Closes #14. Proxy in workload job to use enable permission checking.#18
Conversation
chliang71
left a comment
chliang71
left a comment
There was a problem hiding this comment.
LGTM, only some minor nits
| commandQueue = new DelayQueue<>(); | ||
| Configuration mapperConf = mapperContext.getConfiguration(); | ||
| String namenodeURI = mapperConf.get(WorkloadDriver.NN_URI); | ||
| this.fsCache = fsCache; |
There was a problem hiding this comment.
nit: remove 'this.' to be consistent with the rest?
There was a problem hiding this comment.
The this is necessary to quality fsCache as a field since fsCache is also the name of a parameter.
| String auditMessageSanitized = m.group(2).replace("(options=", "(options:"); | ||
| Map<String, String> parameterMap = AUDIT_SPLITTER.split(auditMessageSanitized); | ||
| return new AuditReplayCommand(relativeToAbsolute.apply(relativeTimestamp), | ||
| SPACE_SPLITTER.split(parameterMap.get("ugi")).iterator().next(), |
There was a problem hiding this comment.
more of a question, does this imply there can be multiple values for ugi, and here we only take the first? I wonder why there can be multiple of them, and why taking just first is enough?
There was a problem hiding this comment.
Sort of. Here are a few example UGI strings:
ugi=user (auth:TOKEN) via user/host@REALM (auth:TOKEN)
ugi=user (auth:KERBEROS)
ugi=user@REALM (auth:TOKEN)
ugi=user/host@REALM (auth:TOKEN)
Taking the first is enough because the second is used if the UGI is proxied; the first user is the effective user which is all we care about.
However this made me realize that this current logic is not sufficient to cover the last two cases. Maybe it would be best to do a regex match for the first character string up until whitespace, /, or @. I will update accordingly.
|
Hey @chen-liang , mind taking another quick look? I added a comment to address your last question about why we split on space for UGI, and also fixed the issue that UGIs like |
|
LGTM, +1 |
xkrogen
force-pushed
the
ekrogen-workload-proxy
branch
from
2e682bd to
6b5f12c
Compare
2 participants
No description provided.