Toggling
●
When the system is toggled from the default to secure mode, tenants do not have access to any HDFS data
they may have created when the system was in default mode.
●
When the system is toggled from the secure to default mode, tenants no longer have access to any HDFS
they created in secure mode. This is due to the fact they are using different NameNodes in the default or
secure mode.
●
Non-restricted users always communicate with the same NameNode, irrespective of the system mode, so
their data is always available in either mode.
●
The NameNodes are, however, persisted across toggling. Therefore, if a tenant creates data in secure mode
and the system is subsequently toggled into default and again into secure the data is retained.
HDFS Tenancy and Tenant Management
Calling the
ux-tenant-create
command in the default service mode is not supported. When the system is
operating in the secure service mode, the tenant NameNodes are started as part of the
urika-start
command's execution.
Users and Groups
Users and groups are extrinsic to HDFS, meaning that HDFS relies on some external system for user and group
management. A user is identified by the Kerberos principal, which the user presents to the system. For example,
a user with Kerberos principal
johnsmith@local
would be mapped to user
johnsmith
in HDFS.
HDFS provides a number of ways to map users to groups via group mapping providers. The most common
implementations are Unix group mappings and LDAP. Unix group mappings rely on the underlying operating
system to do a group lookup for a given username, whereas LDAP involves configuring HDFS to do an LDAP
query to retrieve group membership for a given user.
Authorization
Authorization to HDFS is controlled via Service Level Authorization (SLA). SLA is controlled via an access control
list (ACL) in the
hadoop-policy.xml
config file. The Urika-GX tenant management process automatically syncs
the ACL with the tenant membership reported by Urika-GX tenant management.
7.6
Authorized User Management
Urika-GX Login Authorization
Once authenticated, a user must be present in the Urika-GX authorized user list to be permitted any mode of
access to the Urika-GX.
NOTE:
Login authentication and basic Linux authorization are setup through normal Linux user management,
either directly on the Urika-GX, in which case users are defined in the Urika-GX local LDAP directory, or
in a site defined user directory. Both of these topics are outside of the scope of this publication.
Users are managed in Urika-GX's authorized user list using the following commands as root on the SMW:
Security
S3016
205
