{"action":"created","issue":{"url":"https://api.github.com/repos/mesosphere/hdfs/issues/229","labels_url":"https://api.github.com/repos/mesosphere/hdfs/issues/229/labels{/name}","comments_url":"https://api.github.com/repos/mesosphere/hdfs/issues/229/comments","events_url":"https://api.github.com/repos/mesosphere/hdfs/issues/229/events","html_url":"https://github.com/mesosphere/hdfs/pull/229","id":115843073,"number":229,"title":"Set principal value when build FrameworkInfo","user":{"login":"BrickXu","id":5711360,"avatar_url":"https://avatars.githubusercontent.com/u/5711360?v=3","gravatar_id":"","url":"https://api.github.com/users/BrickXu","html_url":"https://github.com/BrickXu","followers_url":"https://api.github.com/users/BrickXu/followers","following_url":"https://api.github.com/users/BrickXu/following{/other_user}","gists_url":"https://api.github.com/users/BrickXu/gists{/gist_id}","starred_url":"https://api.github.com/users/BrickXu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BrickXu/subscriptions","organizations_url":"https://api.github.com/users/BrickXu/orgs","repos_url":"https://api.github.com/users/BrickXu/repos","events_url":"https://api.github.com/users/BrickXu/events{/privacy}","received_events_url":"https://api.github.com/users/BrickXu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-11-09T09:57:45Z","updated_at":"2015-11-11T03:44:14Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/mesosphere/hdfs/pulls/229","html_url":"https://github.com/mesosphere/hdfs/pull/229","diff_url":"https://github.com/mesosphere/hdfs/pull/229.diff","patch_url":"https://github.com/mesosphere/hdfs/pull/229.patch"},"body":"Hi guys,\r\n\r\nThis PR depends on #175, to finish some works when mesos cluster enable ACL rules.\r\n\r\nOur mesos cluster set ACL to control the framework register and run tasks, the rules always depends on roles and principal.\r\n\r\nIf we enable framework authentication, hdfs scheduler only set credential for the FrameworkInfo, but not set principal value, it does not work with ACL like this:\r\n\r\n```\r\n# credential\r\nhdfs XXXXXXXXXXXXXXXXXXXXXX\r\n\r\n# acl.json\r\n{\r\n  \"permissive\": false,\r\n  \"register_frameworks\": [\r\n    {\r\n      \"principals\": {\r\n        \"values\": [\r\n          \"hdfs\"\r\n        ]\r\n      },\r\n      \"roles\": {\r\n        \"values\": [\r\n          \"hdfs\"\r\n        ]\r\n      }\r\n    }\r\n  ], \r\n ......\r\n```\r\n\r\nbecause principal always set to \"\" by default.\r\n\r\n```\r\nI1109 15:16:21.603461  5336 authenticator.cpp:92] Creating new server SASL connection\r\nI1109 15:16:21.604151  5340 authenticator.cpp:197] Received SASL authentication start\r\nI1109 15:16:21.604300  5340 authenticator.cpp:319] Authentication requires more steps\r\nI1109 15:16:21.605181  5334 authenticator.cpp:225] Received SASL authentication step\r\nI1109 15:16:21.605299  5334 authenticator.cpp:311] Authentication success\r\nI1109 15:16:21.605419  5334 master.cpp:5168] Successfully authenticated principal 'hdfs' at scheduler-23b07469-9dad-4d32-a432-fe0d3167e4e4@10.90.4.65:54000\r\nI1109 15:16:21.606125  5338 master.cpp:2179] Received SUBSCRIBE call for framework 'HDFS on Mesos' at scheduler-23b07469-9dad-4d32-a432-fe0d3167e4e4@10.90.4.65:54000\r\nW1109 15:16:21.606194  5338 master.cpp:2186] Framework at scheduler-23b07469-9dad-4d32-a432-fe0d3167e4e4@10.90.4.65:54000 (authenticated as 'hdfs') does not set 'principal' in FrameworkInfo\r\nI1109 15:16:21.606400  5338 master.cpp:1642] Authorizing framework principal '' to receive offers for role 'hdfs'\r\nI1109 15:16:21.606530  5338 master.cpp:2226] Refusing subscription of framework 'HDFS on Mesos' at scheduler-23b07469-9dad-4d32-a432-fe0d3167e4e4@10.90.4.65:54000: Not authorized to use role 'hdfs'\r\n\r\n``` \r\n\r\n"},"comment":{"url":"https://api.github.com/repos/mesosphere/hdfs/issues/comments/155653454","html_url":"https://github.com/mesosphere/hdfs/pull/229#issuecomment-155653454","issue_url":"https://api.github.com/repos/mesosphere/hdfs/issues/229","id":155653454,"user":{"login":"BrickXu","id":5711360,"avatar_url":"https://avatars.githubusercontent.com/u/5711360?v=3","gravatar_id":"","url":"https://api.github.com/users/BrickXu","html_url":"https://github.com/BrickXu","followers_url":"https://api.github.com/users/BrickXu/followers","following_url":"https://api.github.com/users/BrickXu/following{/other_user}","gists_url":"https://api.github.com/users/BrickXu/gists{/gist_id}","starred_url":"https://api.github.com/users/BrickXu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BrickXu/subscriptions","organizations_url":"https://api.github.com/users/BrickXu/orgs","repos_url":"https://api.github.com/users/BrickXu/repos","events_url":"https://api.github.com/users/BrickXu/events{/privacy}","received_events_url":"https://api.github.com/users/BrickXu/received_events","type":"User","site_admin":false},"created_at":"2015-11-11T03:44:14Z","updated_at":"2015-11-11T03:44:14Z","body":"I'm not quite sure that use roles to control resource usage limit for each node in the cluster is in your road map."}}