Explains the concept of tickets and their working.
When an authenticated user runs a client, the client uses that user's ticket to communicate securely with the server. After Enabling Wire-level Security, supported communications channels between client and server are encrypted.
Nodes use tickets to identify themselves to one another in order to prevent spoofing, a condition where an untrusted machine presents itself as a trusted machine to gain access to the cluster.
System administrators can use the command line interface to block a user. The command to block invalidates all of a user's tickets. Once a block command is received by the CLDB, the name of the blocked user is sent to all FileServer nodes, which reject any request sent by that user that has a ticket older than the block time stamp. Due to the nature of this check, there is no explicit removal of a blocked user. Issuing a new ticket with a time stamp more recent than the block time stamp implicitly permits the user. To permanently prevent a user from logging in again, revoke the user's credentials in the PAM registry.
A blocked user cannot access the HPE Ezmeral Data Fabric filesystem or the CLDB, but since blocking only revokes a user's existing valid tickets, be aware of the following interactions:
~/.oozie-auth-token, and has no effect on Oozie in general, even
after a restart.