16:34
• Resolved: 16/May/17 16:34

Description

Today, we support a separate Kerberos ticket on each node. When it expires, the customer has to perform a manual task to renew it. We need an automated way to perform this operation. There are some options:

Today, a ticket will be renewed until all renewals have been performed. If there are no more renewals, the ticket expires. Trafodion will not work until the ticket is reinited.

One option would be to reinit the ticket after all the renewals are used up.

Another option would be to periodically check for ticket expiration. When a ticket is ready to expire, notify the system administrator. It is then up to the administrator to renew the ticket(s).

We could provide a tool that would periodically recreate trafodion tickets. This could be run by the administrator at time that would not affect running jobs.