<configuration>
<property>
<name>hadoop.common.configuration.versionname>
<value>3.0.0value>
<description>version of this configuration filedescription>
property>
<property>
<name>hadoop.tmp.dirname>
<value>/tmp/hadoop-${user.name}value>
<description>A base for other temporary directories.description>
property>
<property>
<name>hadoop.http.filter.initializersname>
<value>org.apache.hadoop.http.lib.StaticUserWebFiltervalue>
<description>A comma separated list of class names. Each class in the list
must extend org.apache.hadoop.http.FilterInitializer. The corresponding
Filter will be initialized. Then, the Filter will be applied to all user
facing jsp and servlet web pages. The ordering of the list defines the
ordering of the filters.description>
property>
<property>
<name>hadoop.security.authorizationname>
<value>falsevalue>
<description>Is service-level authorization enabled?description>
property>
<property>
<name>hadoop.security.instrumentation.requires.adminname>
<value>falsevalue>
<description>
Indicates if administrator ACLs are required to access
instrumentation servlets (JMX, METRICS, CONF, STACKS).
description>
property>
<property>
<name>hadoop.security.authenticationname>
<value>simplevalue>
<description>Possible values are simple (no authentication), and kerberos
description>
property>
<property>
<name>hadoop.security.group.mappingname>
<value>org.apache.hadoop.security.JniBasedUnixGroupsMappingWithFallbackvalue>
<description>
Class for user to group mapping (get groups for a given user) for ACL.
The default implementation,
org.apache.hadoop.security.JniBasedUnixGroupsMappingWithFallback,
will determine if the Java Native Interface (JNI) is available. If JNI is
available the implementation will use the API within hadoop to resolve a
list of groups for a user. If JNI is not available then the shell
implementation, ShellBasedUnixGroupsMapping, is used. This implementation
shells out to the Linux/Unix environment with the
<code>bash -c groupscode> command to resolve a list of groups for a user.
description>
property>
<property>
<name>hadoop.security.dns.interfacename>
<description>
The name of the Network Interface from which the service should determine
its host name for Kerberos login. e.g. eth2. In a multi-homed environment,
the setting can be used to affect the _HOST substitution in the service
Kerberos principal. If this configuration value is not set, the service
will use its default hostname as returned by
InetAddress.getLocalHost().getCanonicalHostName().
Most clusters will not require this setting.
description>
property>
<property>
<name>hadoop.security.dns.nameservername>
<description>
The host name or IP address of the name server (DNS) which a service Node
should use to determine its own host name for Kerberos Login. Requires
hadoop.security.dns.interface.
Most clusters will not require this setting.
description>
property>
<property>
<name>hadoop.security.dns.log-slow-lookups.enabledname>
<value>falsevalue>
<description>
Time name lookups (via SecurityUtil) and log them if they exceed the
configured threshold.
description>
property>
<property>
<name>hadoop.security.dns.log-slow-lookups.threshold.msname>
<value>1000value>
<description>
If slow lookup logging is enabled, this threshold is used to decide if a
lookup is considered slow enough to be logged.
description>
property>
<property>
<name>hadoop.security.groups.cache.secsname>
<value>300value>
<description>
This is the config controlling the validity of the entries in the cache
containing the user->group mapping. When this duration has expired,
then the implementation of the group mapping provider is invoked to get
the groups of the user and then cached back.
description>
property>
<property>
<name>hadoop.security.groups.negative-cache.secsname>
<value>30value>
<description>
Expiration time for entries in the the negative user-to-group mapping
caching, in seconds. This is useful when invalid users are retrying
frequently. It is suggested to set a small value for this expiration, since
a transient error in group lookup could temporarily lock out a legitimate
user.
Set this to zero or negative value to disable negative user-to-group caching.
description>
property>
<property>
<name>hadoop.security.groups.cache.warn.after.msname>
<value>5000value>
<description>
If looking up a single user to group takes longer than this amount of
milliseconds, we will log a warning message.
description>
property>
<property>
<name>hadoop.security.groups.cache.background.reloadname>
<value>falsevalue>
<description>
Whether to reload expired user->group mappings using a background thread
pool. If set to true, a pool of
hadoop.security.groups.cache.background.reload.threads is created to
update the cache in the background.
description>
property>
<property>
<name>hadoop.security.groups.cache.background.reload.threadsname>
<value>3value>
<description>
Only relevant if hadoop.security.groups.cache.background.reload is true.
Controls the number of concurrent background user->group cache entry
refreshes. Pending refresh requests beyond this value are queued and
processed when a thread is free.
description>
property>
<property>
<name>hadoop.security.groups.shell.command.timeoutname>
<value>0svalue>
<description>
Used by the ShellBasedUnixGroupsMapping class, this property controls how
long to wait for the underlying shell command that is run to fetch groups.
Expressed in seconds (e.g. 10s, 1m, etc.), if the running command takes
longer than the value configured, the command is aborted and the groups
resolver would return a result of no groups found. A value of 0s (default)
would mean an infinite wait (i.e. wait until the command exits on its own).
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.connection.timeout.msname>
<value>60000value>
<description>
This property is the connection timeout (in milliseconds) for LDAP
operations. If the LDAP provider doesn't establish a connection within the
specified period, it will abort the connect attempt. Non-positive value
means no LDAP connection timeout is specified in which case it waits for the
connection to establish until the underlying network times out.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.read.timeout.msname>
<value>60000value>
<description>
This property is the read timeout (in milliseconds) for LDAP
operations. If the LDAP provider doesn't get a LDAP response within the
specified period, it will abort the read attempt. Non-positive value
means no read timeout is specified in which case it waits for the response
infinitely.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.num.attemptsname>
<value>3value>
<description>
This property is the number of attempts to be made for LDAP operations.
If this limit is exceeded, LdapGroupsMapping will return an empty
group list.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.num.attempts.before.failovername>
<value>3value>
<description>
This property is the number of attempts to be made for LDAP operations
using a single LDAP instance. If multiple LDAP servers are configured
and this number of failed operations is reached, we will switch to the
next LDAP server. The configuration for the overall number of attempts
will still be respected, failover will thus be performed only if this
property is less than hadoop.security.group.mapping.ldap.num.attempts.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.urlname>
<value>value>
<description>
The URL of the LDAP server(s) to use for resolving user groups when using
the LdapGroupsMapping user to group mapping. Supports configuring multiple
LDAP servers via a comma-separated list.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.sslname>
<value>falsevalue>
<description>
Whether or not to use SSL when connecting to the LDAP server.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.ssl.keystorename>
<value>value>
<description>
File path to the SSL keystore that contains the SSL certificate required
by the LDAP server.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.ssl.keystore.password.filename>
<value>value>
<description>
The path to a file containing the password of the LDAP SSL keystore. If
the password is not configured in credential providers and the property
hadoop.security.group.mapping.ldap.ssl.keystore.password is not set,
LDAPGroupsMapping reads password from the file.
IMPORTANT: This file should be readable only by the Unix user running
the daemons and should be a local file.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.ssl.keystore.passwordname>
<value>value>
<description>
The password of the LDAP SSL keystore. this property name is used as an
alias to get the password from credential providers. If the password can
not be found and hadoop.security.credential.clear-text-fallback is true
LDAPGroupsMapping uses the value of this property for password.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.conversion.rulename>
<value>nonevalue>
<description>
The rule is applied on the group names received from LDAP when
RuleBasedLdapGroupsMapping is configured.
Supported rules are "to_upper", "to_lower" and "none".
to_upper: This will convert all the group names to uppercase.
to_lower: This will convert all the group names to lowercase.
none: This will retain the source formatting, this is default value.
description>
property>
<property>
<name>hadoop.security.credential.clear-text-fallbackname>
<value>truevalue>
<description>
true or false to indicate whether or not to fall back to storing credential
password as clear text. The default value is true. This property only works
when the password can't not be found from credential providers.
description>
property>
<property>
<name>hadoop.security.credential.provider.pathname>
<value>value>
<description>
A comma-separated list of URLs that indicates the type and
location of a list of providers that should be consulted.
description>
property>
<property>
<name>hadoop.security.credstore.java-keystore-provider.password-filename>
<value>value>
<description>
The path to a file containing the custom password for all keystores
that may be configured in the provider path.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.ssl.truststorename>
<value>value>
<description>
File path to the SSL truststore that contains the root certificate used to
sign the LDAP server's certificate. Specify this if the LDAP server's
certificate is not signed by a well known certificate authority.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.ssl.truststore.password.filename>
<value>value>
<description>
The path to a file containing the password of the LDAP SSL truststore.
IMPORTANT: This file should be readable only by the Unix user running
the daemons.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.bind.username>
<value>value>
<description>
The distinguished name of the user to bind as when connecting to the LDAP
server. This may be left blank if the LDAP server supports anonymous binds.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.bind.password.filename>
<value>value>
<description>
The path to a file containing the password of the bind user. If
the password is not configured in credential providers and the property
hadoop.security.group.mapping.ldap.bind.password is not set,
LDAPGroupsMapping reads password from the file.
IMPORTANT: This file should be readable only by the Unix user running
the daemons and should be a local file.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.bind.passwordname>
<value>value>
<description>
The password of the bind user. this property name is used as an
alias to get the password from credential providers. If the password can
not be found and hadoop.security.credential.clear-text-fallback is true
LDAPGroupsMapping uses the value of this property for password.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.basename>
<value>value>
<description>
The search base for the LDAP connection. This is a distinguished name,
and will typically be the root of the LDAP directory.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.userbasename>
<value>value>
<description>
The search base for the LDAP connection for user search query. This is a
distinguished name, and its the root of the LDAP directory for users.
If not set, hadoop.security.group.mapping.ldap.base is used.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.groupbasename>
<value>value>
<description>
The search base for the LDAP connection for group search . This is a
distinguished name, and its the root of the LDAP directory for groups.
If not set, hadoop.security.group.mapping.ldap.base is used.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.search.filter.username>
<value>(&(objectClass=user)(sAMAccountName={0}))value>
<description>
An additional filter to use when searching for LDAP users. The default will
usually be appropriate for Active Directory installations. If connecting to
an LDAP server with a non-AD schema, this should be replaced with
(&(objectClass=inetOrgPerson)(uid={0}). {0} is a special string used to
denote where the username fits into the filter.
If the LDAP server supports posixGroups, Hadoop can enable the feature by
setting the value of this property to "posixAccount" and the value of
the hadoop.security.group.mapping.ldap.search.filter.group property to
"posixGroup".
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.search.filter.groupname>
<value>(objectClass=group)value>
<description>
An additional filter to use when searching for LDAP groups. This should be
changed when resolving groups against a non-Active Directory installation.
See the description of hadoop.security.group.mapping.ldap.search.filter.user
to enable posixGroups support.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.search.attr.memberofname>
<value>value>
<description>
The attribute of the user object that identifies its group objects. By
default, Hadoop makes two LDAP queries per user if this value is empty. If
set, Hadoop will attempt to resolve group names from this attribute,
instead of making the second LDAP query to get group objects. The value
should be 'memberOf' for an MS AD installation.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.search.attr.membername>
<value>membervalue>
<description>
The attribute of the group object that identifies the users that are
members of the group. The default will usually be appropriate for
any LDAP installation.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.search.attr.group.namename>
<value>cnvalue>
<description>
The attribute of the group object that identifies the group name. The
default will usually be appropriate for all LDAP systems.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.search.group.hierarchy.levelsname>
<value>0value>
<description>
The number of levels to go up the group hierarchy when determining
which groups a user is part of. 0 Will represent checking just the
group that the user belongs to. Each additional level will raise the
time it takes to execute a query by at most
hadoop.security.group.mapping.ldap.directory.search.timeout.
The default will usually be appropriate for all LDAP systems.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.posix.attr.uid.namename>
<value>uidNumbervalue>
<description>
The attribute of posixAccount to use when groups for membership.
Mostly useful for schemas wherein groups have memberUids that use an
attribute other than uidNumber.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.posix.attr.gid.namename>
<value>gidNumbervalue>
<description>
The attribute of posixAccount indicating the group id.
description>
property>
<property>
<name>hadoop.security.group.mapping.ldap.directory.search.timeoutname>
<value>10000value>
<description>
The attribute applied to the LDAP SearchControl properties to set a
maximum time limit when searching and awaiting a result.
Set to 0 if infinite wait period is desired.
Default is 10 seconds. Units in milliseconds.
description>
property>
<property>
<name>hadoop.security.group.mapping.providersname>
<value>value>
<description>
Comma separated of names of other providers to provide user to group
mapping. Used by CompositeGroupsMapping.
description>
property>
<property>
<name>hadoop.security.group.mapping.providers.combinedname>
<value>truevalue>
<description>
true or false to indicate whether groups from the providers are combined or
not. The default value is true. If true, then all the providers will be
tried to get groups and all the groups are combined to return as the final
results. Otherwise, providers are tried one by one in the configured list
order, and if any groups are retrieved from any provider, then the groups
will be returned without trying the left ones.
description>
property>
<property>
<name>hadoop.security.service.user.name.keyname>
<value>value>
<description>
For those cases where the same RPC protocol is implemented by multiple
servers, this configuration is required for specifying the principal
name to use for the service when the client wishes to make an RPC call.
description>
property>
<property>
<name>fs.azure.user.agent.prefixname>
<value>unknownvalue>
<description>
WASB passes User-Agent header to the Azure back-end. The default value
contains WASB version, Java Runtime version, Azure Client library version,
and the value of the configuration option fs.azure.user.agent.prefix.
description>
property>
<property>
<name>hadoop.security.uid.cache.secsname>
<value>14400value>
<description>
This is the config controlling the validity of the entries in the cache
containing the userId to userName and groupId to groupName used by
NativeIO getFstat().
description>
property>
<property>
<name>hadoop.service.shutdown.timeoutname>
<value>30svalue>
<description>
Timeout to wait for each shutdown operation to complete.
If a hook takes longer than this time to complete, it will be interrupted,
so the service will shutdown. This allows the service shutdown
to recover from a blocked operation.
Some shutdown hooks may need more time than this, for example when
a large amount of data needs to be uploaded to an object store.
In this situation: increase the timeout.
The minimum duration of the timeout is 1 second, "1s".
description>
property>
<property>
<name>hadoop.rpc.protectionname>
<value>authenticationvalue>
<description>A comma-separated list of protection values for secured sasl
connections. Possible values are authentication, integrity and privacy.
authentication means authentication only and no integrity or privacy;
integrity implies authentication and integrity are enabled; and privacy
implies all of authentication, integrity and privacy are enabled.
hadoop.security.saslproperties.resolver.class can be used to override
the hadoop.rpc.protection for a connection at the server side.
description>
property>
<property>
<name>hadoop.security.saslproperties.resolver.classname>
<value>value>
<description>SaslPropertiesResolver used to resolve the QOP used for a
connection. If not specified, the full set of values specified in
hadoop.rpc.protection is used while determining the QOP used for the
connection. If a class is specified, then the QOP values returned by
the class will be used while determining the QOP used for the connection.
description>
property>
<property>
<name>hadoop.security.sensitive-config-keysname>
<value>
secret$
password$
ssl.keystore.pass$
fs.s3a.server-side-encryption.key
fs.s3a.*.server-side-encryption.key
fs.s3a.secret.key
fs.s3a.*.secret.key
fs.s3a.session.key
fs.s3a.*.session.key
fs.s3a.session.token
fs.s3a.*.session.token
fs.azure.account.key.*
fs.azure.oauth2.*
fs.adl.oauth2.*
credential$
oauth.*token$
hadoop.security.sensitive-config-keys
value>
<description>A comma-separated or multi-line list of regular expressions to
match configuration keys that should be redacted where appropriate, for
example, when logging modified properties during a reconfiguration,
private credentials should not be logged.
description>
property>
<property>
<name>hadoop.workaround.non.threadsafe.getpwuidname>
<value>truevalue>
<description>Some operating systems or authentication modules are known to
have broken implementations of getpwuid_r and getpwgid_r, such that these
calls are not thread-safe. Symptoms of this problem include JVM crashes
with a stack trace inside these functions. If your system exhibits this
issue, enable this configuration parameter to include a lock around the
calls as a workaround.
An incomplete list of some systems known to have this issue is available
at http://wiki.apache.org/hadoop/KnownBrokenPwuidImplementations
description>
property>
<property>
<name>hadoop.kerberos.kinit.commandname>
<value>kinitvalue>
<description>Used to periodically renew Kerberos credentials when provided
to Hadoop. The default setting assumes that kinit is in the PATH of users
running the Hadoop client. Change this to the absolute path to kinit if this
is not the case.
description>
property>
<property>
<name>hadoop.kerberos.min.seconds.before.reloginname>
<value>60value>
<description>The minimum time between relogin attempts for Kerberos, in
seconds.
description>
property>
<property>
<name>hadoop.security.auth_to_localname>
<value>value>
<description>Maps kerberos principals to local user namesdescription>
property>
<property>
<name>hadoop.security.auth_to_local.mechanismname>
<value>hadoopvalue>
