-
Notifications
You must be signed in to change notification settings - Fork 3.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[opt](kerberos) use ticket cache instead of keytab on BE side #47299
base: master
Are you sure you want to change the base?
Conversation
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
7f81d04
to
c084897
Compare
c084897
to
4a84c49
Compare
972fb7e
to
8c80cf5
Compare
run buildall |
TPC-H: Total hot run time: 32324 ms
|
TPC-DS: Total hot run time: 192037 ms
|
ClickBench: Total hot run time: 31.23 s
|
run buildall |
TPC-H: Total hot run time: 31973 ms
|
TPC-DS: Total hot run time: 191165 ms
|
ClickBench: Total hot run time: 31.13 s
|
TeamCity be ut coverage result: |
TPC-H: Total hot run time: 32501 ms
|
TPC-DS: Total hot run time: 191616 ms
|
ClickBench: Total hot run time: 30.51 s
|
run buildall |
TPC-H: Total hot run time: 32325 ms
|
TeamCity be ut coverage result: |
TPC-DS: Total hot run time: 196460 ms
|
ClickBench: Total hot run time: 31.06 s
|
run buildall |
TeamCity be ut coverage result: |
What problem does this PR solve?
Overview
Previously, BE node use principal and keytab to do the kerberos authentication.
But only the modified hadoop libhdfs support authenticating in this way, the origin libhdfs
only support setting kerberos ticket cache path, or use system level kerberos authentication context.
This pull request introduces a comprehensive Kerberos authentication module for the BE.
The module is designed to handle Kerberos ticket management, including initialization, authentication, and periodic ticket refresh.
It provides a robust interface for integrating Kerberos authentication, ensuring secure and efficient credential management.
Key Components
KerberosConfig (
kerberos_config.h
andkerberos_config.cpp
):KerberosTicketCache (
kerberos_ticket_cache.h
andkerberos_ticket_cache.cpp
):/tmp
dir, but can be modified usingkerberos_ccache_path
in be.confKerberosTicketMgr (
kerberos_ticket_mgr.h
andkerberos_ticket_mgr.cpp
):Mainly Changes
kerberos_krb5_conf_path
in be.conf does not take effect.Usage
The user interface remains unchanged.
kerberos_krb5_conf_path
, default is/etc/krb5.conf
Configurations
be.conf
kerberos_ccache_path
The dir where kerber ticket cache file saved. the file name as format
doris_krb_xxxx
kerberos_krb5_conf_path
The path of krb5.conf file
kerberos_refresh_interval_second
The min interval to refresh a kerberos ticket cache file. default is 1h.
cleanup logic
If the ticket cache is not used for 1 day, it will be deleted.
Release note
None
Check List (For Author)
Test
Behavior changed:
Does this need documentation?
Check List (For Reviewer who merge this PR)