hadoop-common-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Alejandro Abdelnur (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (HADOOP-10433) Key Management Server based on KeyProvider API
Date Fri, 02 May 2014 17:17:58 GMT

    [ https://issues.apache.org/jira/browse/HADOOP-10433?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13987966#comment-13987966
] 

Alejandro Abdelnur commented on HADOOP-10433:
---------------------------------------------

Test failure seems unrelated.

Owen, Andrew, are we good to go now?

Vinay, a sample of the audit log follows. Regarding normalizing audit logs, that would be
nice, mind opening a JIRA for it (it is out of scope from this JIRA).

{code}
2014-05-02 10:14:12,326 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65499/kms/v1/keys?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:12,994 Status:OK User:client@EXAMPLE.COM Op:CREATE_KEY Name:ck0UserProvidedMaterial:false
Description:null
2014-05-02 10:14:13,027 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65499/kms/v1/keys?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:13,076 Status:OK User:client/host@EXAMPLE.COM Op:CREATE_KEY Name:ck1UserProvidedMaterial:false
Description:null
2014-05-02 10:14:13,557 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/keys?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:13,597 Status:UNAUTHORIZED User:client@EXAMPLE.COM Op:CREATE_KEY Name:k
2014-05-02 10:14:13,597 Status:ERROR User:client@EXAMPLE.COM Method:POST URL:http://localhost:65509/kms/v1/keys
Exception:'User:client@EXAMPLE.COM not allowed to do 'CREATE_KEY' on 'k''
2014-05-02 10:14:13,606 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/keys?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:13,645 Status:UNAUTHORIZED User:client@EXAMPLE.COM Op:CREATE_KEY Name:k
2014-05-02 10:14:13,646 Status:ERROR User:client@EXAMPLE.COM Method:POST URL:http://localhost:65509/kms/v1/keys
Exception:'User:client@EXAMPLE.COM not allowed to do 'CREATE_KEY' on 'k''
2014-05-02 10:14:13,653 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/key/k?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:13,692 Status:UNAUTHORIZED User:client@EXAMPLE.COM Op:ROLL_NEW_VERSION Name:k
2014-05-02 10:14:13,692 Status:ERROR User:client@EXAMPLE.COM Method:POST URL:http://localhost:65509/kms/v1/key/k
Exception:'User:client@EXAMPLE.COM not allowed to do 'ROLL_NEW_VERSION' on 'k''
2014-05-02 10:14:13,699 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/key/k?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:13,739 Status:UNAUTHORIZED User:client@EXAMPLE.COM Op:ROLL_NEW_VERSION Name:k
2014-05-02 10:14:13,739 Status:ERROR User:client@EXAMPLE.COM Method:POST URL:http://localhost:65509/kms/v1/key/k
Exception:'User:client@EXAMPLE.COM not allowed to do 'ROLL_NEW_VERSION' on 'k''
2014-05-02 10:14:13,746 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/keys/names?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:13,781 Status:UNAUTHORIZED User:client@EXAMPLE.COM Op:GET_KEYS Name:*
2014-05-02 10:14:13,781 Status:ERROR User:client@EXAMPLE.COM Method:GET URL:http://localhost:65509/kms/v1/keys/names
Exception:'User:client@EXAMPLE.COM not allowed to do 'GET_KEYS' on '*''
2014-05-02 10:14:13,791 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/keys/metadata?key=k&user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:13,825 Status:UNAUTHORIZED User:client@EXAMPLE.COM Op:GET_KEYS_METADATA Name:k
2014-05-02 10:14:13,826 Status:ERROR User:client@EXAMPLE.COM Method:GET URL:http://localhost:65509/kms/v1/keys/metadata?key=k
Exception:'User:client@EXAMPLE.COM not allowed to do 'GET_KEYS_METADATA' on 'k''
2014-05-02 10:14:13,836 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/keyversion/k%400?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:13,871 Status:UNAUTHORIZED User:client@EXAMPLE.COM Op:GET_KEY_VERSION Name:k@0
2014-05-02 10:14:13,871 Status:ERROR User:client@EXAMPLE.COM Method:GET URL:http://localhost:65509/kms/v1/keyversion/k%400
Exception:'User:client@EXAMPLE.COM not allowed to do 'GET_KEY_VERSION' on 'k@0''
2014-05-02 10:14:13,878 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/key/k/_currentversion?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:13,912 Status:UNAUTHORIZED User:client@EXAMPLE.COM Op:GET_CURRENT_KEY Name:k
2014-05-02 10:14:13,912 Status:ERROR User:client@EXAMPLE.COM Method:GET URL:http://localhost:65509/kms/v1/key/k/_currentversion
Exception:'User:client@EXAMPLE.COM not allowed to do 'GET_CURRENT_KEY' on 'k''
2014-05-02 10:14:13,919 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/key/k/_metadata?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:13,952 Status:UNAUTHORIZED User:client@EXAMPLE.COM Op:GET_METADATA Name:k
2014-05-02 10:14:13,952 Status:ERROR User:client@EXAMPLE.COM Method:GET URL:http://localhost:65509/kms/v1/key/k/_metadata
Exception:'User:client@EXAMPLE.COM not allowed to do 'GET_METADATA' on 'k''
2014-05-02 10:14:13,959 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/key/k/_versions?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:13,991 Status:UNAUTHORIZED User:client@EXAMPLE.COM Op:GET_KEY_VERSIONS Name:k
2014-05-02 10:14:13,992 Status:ERROR User:client@EXAMPLE.COM Method:GET URL:http://localhost:65509/kms/v1/key/k/_versions
Exception:'User:client@EXAMPLE.COM not allowed to do 'GET_KEY_VERSIONS' on 'k''
2014-05-02 10:14:14,010 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/keys?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:14,054 Status:OK User:CREATE@EXAMPLE.COM Op:CREATE_KEY Name:k0UserProvidedMaterial:false
Description:null
2014-05-02 10:14:14,081 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/key/k0?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:14,121 Status:OK User:DELETE@EXAMPLE.COM Op:DELETE_KEY Name:k0
2014-05-02 10:14:14,135 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/keys?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:14,184 Status:OK User:SET_KEY_MATERIAL@EXAMPLE.COM Op:CREATE_KEY Name:k1UserProvidedMaterial:true
Description:null
2014-05-02 10:14:14,210 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/key/k1?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:14,253 Status:OK User:ROLLOVER@EXAMPLE.COM Op:ROLL_NEW_VERSION Name:k1UserProvidedMaterial:false
NewVersion:k1@1
2014-05-02 10:14:14,280 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/key/k1?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:14,323 Status:OK User:SET_KEY_MATERIAL@EXAMPLE.COM Op:ROLL_NEW_VERSION Name:k1UserProvidedMaterial:true
NewVersion:k1@2
2014-05-02 10:14:14,352 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/keyversion/k1%400?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:14,382 Status:OK User:GET@EXAMPLE.COM Op:GET_KEY_VERSION Name:k1@0
2014-05-02 10:14:14,387 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/key/k1/_currentversion?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:14,408 Status:OK User:GET@EXAMPLE.COM Op:GET_CURRENT_KEY Name:k1
2014-05-02 10:14:14,422 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/keys/names?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:14,441 Status:OK User:GET_KEYS@EXAMPLE.COM Op:GET_KEYS Name:*
2014-05-02 10:14:14,461 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/key/k1/_metadata?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:14,480 Status:OK User:GET_METADATA@EXAMPLE.COM Op:GET_METADATA Name:k1
2014-05-02 10:14:14,486 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/keys/metadata?key=k1&user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:14,503 Status:OK User:GET_METADATA@EXAMPLE.COM Op:GET_KEYS_METADATA Name:k1
2014-05-02 10:14:14,586 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:65509/kms/v1/keys?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:14,618 Status:UNAUTHORIZED User:CREATE@EXAMPLE.COM Op:CREATE_KEY Name:k2
2014-05-02 10:14:14,619 Status:ERROR User:CREATE@EXAMPLE.COM Method:POST URL:http://localhost:65509/kms/v1/keys
Exception:'User:CREATE@EXAMPLE.COM not allowed to do 'CREATE_KEY' on 'k2''
2014-05-02 10:14:14,962 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:49200/kms/v1/keys/names?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:14,983 Status:OK User:client@EXAMPLE.COM Op:GET_KEYS Name:*
2014-05-02 10:14:14,996 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:http://localhost:49200/kms/v1/keys/names?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:15,017 Status:OK User:client/host@EXAMPLE.COM Op:GET_KEYS Name:*
2014-05-02 10:14:15,417 Status:OK User:tucu Op:GET_KEYS Name:*
2014-05-02 10:14:15,979 Status:OK User:tucu Op:GET_KEYS Name:*
2014-05-02 10:14:16,388 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:https://localhost:49216/kms/v1/keys/names?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:16,420 Status:OK User:client@EXAMPLE.COM Op:GET_KEYS Name:*
2014-05-02 10:14:16,437 Status:UNAUTHENTICATED RemoteHost:127.0.0.1 Method:OPTIONS URL:https://localhost:49216/kms/v1/keys/names?user.name=tucu
ErrorMsg:'Authentication required'
2014-05-02 10:14:16,466 Status:OK User:client/host@EXAMPLE.COM Op:GET_KEYS Name:*
2014-05-02 10:14:16,774 Status:OK User:tucu Op:GET_KEYS Name:*
2014-05-02 10:14:16,812 Status:OK User:tucu Op:CREATE_KEY Name:k1UserProvidedMaterial:false
Description:l1
2014-05-02 10:14:16,824 Status:OK User:tucu Op:GET_KEY_VERSION Name:k1@0
2014-05-02 10:14:16,834 Status:OK User:tucu Op:GET_CURRENT_KEY Name:k1
2014-05-02 10:14:16,842 Status:OK User:tucu Op:GET_METADATA Name:k1
2014-05-02 10:14:16,852 Status:OK User:tucu Op:GET_KEY_VERSIONS Name:k1
2014-05-02 10:14:16,884 Status:OK User:tucu Op:ROLL_NEW_VERSION Name:k1UserProvidedMaterial:false
NewVersion:k1@1
2014-05-02 10:14:16,895 Status:OK User:tucu Op:GET_KEY_VERSION Name:k1@1
2014-05-02 10:14:16,903 Status:OK User:tucu Op:GET_CURRENT_KEY Name:k1
2014-05-02 10:14:16,913 Status:OK User:tucu Op:GET_KEY_VERSIONS Name:k1
2014-05-02 10:14:16,922 Status:OK User:tucu Op:GET_METADATA Name:k1
2014-05-02 10:14:16,930 Status:OK User:tucu Op:GET_KEYS Name:*
2014-05-02 10:14:16,937 Status:OK User:tucu Op:GET_KEYS_METADATA Name:k1
2014-05-02 10:14:16,962 Status:OK User:tucu Op:DELETE_KEY Name:k1
2014-05-02 10:14:16,969 Status:OK User:tucu Op:GET_KEY_VERSION Name:k1
2014-05-02 10:14:16,978 Status:OK User:tucu Op:GET_KEY_VERSIONS Name:k1
2014-05-02 10:14:16,985 Status:OK User:tucu Op:GET_METADATA Name:k1
2014-05-02 10:14:16,991 Status:OK User:tucu Op:GET_KEYS Name:*
{code}

> Key Management Server based on KeyProvider API
> ----------------------------------------------
>
>                 Key: HADOOP-10433
>                 URL: https://issues.apache.org/jira/browse/HADOOP-10433
>             Project: Hadoop Common
>          Issue Type: Improvement
>          Components: security
>    Affects Versions: 3.0.0
>            Reporter: Alejandro Abdelnur
>            Assignee: Alejandro Abdelnur
>         Attachments: HADOOP-10433.patch, HADOOP-10433.patch, HADOOP-10433.patch, HADOOP-10433.patch,
HADOOP-10433.patch, HADOOP-10433.patch, HADOOP-10433.patch, HADOOP-10433.patch, HADOOP-10433.patch,
HADOOP-10433.patch, HADOOP-10433.patch, HADOOP-10433.patch, HadoopKMSDocsv2.pdf, KMS-doc.pdf
>
>
> (from HDFS-6134 proposal)
> Hadoop KMS is the gateway, for Hadoop and Hadoop clients, to the underlying KMS. It provides
an interface that works with existing Hadoop security components (authenticatication, confidentiality).
> Hadoop KMS will be implemented leveraging the work being done in HADOOP-10141 and HADOOP-10177.
> Hadoop KMS will provide an additional implementation of the Hadoop KeyProvider class.
This implementation will be a client-server implementation.
> The client-server protocol will be secure:
> * Kerberos HTTP SPNEGO (authentication)
> * HTTPS for transport (confidentiality and integrity)
> * Hadoop ACLs (authorization)
> The Hadoop KMS implementation will not provide additional ACL to access encrypted files.
For sophisticated access control requirements, HDFS ACLs (HDFS-4685) should be used.
> Basic key administration will be supported by the Hadoop KMS via the, already available,
Hadoop KeyShell command line tool
> There are minor changes that must be done in Hadoop KeyProvider functionality:
> The KeyProvider contract, and the existing implementations, must be thread-safe
> KeyProvider API should have an API to generate the key material internally
> JavaKeyStoreProvider should use, if present, a password provided via configuration
> KeyProvider Option and Metadata should include a label (for easier cross-referencing)
> To avoid overloading the underlying KeyProvider implementation, the Hadoop KMS will cache
keys using a TTL policy.
> Scalability and High Availability of the Hadoop KMS can achieved by running multiple
instances behind a VIP/Load-Balancer. For High Availability, the underlying KeyProvider implementation
used by the Hadoop KMS must be High Available.



--
This message was sent by Atlassian JIRA
(v6.2#6252)

Mime
View raw message