[
https://issues.apache.org/jira/browse/HADOOP-9392?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13655311#comment-13655311
]
Larry McCay commented on HADOOP-9392:
-------------------------------------
Hello Kai - I have added a document to
https://issues.apache.org/jira/browse/HADOOP-9533 that describes the client
interactions with the HSSO service and have called out a couple aspects that we
need to rationalize with our related efforts.
One is regarding the composability of the authentication providers in your
effort within the chains of HSSO token endpoints. It is listed as an open
question within that document. Another is related to the granularity of the
tokens within our proposals. The HSSO overview describes the acquisition and
use of a couple different types of tokens. One is the cluster access token
which is issued to users to allow them to request service access tokens in
order to access specific services within the cluster.
The cluster access token records the authenticated identity and claims that
represent the event of authentication. It has a longer lifespan than service
access tokens and are cryptographically verifiable. Service access tokens are
issued to represent the ability for an authenticated user to request resources
of a particular service. They contain a representation of the authenticated
user as well as additional identity and profile attributes to be used in
authorization policy. Providing a relatively short lifespan for the service
access token allows for the groups and other attributes to be refreshed in a
timely manner while not requiring re-authentication or attribute server
interaction within the lifespan of the access token.
I am looking forward to your thoughts on rationalizing and collaborating on
these particular aspects of your pluggable authentication providers and token
based authentication. Please take a look at the overview document in
https://issues.apache.org/jira/browse/HADOOP-9533 and let me know what you
think.
Thanks!
> Token based authentication and Single Sign On
> ---------------------------------------------
>
> Key: HADOOP-9392
> URL: https://issues.apache.org/jira/browse/HADOOP-9392
> Project: Hadoop Common
> Issue Type: New Feature
> Components: security
> Reporter: Kai Zheng
> Assignee: Kai Zheng
> Fix For: 3.0.0
>
> Attachments: token-based-authn-plus-sso.pdf
>
>
> This is an umbrella entry for one of project Rhino’s topic, for details of
> project Rhino, please refer to
> https://github.com/intel-hadoop/project-rhino/. The major goal for this entry
> as described in project Rhino was
>
> “Core, HDFS, ZooKeeper, and HBase currently support Kerberos authentication
> at the RPC layer, via SASL. However this does not provide valuable attributes
> such as group membership, classification level, organizational identity, or
> support for user defined attributes. Hadoop components must interrogate
> external resources for discovering these attributes and at scale this is
> problematic. There is also no consistent delegation model. HDFS has a simple
> delegation capability, and only Oozie can take limited advantage of it. We
> will implement a common token based authentication framework to decouple
> internal user and service authentication from external mechanisms used to
> support it (like Kerberos)”
>
> We’d like to start our work from Hadoop-Common and try to provide common
> facilities by extending existing authentication framework which support:
> 1. Pluggable token provider interface
> 2. Pluggable token verification protocol and interface
> 3. Security mechanism to distribute secrets in cluster nodes
> 4. Delegation model of user authentication
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
