From 908fd4506f1dafe9624685bf930b38023be24493 Mon Sep 17 00:00:00 2001 From: Jakob Homan Date: Fri, 4 Jun 2010 00:41:13 +0000 Subject: [PATCH] HADOOP-6661. User document for UserGroupInformation.doAs. Contributed by Jitendra Pandey. git-svn-id: https://svn.apache.org/repos/asf/hadoop/common/trunk@951227 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES.txt | 3 + .../content/xdocs/Superusers.xml | 106 ++++++++++++++++++ .../src/documentation/content/xdocs/site.xml | 1 + 3 files changed, 110 insertions(+) create mode 100644 src/docs/src/documentation/content/xdocs/Superusers.xml diff --git a/CHANGES.txt b/CHANGES.txt index 0aca265fc7..e739176ab1 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -38,6 +38,9 @@ Trunk (unreleased changes) HADOOP-6714. Resolve compressed files using CodecFactory in FsShell::text. (Patrick Angeles via cdouglas) + HADOOP-6661. User document for UserGroupInformation.doAs. + (Jitendra Pandey via jghoman) + BUG FIXES HADOOP-6638. try to relogin in a case of failed RPC connection (expired tgt) only in case the subject is loginUser or proxyUgi.realUser. (boryas) diff --git a/src/docs/src/documentation/content/xdocs/Superusers.xml b/src/docs/src/documentation/content/xdocs/Superusers.xml new file mode 100644 index 0000000000..94409c49d8 --- /dev/null +++ b/src/docs/src/documentation/content/xdocs/Superusers.xml @@ -0,0 +1,106 @@ + + + + + + + + +
+ + Superusers Acting On Behalf Of Other Users + +
+ + +
+ Introduction +

+ This document describes how a superuser can submit jobs or access hdfs on behalf of another user in a secured way. +

+
+ +
+ Use Case +

+ The code example described in the next section is applicable for the following use case. +

+

+ A superuser with username 'super' wants to submit job and access hdfs on behalf of a user joe. The superuser has kerberos credentials but user joe doesn't have any. The tasks are required to run as user joe and any file accesses on namenode are required to be done as user joe. It is required that user joe can connect to the namenode or job tracker on a connection authenticated with super's kerberos credentials. In other words super is impersonating the user joe. +

+
+ + +
+ Code example +

+ In this example super's kerberos credentials are used for login and a proxy user ugi object is created for joe. The operations are performed within the doAs method of this proxy user ugi object. +

+ + ... + //Create ugi for joe. The login user is 'super'. + UserGroupInformation ugi = + UserGroupInformation.createProxyUser("joe", UserGroupInformation.getLoginUser()); + ugi.doAs(new PrivilegedExceptionAction<Void>() { + public Void run() throws Exception { + //Submit a job + JobClient jc = new JobClient(conf); + jc.submitJob(conf); + //OR access hdfs + FileSystem fs = FileSystem.get(conf); + fs.mkdir(someFilePath); + } + } + +
+ +
+ Configurations +

+ The superuser must be configured on namenode and jobtracker to be allowed to impersonate another user. Following configurations are required. +

+ + <property> + <name>hadoop.proxyuser.super.groups</name> + <value>group1,group2</value> + <description>Allow the superuser super to impersonate any members of the group group1 and group2</description> + </property> + <property> + <name>hadoop.proxyuser.super.hosts</name> + <value>host1,host2</value> + <description>The superuser can connect only from host1 and host2 to impersonate a user</description> + </property> + +

+ If these configurations are not present, impersonation will not be allowed and connection will fail. +

+
+ + +
+ Caveats +

+ The superuser must have kerberos credentials to be able to impersonate another user. It cannot use delegation tokens for this feature. It would be wrong if superuser adds its own delegation token to the proxy user ugi, as it will allow the proxy user to connect to the service with the privileges of the superuser. +

+

+ However, if the superuser does want to give a delegation token to joe, it must first impersonate joe and get a delegation token for joe, in the same way as the code example above, and add it to the ugi of joe. In this way the delegation token will have the owner as joe. +

+
+ + + diff --git a/src/docs/src/documentation/content/xdocs/site.xml b/src/docs/src/documentation/content/xdocs/site.xml index 878712b930..fe384f3c10 100644 --- a/src/docs/src/documentation/content/xdocs/site.xml +++ b/src/docs/src/documentation/content/xdocs/site.xml @@ -42,6 +42,7 @@ See http://forrest.apache.org/docs/linking.html for more info. +