You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ozone.apache.org by we...@apache.org on 2026/10/12 19:15:35 UTC
(ozone-site) branch master updated: HDDS-16759. Document that DB checkpoint endpoints are not authenticated without SPNEGO (#567)
This is an automated email from the ASF dual-hosted git repository.
jojochuang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ozone-site.git
The following commit(s) were added to refs/heads/master by this push:
new 09010675cf HDDS-16759. Document that DB checkpoint endpoints are not authenticated without SPNEGO (#567)
09010675cf is described below
commit 09010675cff0b5e82402321b1a85b0a9704ba255
Author: Siyao Meng <50...@users.noreply.github.com>
AuthorDate: Mon Oct 12 12:15:30 2026 -0700
HDDS-16759. Document that DB checkpoint endpoints are not authenticated without SPNEGO (#567)
Generated-by: Claude Code (Opus 5.5)
---
.../02-configuration/03-security/03-https.md | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/docs/05-administrator-guide/02-configuration/03-security/03-https.md b/docs/05-administrator-guide/02-configuration/03-security/03-https.md
index 6090cc4cbb..06c82d408a 100644
--- a/docs/05-administrator-guide/02-configuration/03-security/03-https.md
+++ b/docs/05-administrator-guide/02-configuration/03-security/03-https.md
@@ -17,6 +17,8 @@ By default Ozone HTTP web-consoles (OM, SCM, S3G, Recon, Datanode) allow access
If you have an SPNEGO enabled Ozone cluster and want to disable it for all Ozone services, just make sure the two key mentioned are configured as above.
+Without SPNEGO a request carries no authenticated identity, so endpoints that are restricted to administrators cannot check the caller. This includes the DB checkpoint endpoints of OM (`/dbCheckpoint`, `/v2/dbCheckpoint`) and SCM (`/dbCheckpoint`), which serve a copy of the service's metadata DB. The OM DB contains the S3 secrets of all users. On a secure cluster, enable SPNEGO for OM and SCM as described below, or restrict network access to their HTTP ports.
+
## Kerberos based SPNEGO authentication
However, they can be configured to require Kerberos authentication using HTTP SPNEGO protocol (supported by browsers like Firefox and Chrome). To achieve that, the following keys must be configured first.
@@ -57,9 +59,9 @@ After that, individual component needs to configure properly to completely enabl
| Property | Value |
|----------|-------|
-| `ozone.scm.http.auth.type` | `kerberos` |
-| `ozone.scm.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` |
-| `ozone.scm.http.auth.kerberos.keytab` | `/path/to/HTTP.keytab` |
+| `hdds.scm.http.auth.type` | `kerberos` |
+| `hdds.scm.http.auth.kerberos.principal` | `HTTP/_HOST@REALM` |
+| `hdds.scm.http.auth.kerberos.keytab` | `/path/to/HTTP.keytab` |
## Enable SPNEGO authentication for Datanode HTTP
@@ -104,8 +106,8 @@ If you don’t want to specify the user.name in the query string parameter, chan
| Property | Value |
|----------|-------|
-| `ozone.scm.http.auth.type` | `simple` |
-| `ozone.scm.http.auth.simple.anonymous.allowed` | `false` |
+| `hdds.scm.http.auth.type` | `simple` |
+| `hdds.scm.http.auth.simple.anonymous.allowed` | `false` |
If you don’t want to specify the user.name in the query string parameter, change `hdds.scm.http.auth.simple.anonymous.allowed` to true.
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@ozone.apache.org
For additional commands, e-mail: commits-help@ozone.apache.org