You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "rjgoyln (via GitHub)" <gi...@apache.org> on 2026/10/10 13:22:12 UTC
[PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
rjgoyln opened a new pull request, #11464:
URL: https://github.com/apache/ozone/pull/11464
## What changes were proposed in this pull request?
`BaseHttpServer` never sets a host on `HttpServer2.Builder`, so `_HOST` in the SPNEGO principal is expanded from the first endpoint, which is the bind address. The S3 Gateway secret endpoint reads `ozone.s3g.webadmin.http-bind-host` directly for the same purpose.
A bind host is not the name a keytab was issued for. The IPv6 wildcard that HDDS-16307 made usable gives `HTTP/[0:0:0:0:0:0:0:0]@REALM`, and an interface-specific bind host gives whatever it reverse-resolves to. Only the IPv4 wildcard works today, because `SecurityUtil.getServerPrincipal` special-cases the literal `0.0.0.0`; the JIRA description is inaccurate on that point.
- `BaseHttpServer` passes the builder the host of the advertised HTTP, then HTTPS, address when it is not a wildcard, otherwise the canonical local hostname.
- `S3GatewayWebAdminServer` expands the secret endpoint principal from the same host.
The fallback is what Hadoop already substitutes for `0.0.0.0`, so deployments that leave the `*-address` properties at their `0.0.0.0:<port>` defaults keep their current principal; failing startup on a wildcard bind host instead would have broken exactly that default. OM, SCM and Recon expand `_HOST` for their RPC login from the advertised RPC address, so the secret endpoint was the only other principal built from a listener address.
## What is the link to the Apache JIRA?
https://issues.apache.org/jira/browse/HDDS-16347
## How was this patch tested?
Unit tests in `TestBaseHttpServer` cover the host resolution for unset, wildcard, hostname and IPv6-literal advertised addresses, and the SPNEGO filter's resulting `kerberos.principal` for bind hosts `0.0.0.0`, `::` and `127.0.0.1`; `TestS3GatewayHttpServers` covers the secret endpoint with an IPv6 wildcard bind host. Without the production change the principal assertions fail with `HTTP/<local hostname>@`, `HTTP/[0:0:0:0:0:0:0:0]@`, `HTTP/localhost@` and `HTTP/::@` respectively.
Generated-by: Claude Code (Fable 5.1)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on PR #11464:
URL: https://github.com/apache/ozone/pull/11464#issuecomment-6138241150
> > TestLogLevelEndpointSecure appears to be problematic.
>
> The test passed locally for me.
Sorry, I was wrong. The run passed, but no test was executed, because the PR branch does not have it. After merging `master` into the PR branch locally, the test is indeed failing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "jojochuang (via GitHub)" <gi...@apache.org>.
jojochuang commented on PR #11464:
URL: https://github.com/apache/ozone/pull/11464#issuecomment-6129137059
Doc Jira: https://issues.apache.org/jira/browse/HDDS-16945 (related to HDDS-16347). Doc PR: https://github.com/apache/ozone/pull/11495
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "rjgoyln (via GitHub)" <gi...@apache.org>.
rjgoyln commented on PR #11464:
URL: https://github.com/apache/ozone/pull/11464#issuecomment-6139254549
Thanks for the review, and sorry for the late reply.
`TestLogLevelEndpointSecure` failed because `MiniOzoneCluster` advertises `127.0.0.1`, while the test keytab uses `HTTP/localhost`. Using the IP directly caused a SPNEGO `403`. I fixed this by reverse-resolving IP literals to their canonical hostnames.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #11464:
URL: https://github.com/apache/ozone/pull/11464#discussion_r4237789804
##########
hadoop-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3/TestS3GatewayHttpServers.java:
##########
@@ -46,6 +54,23 @@ class TestS3GatewayHttpServers {
@TempDir
private Path tempDir;
+ /**
+ * Switching {@link UserGroupInformation} to Kerberos reads the default
+ * realm, which the JDK resolves from these properties when there is no
+ * krb5.conf, as in CI.
+ */
+ @BeforeAll
+ static void fakeKerberosRealm() {
+ System.setProperty("java.security.krb5.realm", "EXAMPLE.COM");
+ System.setProperty("java.security.krb5.kdc", "localhost");
+ }
+
+ @AfterAll
+ static void clearKerberosRealm() {
+ System.clearProperty("java.security.krb5.realm");
+ System.clearProperty("java.security.krb5.kdc");
+ }
Review Comment:
These methods mutate JVM-wide Kerberos system properties and then unconditionally clear them. If the test JVM already supplied a `java.security.krb5.realm` or `java.security.krb5.kdc` (or another test changes them concurrently), this class destroys that state and can make later Kerberos tests observe the wrong realm/KDC. Capture the previous values in `@BeforeAll` and restore them in `@AfterAll` instead of always clearing them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "jojochuang (via GitHub)" <gi...@apache.org>.
jojochuang commented on PR #11464:
URL: https://github.com/apache/ozone/pull/11464#issuecomment-6129121271
Documentation follow-up for this change is in progress: https://github.com/apache/ozone/pull/11479 is unrelated; the SPNEGO `_HOST` doc update is on branch `HDDS-16347-spnego-doc` (PR link will be posted when open).
Please add a short pointer in the HDDS-16347 Jira (or the doc PR) so operators know to set `*-http-address` / `*-https-address` to the keytab hostname, not the bind host—especially for IPv6 `::` bind.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on PR #11464:
URL: https://github.com/apache/ozone/pull/11464#issuecomment-6153840285
Thanks @rjgoyln for the patch. Thanks @jojochuang @adoroszlai for the reviews.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "jojochuang (via GitHub)" <gi...@apache.org>.
jojochuang commented on PR #11464:
URL: https://github.com/apache/ozone/pull/11464#issuecomment-6129167748
Operator doc PR (HDDS-16945): https://github.com/apache/ozone-site/pull/569 — updates the [Kerberos SPNEGO page](https://ozone.apache.org/docs/next/administrator-guide/configuration/security/https/). Closed incorrect apache/ozone#11495.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl merged PR #11464:
URL: https://github.com/apache/ozone/pull/11464
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "rjgoyln (via GitHub)" <gi...@apache.org>.
rjgoyln commented on PR #11464:
URL: https://github.com/apache/ozone/pull/11464#issuecomment-6143490035
> @rjgoyln have you had a chance to take a look at re-enabling workflows?
Thanks for the heads-up! I've re-enabled the workflows, so this should be resolved now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on PR #11464:
URL: https://github.com/apache/ozone/pull/11464#issuecomment-6141466735
> Please re-enable the [`build-branch`](https://github.com/rjgoyln/ozone/actions/workflows/post-commit.yml) workflow in your fork. I guess you can disable [`scheduled-label-pr`](https://github.com/rjgoyln/ozone/actions/workflows/schedule-label-pr.yml) and [`close-stale-prs`](https://github.com/rjgoyln/ozone/actions/workflows/close-stale-prs.yaml) to save some runner minutes.
@rjgoyln have you had a chance to take a look at re-enabling workflows? GitHub [says](https://github.com/rjgoyln/ozone/actions):
"Workflows are not currently being run on this fork due to the scale of GitHub Actions usage. A repository maintainer can choose to re-enable these." I've seen this happen to multiple forks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "jojochuang (via GitHub)" <gi...@apache.org>.
jojochuang commented on PR #11464:
URL: https://github.com/apache/ozone/pull/11464#issuecomment-6131829226
TestLogLevelEndpointSecure appears to be problematic.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on PR #11464:
URL: https://github.com/apache/ozone/pull/11464#issuecomment-6134329873
> TestLogLevelEndpointSecure appears to be problematic.
The test passed locally for me. I have just launched `flaky-test-check` for both `master` and this PR branch to get more data points. Will post the results.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "jojochuang (via GitHub)" <gi...@apache.org>.
jojochuang commented on code in PR #11464:
URL: https://github.com/apache/ozone/pull/11464#discussion_r4250651813
##########
hadoop-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3/TestS3GatewayHttpServers.java:
##########
@@ -46,6 +54,23 @@ class TestS3GatewayHttpServers {
@TempDir
private Path tempDir;
+ /**
+ * Switching {@link UserGroupInformation} to Kerberos reads the default
+ * realm, which the JDK resolves from these properties when there is no
+ * krb5.conf, as in CI.
+ */
+ @BeforeAll
+ static void fakeKerberosRealm() {
+ System.setProperty("java.security.krb5.realm", "EXAMPLE.COM");
+ System.setProperty("java.security.krb5.kdc", "localhost");
+ }
+
+ @AfterAll
+ static void clearKerberosRealm() {
+ System.clearProperty("java.security.krb5.realm");
+ System.clearProperty("java.security.krb5.kdc");
+ }
Review Comment:
good catch.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "jojochuang (via GitHub)" <gi...@apache.org>.
jojochuang commented on PR #11464:
URL: https://github.com/apache/ozone/pull/11464#issuecomment-6129122460
Correction: doc follow-up for HDDS-16347 is https://github.com/apache/ozone/pull/11495 (updates SecuringOzoneHTTP.md: `_HOST` comes from advertised `*-address`, not `*-bind-host`). Please link that doc PR from HDDS-16347 when convenient.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16347. Stop expanding _HOST to the bind host in HTTP SPNEGO principals [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on PR #11464:
URL: https://github.com/apache/ozone/pull/11464#issuecomment-6134129027
Thanks @rjgoyln for the patch. Please re-enable the [`build-branch`](https://github.com/rjgoyln/ozone/actions/workflows/post-commit.yml) workflow in your fork. I guess you can disable [`scheduled-label-pr`](https://github.com/rjgoyln/ozone/actions/workflows/schedule-label-pr.yml) and [`close-stale-prs`](https://github.com/rjgoyln/ozone/actions/workflows/close-stale-prs.yaml) to save some runner minutes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org