Add SASL authentication - #153
Conversation
SASL is used as an authentication mechanism for secure Hadoop clusters. Snakebite does not have the capability to authenticate against secure clusters at the moment. This class implements the required functionality. * Introduces a dependency on sasl
To be able to determine if SASL authentication should be tried hadoop.security.authentication should be "kerberos".
This adds parameters to all instances of the client for the use of sasl authentication
This change obtains available mechanisms from the server and selects the one most secure, by design, for authentication.
This change sets the effective user to the kerberos principal name the current user has. This is required for GSSAPI authentication against a secure cluster. * New dependency on python-krbV
|
I am looking for some feedback on this. It fixes issue #59 for Kerberos support. |
|
Just reviewed this PR and I'm +1, just want @ravwojdyla to +1 too, since this is quite a big thing. Thanks a million for implementing this! |
|
Hello, the Kerberos support is great! In our environment we also enabled HDFS encrypted transport (rpc-protection is set to "privacy"). Seems like only unencrypted RPC responses are supported for now? I saw serverdefaults() in client.py reads encryptDataTransfer info but did not use it. Is it possible to add the rpc encrypt support? What work will be involved to make it happen? Thanks in advance! |
|
@chenbensong a bit of work needs to happen. The good news is that it is not as large as the initial commit (I think!). The messages need to be wrapped and unwrapped within the (kerberos)client. The bad news is that I don't have a cluster to test it out. I don't mind trying it out however I do like to have this patch reviewed and landed first. @ravwojdyla would you mind taking a look? |
|
@bolkedebruin Thanks for the explanations! Yes this patch itself is substantial and should land first. |
|
+1 |
1 similar comment
|
👍 |
|
+1, we're excited about Kerberos support as well - when are you guys planning to merge? |
|
👍 Any way to get this PR merged in? |
|
This is exactly what we need. Super stocked about Kerberos support! Any timeline projections on when we can expect this to get merged? 👍 |
|
Excited for this! Can we merge? 👍 |
|
Here we go! Seems all test pass, so I'm good :) |
10 participants
This patch implements SASL authentication (only GSSAPI was tested). SASL authentication is required for secure clusters, specifically the ones that use Kerberos. In Hadoop SASL is implemented on top of the Hadoop RPC protocol. I have chosen not to refactor any of the code yet, that could be done in a later patch.