-
Notifications
You must be signed in to change notification settings - Fork 3.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[opt](kerberos) use ticket cache instead of principal+keytab on BE side #47299
base: master
Are you sure you want to change the base?
Conversation
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
972fb7e
to
8c80cf5
Compare
run buildall |
TPC-H: Total hot run time: 32324 ms
|
TPC-DS: Total hot run time: 192037 ms
|
ClickBench: Total hot run time: 31.23 s
|
run buildall |
TPC-H: Total hot run time: 31973 ms
|
TPC-DS: Total hot run time: 191165 ms
|
ClickBench: Total hot run time: 31.13 s
|
TeamCity be ut coverage result: |
run buildall |
TPC-H: Total hot run time: 32501 ms
|
TPC-DS: Total hot run time: 191616 ms
|
ClickBench: Total hot run time: 30.51 s
|
run buildall |
TPC-H: Total hot run time: 32325 ms
|
TeamCity be ut coverage result: |
TPC-DS: Total hot run time: 196460 ms
|
run buildall |
TPC-H: Total hot run time: 32387 ms
|
TeamCity be ut coverage result: |
TPC-DS: Total hot run time: 192557 ms
|
ClickBench: Total hot run time: 30.87 s
|
run buildall |
1 similar comment
run buildall |
TPC-H: Total hot run time: 32510 ms
|
TPC-DS: Total hot run time: 191703 ms
|
ClickBench: Total hot run time: 31.17 s
|
run buildall |
TPC-H: Total hot run time: 32514 ms
|
TPC-DS: Total hot run time: 191232 ms
|
ClickBench: Total hot run time: 30.8 s
|
TeamCity be ut coverage result: |
run buildall |
TPC-H: Total hot run time: 32396 ms
|
TPC-DS: Total hot run time: 192003 ms
|
TeamCity be ut coverage result: |
ClickBench: Total hot run time: 30.86 s
|
run external |
run buildall |
TPC-H: Total hot run time: 31640 ms
|
What problem does this PR solve?
Overview
Previously, BE node use principal and keytab to do the kerberos authentication.
But only the modified hadoop libhdfs support authenticating in this way, the origin libhdfs
only support setting kerberos ticket cache path, or use system level kerberos authentication context.
This pull request introduces a comprehensive Kerberos authentication module for the BE.
The module is designed to handle Kerberos ticket management, including initialization, authentication, and periodic ticket refresh.
It provides a robust interface for integrating Kerberos authentication, ensuring secure and efficient credential management.
Key Components
KerberosConfig (
kerberos_config.h
andkerberos_config.cpp
):KerberosTicketCache (
kerberos_ticket_cache.h
andkerberos_ticket_cache.cpp
):/tmp
dir, but can be modified usingkerberos_ccache_path
in be.confKerberosTicketMgr (
kerberos_ticket_mgr.h
andkerberos_ticket_mgr.cpp
):HdfsMgr
HdfsHandlerCache
Mainly Changes
kerberos_krb5_conf_path
in be.conf does not take effect.backend_kerberos_ticket_cache
, to view the krb ticket cache of each backend:Usage
The user interface remains unchanged.
kerberos_krb5_conf_path
, default is/etc/krb5.conf
Configurations
be.conf
kerberos_ccache_path
The dir where kerber ticket cache file saved. the file name as format
doris_krb_xxxx
kerberos_krb5_conf_path
The path of krb5.conf file
kerberos_refresh_interval_second
The min interval to refresh a kerberos ticket cache file. default is 1h.
cleanup logic
If the ticket cache is not used for 1 day, it will be deleted.
Release note
None
Check List (For Author)
Test
Behavior changed:
Does this need documentation?
Check List (For Reviewer who merge this PR)