You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Previously, BE node use principal and keytab to do the kerberos authentication.
But only the modified hadoop libhdfs support authenticating in this way, the origin libhdfs
only support setting kerberos ticket cache path, or use system level kerberos authentication context.
This pull request introduces a comprehensive Kerberos authentication module for the BE.
The module is designed to handle Kerberos ticket management, including initialization, authentication, and periodic ticket refresh.
It provides a robust interface for integrating Kerberos authentication, ensuring secure and efficient credential management.
Key Components
KerberosConfig (kerberos_config.h and kerberos_config.cpp):
This class encapsulates the configuration settings required for Kerberos authentication, such as principal, keytab path, and refresh intervals.
Provides methods to set and retrieve configuration parameters.
KerberosTicketCache (kerberos_ticket_cache.h and kerberos_ticket_cache.cpp):
Manages the Kerberos ticket cache, including initialization, login, and periodic refresh of tickets.
Supports operations like writing to the ticket cache and checking if a refresh is needed.
Utilizes a background thread to periodically refresh tickets based on configured intervals.
The default cache file will be written in /tmp dir, but can be modified using kerberos_ccache_path in be.conf
KerberosTicketMgr (kerberos_ticket_mgr.h and kerberos_ticket_mgr.cpp):
Acts as a manager for multiple Kerberos ticket caches, handling their lifecycle, including creation, access, and cleanup.
Provides methods to get or set ticket caches and retrieve cache file paths.
Includes a background thread for cleaning up expired ticket caches. If a cache is longer accessed for a long time, it will be deleted.
Mainly Changes
Introduce a comprehensive kerberos ticket cache management on BE side
Use ticket cache path instead of principal and keytab to do the kerberos authentication of libhdfs.
Fix the issue that kerberos_krb5_conf_path in be.conf does not take effect.
Usage
The user interface remains unchanged.
set krb5.conf path in be.conf kerberos_krb5_conf_path, default is /etc/krb5.conf
provide kerberos principal the keytab path as usual.
Configurations
be.conf
kerberos_ccache_path
The dir where kerber ticket cache file saved. the file name as format doris_krb_xxxx
kerberos_krb5_conf_path
The path of krb5.conf file
kerberos_refresh_interval_second
The min interval to refresh a kerberos ticket cache file. default is 1h.
cleanup logic
If the ticket cache is not used for 1 day, it will be deleted.
Release note
None
Check List (For Author)
Test
Regression test
Unit Test
Manual test (add detailed scripts or steps below)
No need to test or manual test. Explain why:
This is a refactor/code format and no logic has been changed.
morningman
changed the title
[opt](kerberos) use ticket patch instead of keytab
[opt](kerberos) use ticket cache instead of keytab on BE side
Jan 28, 2025
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What problem does this PR solve?
Overview
Previously, BE node use principal and keytab to do the kerberos authentication.
But only the modified hadoop libhdfs support authenticating in this way, the origin libhdfs
only support setting kerberos ticket cache path, or use system level kerberos authentication context.
This pull request introduces a comprehensive Kerberos authentication module for the BE.
The module is designed to handle Kerberos ticket management, including initialization, authentication, and periodic ticket refresh.
It provides a robust interface for integrating Kerberos authentication, ensuring secure and efficient credential management.
Key Components
KerberosConfig (
kerberos_config.h
andkerberos_config.cpp
):KerberosTicketCache (
kerberos_ticket_cache.h
andkerberos_ticket_cache.cpp
):/tmp
dir, but can be modified usingkerberos_ccache_path
in be.confKerberosTicketMgr (
kerberos_ticket_mgr.h
andkerberos_ticket_mgr.cpp
):Mainly Changes
kerberos_krb5_conf_path
in be.conf does not take effect.Usage
The user interface remains unchanged.
kerberos_krb5_conf_path
, default is/etc/krb5.conf
Configurations
be.conf
kerberos_ccache_path
The dir where kerber ticket cache file saved. the file name as format
doris_krb_xxxx
kerberos_krb5_conf_path
The path of krb5.conf file
kerberos_refresh_interval_second
The min interval to refresh a kerberos ticket cache file. default is 1h.
cleanup logic
If the ticket cache is not used for 1 day, it will be deleted.
Release note
None
Check List (For Author)
Test
Behavior changed:
Does this need documentation?
Check List (For Reviewer who merge this PR)