[GitHub] [hadoop] tasanuma commented on a diff in pull request #5480: HADOOP-18666. A whitelist of endpoints to skip Kerberos authentication doesn't work for ResourceManager and Job History Server

["tasanuma (via GitHub)" <gi...@apache.org>]

tasanuma commented on code in PR #5480:
URL: https://github.com/apache/hadoop/pull/5480#discussion_r1142162026


##########
hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServerWithSpnego.java:
##########
@@ -191,6 +193,48 @@ public void testAuthenticationWithProxyUser() throws Exception {
     }
   }
 
+  @Test
+  public void testAuthenticationToAllowList() throws Exception {
+    Configuration spnegoConf = getSpnegoConf(new Configuration());
+    String[] allowList = new String[] {"/jmx", "/prom"};
+    String[] denyList = new String[] {"/conf", "/stacks", "/logLevel"};
+    spnegoConf.set(PREFIX + "kerberos.endpoint.whitelist", String.join(",", allowList));
+    spnegoConf.set("hadoop.prometheus.endpoint.enabled", "true");
+    spnegoConf.set("hadoop.http.filter.initializers",
+        "org.apache.hadoop.security.AuthenticationFilterInitializer");

Review Comment:
   @eubnara Sorry, I have one more request. Could you use constants here?
   ```suggestion
       spnegoConf.set(CommonConfigurationKeysPublic.HADOOP_PROMETHEUS_ENABLED, "true");
       spnegoConf.set(FILTER_INITIALIZER_PROPERTY, AuthenticationFilterInitializer.class.getName());
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org