Securing Ozone

Kerberos

This release of Ozone follows that model, but soon will move to secure by default. Today to enable security in ozone cluster, we need to set the configuration ozone.security.enabled to true and hadoop.security.authentication to kerberos.

Tokens

Ozone uses a notion of tokens to avoid overburdening the Kerberos server. When you serve thousands of requests per second, involving Kerberos might not work well. Hence once an authentication is done, Ozone issues delegation tokens and block tokens to the clients. These tokens allow applications to do specified operations against the cluster, as if they have kerberos tickets with them. Ozone supports following kinds of tokens.

Delegation tokens allow an application to impersonate a users kerberos credentials. This token is based on verification of kerberos identity and is issued by the Ozone Manager. Delegation tokens are enabled by default when security is enabled.

Block Token

S3 uses a very different shared secret security scheme. Ozone supports the AWS Signature Version 4 protocol, and from the end users perspective Ozone’s S3 feels exactly like AWS S3.

The S3 credential tokens are called S3 auth info in the code. These tokens are also enabled by default when security is enabled.

Each of the service daemons that make up Ozone needs a Kerberos service principal name and a corresponding file.

Storage Container Manager

SCM requires two Kerberos principals, and the corresponding key tab files for both of these principals.

Like SCM, OM also requires two Kerberos principals, and the corresponding key tab files for both of these principals.

S3 Gateway

S3 gateway requires one service principal and here the configuration values needed in the ozone-site.xml.