apache / carbondata / 2046

76%

push

jenkins

[CARBONDATA-3512]Index Server enhancement

What changes are proposed

1. Remove the keytab dependency for IndexServer. Currently IndexServer needs to configure keytab and prinicipal for both
Client side and Server Side.But indexServer is super user and having super user's keytab and principal in client is not
correct(specialy spark-submit). Since IndexServer is wrapped around spark application so no need to ask Keytab from User
for IndexServer.

2. Authentication:-This happens in org.apache.hadoop.security.SaslRpcClient#createSaslClient .it checks getServerPrincipal
(spark.carbon.indexserver.principal) and Server protocol (UGI of IndexServer). User need to configure spark.carbon.indexserver.principal
properly.

3. Authorization(ACL):- Support User who can access the IndexServer. Authorization is controlled by hadoop.security.authorization
parameter. IndexServer has below scenarios.
	1. Spark-submit,spark-shell,spark-Sql :-> These type of spark Application has UGI where LoginUser and LoginUser will be same
	either based on kinit or based on spark.yarn.principal. Authorization is done in org.apache.hadoop.ipc.Server#authorize
	using IndexServer ProtocolClass and ACL list which is prepared by org.apache.hadoop.security.authorize.PolicyProvider
	(generally hadoop-policy.xml with key security.indexserver.protocol.acl , by default *).
	2. Spark JDBCServer :- It has UGI based on ProxyUser like user1(auth:PROXY)via spark//. where user1 is currentUser and spark is
	LoginUser (JDBCServer started UGI).This type of Authorization happens in org.apache.hadoop.security.authorize.ProxyUsers#authorize
	with proxyUserAcl list prepared by hadoop.proxyuser.<INDEXSERVER_UGI>.users ,hadoop.proxyuser.<INDEXSERVER_UGI>.hosts ,
	hadoop.proxyuser.<INDEXSERVER_UGI>.groups.

TokenRenewer:- IndexServer is NOT Token based Hadoop Service. It does not required Delegation Token as IndexServer does not connect to
KDC since it is inside SparkApplication(both, Indexclient and IndexServe... (continued)

41 of 41 new or added lines in 4 files covered. (100.0%)

66778 of 84925 relevant lines covered (78.63%)

1.04 hits per line