Re: Securing Flink Monitoring REST API

2017-09-19 Thread Fabian Hueske
Thanks for the correction and the pointers Eron! Cheers, Fabian 2017-09-18 18:34 GMT+02:00 Eron Wright : > Unfortunately Flink does not yet support SSL mutual authentication nor any > form of client authentication. There is an ongoing discussion about it: > http://apache-flink-mailing-list-arc

Re: Securing Flink Monitoring REST API

2017-09-18 Thread Eron Wright
Unfortunately Flink does not yet support SSL mutual authentication nor any form of client authentication. There is an ongoing discussion about it: http://apache-flink-mailing-list-archive.1008284.n3.nabble.com/DISCUSS-Service-Authorization-redux-td18890.html A workaround that I've seen is to use

Re: Securing Flink Monitoring REST API

2017-09-18 Thread Fabian Hueske
Hi, sorry for the late response. Flink uses Netty for network communication which supports SSL client authentication. I haven't tried it myself, but would think that this should work in Flink as well if you configure the certificates correctly. We should update the docs to cover this aspect. Feed

Re: Securing Flink Monitoring REST API

2017-09-06 Thread avivros
Does jobmanager.web.ssl.enabled supports Client SSL Authentication? -- Sent from: http://apache-flink-user-mailing-list-archive.2336050.n4.nabble.com/

Re: Securing Flink Monitoring REST API

2017-09-04 Thread Fabian Hueske
Hi, you can configure SSL for Flink's network communication [1] (see jobmanager.web.ssl.enabled). However, Flink does not manage different user accounts or allows to grant permissions yet. Best, Fabian [1] https://ci.apache.org/projects/flink/flink-docs-release-1.3/setup/security-ssl.html 2017-

Securing Flink Monitoring REST API

2017-09-04 Thread avivros
What is the best way to secure the Monitoring REST API? I am using the monitoring rest API in a production environment ( starting/stopping jobs, etc...). I should only allow authenticated calls to be executed ( called from a Java sever process ). What's the best way to go about this ( Kerberos? SSL