Closes #14. Proxy in workload job to use enable permission checking. #18
Conversation
| commandQueue = new DelayQueue<>(); | ||
| Configuration mapperConf = mapperContext.getConfiguration(); | ||
| String namenodeURI = mapperConf.get(WorkloadDriver.NN_URI); | ||
| this.fsCache = fsCache; |
There was a problem hiding this comment.
nit: remove 'this.' to be consistent with the rest?
There was a problem hiding this comment.
The this is necessary to quality fsCache as a field since fsCache is also the name of a parameter.
| @@ -63,6 +64,7 @@ public AuditReplayCommand parse(Text inputLine, Function<Long, Long> relativeToA | |||
| String auditMessageSanitized = m.group(2).replace("(options=", "(options:"); | |||
| Map<String, String> parameterMap = AUDIT_SPLITTER.split(auditMessageSanitized); | |||
| return new AuditReplayCommand(relativeToAbsolute.apply(relativeTimestamp), | |||
| SPACE_SPLITTER.split(parameterMap.get("ugi")).iterator().next(), | |||
There was a problem hiding this comment.
more of a question, does this imply there can be multiple values for ugi, and here we only take the first? I wonder why there can be multiple of them, and why taking just first is enough?
There was a problem hiding this comment.
Sort of. Here are a few example UGI strings:
ugi=user (auth:TOKEN) via user/host@REALM (auth:TOKEN)
ugi=user (auth:KERBEROS)
ugi=user@REALM (auth:TOKEN)
ugi=user/host@REALM (auth:TOKEN)
Taking the first is enough because the second is used if the UGI is proxied; the first user is the effective user which is all we care about.
However this made me realize that this current logic is not sufficient to cover the last two cases. Maybe it would be best to do a regex match for the first character string up until whitespace, /, or @. I will update accordingly.
|
Hey @chen-liang , mind taking another quick look? I added a comment to address your last question about why we split on space for UGI, and also fixed the issue that UGIs like |
|
LGTM, +1 |
xkrogen
force-pushed
the
ekrogen-workload-proxy
branch
from
2e682bd
to
6b5f12c
Compare
No description provided.