question service level authorisation in Support Questions

service level authorisation

garunkumar85 — Fri, 29 Jan 2016 02:36:57 GMT

What are the consequencs/ disadvantages setting hadoop.security.authorization to true? why its by default set to false.

Re: service level authorisation

bleonhardi — Fri, 29 Jan 2016 04:35:26 GMT

If you enable it you also need to define ACLs for the different yarn services. I.e. define users and groups that can execute specific tasks. More details can be found here.

https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-common/ServiceLevelAuth.html#Enable_Service_Level_Authorization

Re: service level authorisation

garunkumar85 — Fri, 29 Jan 2016 05:01:33 GMT

users list should be pulled from KDC ?

Re: service level authorisation

garunkumar85 — Fri, 29 Jan 2016 05:02:07 GMT

instead of all users, can we restrict to confined users and the list should be pulled from KDC ?

Re: service level authorisation

bleonhardi — Fri, 29 Jan 2016 18:02:54 GMT

Not sure what you mean with "confined" users and pulled from KDC. Its just the hadoop (linux) users/groups you want to give access to these services. For example if you have a linux group hadoopadmins who should be able to run these services you would specify them. KDC principals are mapped to linux users by Hadoop using the authtolocal rules.

Normally the linux users will come from LDAP/AD but that does not have to be the case.

Re: service level authorisation

garunkumar85 — Sat, 30 Jan 2016 02:28:53 GMT

@Benjamin Leonhardi Thank you Benjamin for your explanation.

Re: service level authorisation

rahulpathak109 — Mon, 04 Apr 2016 20:26:40 GMT

@Benjamin Leonhardi

Can you help me with working demo of enabling service level authorization for yarn.

I have followed the steps in https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-common/ServiceLevelAuth.html#Enable_Service_Level_Authorization but it is not working.

I can run yarn jobs from any user irrespective of the acl settings. I need this in HDP 2.3.4.0 with Ambari 2.2.0