You are viewing a plain text version of this content. The canonical link for it is here.
Posted to hdfs-issues@hadoop.apache.org by "Owen O'Malley (JIRA)" <ji...@apache.org> on 2012/05/25 23:55:23 UTC
[jira] [Created] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Owen O'Malley created HDFS-3466:
-----------------------------------
Summary: The SPNEGO filter for the NameNode should come out of the web keytab file
Key: HDFS-3466
URL: https://issues.apache.org/jira/browse/HDFS-3466
Project: Hadoop HDFS
Issue Type: Bug
Components: name-node, security
Affects Versions: 2.0.0-alpha, 1.1.0
Reporter: Owen O'Malley
Assignee: Owen O'Malley
Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Owen O'Malley (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Owen O'Malley updated HDFS-3466:
--------------------------------
Resolution: Fixed
Fix Version/s: 2.1.0-alpha
1.1.0
Status: Resolved (was: Patch Available)
I just committed this.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Fix For: 1.1.0, 2.1.0-alpha
>
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch, hdfs-3466-trunk-3.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Hudson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13446471#comment-13446471 ]
Hudson commented on HDFS-3466:
------------------------------
Integrated in Hadoop-Common-trunk-Commit #2669 (See [https://builds.apache.org/job/Hadoop-Common-trunk-Commit/2669/])
HDFS-3466. Get HTTP kerberos principal from the web authentication keytab.
(omalley) (Revision 1379646)
Result = SUCCESS
omalley : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1379646
Files :
* /hadoop/common/trunk/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
* /hadoop/common/trunk/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/NameNodeHttpServer.java
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Fix For: 1.1.0, 2.1.0-alpha
>
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch, hdfs-3466-trunk-3.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Hadoop QA (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13283825#comment-13283825 ]
Hadoop QA commented on HDFS-3466:
---------------------------------
-1 overall. Here are the results of testing the latest attachment
http://issues.apache.org/jira/secure/attachment/12529807/hdfs-3466-trunk.patch
against trunk revision .
+1 @author. The patch does not contain any @author tags.
-1 tests included. The patch doesn't appear to include any new or modified tests.
Please justify why no new tests are needed for this patch.
Also please list what manual steps were performed to verify this patch.
+1 javac. The applied patch does not increase the total number of javac compiler warnings.
+1 javadoc. The javadoc tool did not generate any warning messages.
+1 eclipse:eclipse. The patch built with eclipse:eclipse.
+1 findbugs. The patch does not introduce any new Findbugs (version 1.3.9) warnings.
+1 release audit. The applied patch does not increase the total number of release audit warnings.
+1 core tests. The patch passed unit tests in hadoop-hdfs-project/hadoop-hdfs.
+1 contrib tests. The patch passed contrib unit tests.
Test results: https://builds.apache.org/job/PreCommit-HDFS-Build/2520//testReport/
Console output: https://builds.apache.org/job/PreCommit-HDFS-Build/2520//console
This message is automatically generated.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Alejandro Abdelnur (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13285248#comment-13285248 ]
Alejandro Abdelnur commented on HDFS-3466:
------------------------------------------
regarding key change, we can deprecate the DFS_WEB_ one
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Aaron T. Myers (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13439713#comment-13439713 ]
Aaron T. Myers commented on HDFS-3466:
--------------------------------------
Nicholas, note that the currently-posted patch does not implement the solution that Owen and I discussed and agreed to.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Aaron T. Myers (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13285155#comment-13285155 ]
Aaron T. Myers commented on HDFS-3466:
--------------------------------------
bq. We need to do this because as soon as you add the same principal do a different keytab, earlier keytabs become invalidated.
That's not necessarily true. It's true by default with MIT kerberos, but it doesn't have to be the case. You can either use the '-norandkey' option when creating the second keytab in kadmin, or you can use ktutil to create a keytab totally offline (i.e. independently of the kadmin server) which contains whatever entries you want from several already-created keytabs.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Owen O'Malley (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Owen O'Malley updated HDFS-3466:
--------------------------------
Attachment: hdfs-3466-trunk.patch
hdfs-3466-b1.patch
This patch changes the config key.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13444678#comment-13444678 ]
Tsz Wo (Nicholas), SZE commented on HDFS-3466:
----------------------------------------------
Aaron, thanks for reminding me. Will wait for Owen's new patches.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Owen O'Malley (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13287847#comment-13287847 ]
Owen O'Malley commented on HDFS-3466:
-------------------------------------
It is good to allow the keytabs that need to be shared between services, such as spnego to be shared. At this point we can't change the name without a very good reason, since it will break compatibility with hadoop-1.0.X. We also need to fix the secondary namenode with exactly the same problem.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Owen O'Malley (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Owen O'Malley updated HDFS-3466:
--------------------------------
Attachment: hdfs-3466-b1-2.patch
Here's a patch that incorporates Eli's feedback.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HDFS-3466:
-----------------------------------------
Hadoop Flags: Reviewed
+1 patch looks good.
I will commit it unless someone still has questions on the patch.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Arpit Gupta (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13285167#comment-13285167 ]
Arpit Gupta commented on HDFS-3466:
-----------------------------------
@Aaron
Thanks for the info. I wil try these out.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Aaron T. Myers (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13287978#comment-13287978 ]
Aaron T. Myers commented on HDFS-3466:
--------------------------------------
It's fine by me to support folks who already have a keytab which contains only the HTTP principal, I just want to make sure we continue to support folks who are used to putting entries for both principals in the same keytab. So, let's make this code first check the config for DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY, and then fall back to using DFS_NAMENODE_KEYTAB_FILE_KEY if that's not set.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Owen O'Malley (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Owen O'Malley updated HDFS-3466:
--------------------------------
Attachment: (was: hdfs-3466-trunk.patch)
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Owen O'Malley (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Owen O'Malley updated HDFS-3466:
--------------------------------
Attachment: (was: hdfs-3466-trunk.patch)
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Hadoop QA (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13443654#comment-13443654 ]
Hadoop QA commented on HDFS-3466:
---------------------------------
-1 overall. Here are the results of testing the latest attachment
http://issues.apache.org/jira/secure/attachment/12542858/hdfs-3466-trunk-2.patch
against trunk revision .
+1 @author. The patch does not contain any @author tags.
-1 tests included. The patch doesn't appear to include any new or modified tests.
Please justify why no new tests are needed for this patch.
Also please list what manual steps were performed to verify this patch.
-1 javac. The patch appears to cause the build to fail.
Console output: https://builds.apache.org/job/PreCommit-HDFS-Build/3116//console
This message is automatically generated.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Aaron T. Myers (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13288020#comment-13288020 ]
Aaron T. Myers commented on HDFS-3466:
--------------------------------------
Sure, that works for me, if you think it's simpler.
Thanks for the understanding, Owen.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Aaron T. Myers (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13446469#comment-13446469 ]
Aaron T. Myers commented on HDFS-3466:
--------------------------------------
Thanks a lot, Owen.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Fix For: 1.1.0, 2.1.0-alpha
>
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch, hdfs-3466-trunk-3.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Owen O'Malley (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13287849#comment-13287849 ]
Owen O'Malley commented on HDFS-3466:
-------------------------------------
To continue on the point, anyone who has a keytab with the HTTP principal in it has been pointing to it using the DFS_WEB_AUTH config setting. There is no motivation for breaking their configs and this patch fixes the problem introduced by HDFS-2617.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Hudson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13446468#comment-13446468 ]
Hudson commented on HDFS-3466:
------------------------------
Integrated in Hadoop-Hdfs-trunk-Commit #2732 (See [https://builds.apache.org/job/Hadoop-Hdfs-trunk-Commit/2732/])
HDFS-3466. Get HTTP kerberos principal from the web authentication keytab.
(omalley) (Revision 1379646)
Result = SUCCESS
omalley : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1379646
Files :
* /hadoop/common/trunk/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
* /hadoop/common/trunk/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/NameNodeHttpServer.java
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Fix For: 1.1.0, 2.1.0-alpha
>
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch, hdfs-3466-trunk-3.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Owen O'Malley (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13288018#comment-13288018 ]
Owen O'Malley commented on HDFS-3466:
-------------------------------------
Can't we take the simpler approach of just making the default value for DFS_WEB_AUTH be DFS_NAMENODE_KEYTAB?
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Arpit Gupta (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13285190#comment-13285190 ]
Arpit Gupta commented on HDFS-3466:
-----------------------------------
@Aaron
I still feel that this flexibility is good to have. The users would have to keep track of if any keytab was generated for a given principal to know when to use the '-norandkey' option. To me this makes it easier to manage keytabs and principals.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Alejandro Abdelnur (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13284995#comment-13284995 ]
Alejandro Abdelnur commented on HDFS-3466:
------------------------------------------
It is an unnecessary flexibility (adding extra complexity) to have 2 keys for a keytab. IMO, we should consolidate both keys in one instead.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Hudson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13446690#comment-13446690 ]
Hudson commented on HDFS-3466:
------------------------------
Integrated in Hadoop-Hdfs-trunk #1152 (See [https://builds.apache.org/job/Hadoop-Hdfs-trunk/1152/])
HDFS-3466. Get HTTP kerberos principal from the web authentication keytab.
(omalley) (Revision 1379646)
Result = SUCCESS
omalley : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1379646
Files :
* /hadoop/common/trunk/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
* /hadoop/common/trunk/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/NameNodeHttpServer.java
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Fix For: 1.1.0, 2.1.0-alpha
>
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch, hdfs-3466-trunk-3.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Owen O'Malley (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Owen O'Malley updated HDFS-3466:
--------------------------------
Attachment: hdfs-3466-trunk.patch
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Aaron T. Myers (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13285186#comment-13285186 ]
Aaron T. Myers commented on HDFS-3466:
--------------------------------------
Happy to help.
If these work for you, would you agree with Tucu's assertion that having the ability to configure multiple keytabs is an unnecessary feature?
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Aaron T. Myers (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13285201#comment-13285201 ]
Aaron T. Myers commented on HDFS-3466:
--------------------------------------
bq. I still feel that this flexibility is good to have. The users would have to keep track of if any keytab was generated for a given principal to know when to use the '-norandkey' option. To me this makes it easier to manage keytabs and principals.
They're still going to have to know to do this even with separate configuration options, since the user might try to export a new keytab for the HTTP/... principal without knowing that they've already done so for a different service. I don't see how having two separate configuration options makes things easier.
----
If we go forward with this, then I think we should not require the two separate configuration options. In the current patch, the user would have to set both DFS_NAMENODE_KEYTAB_FILE_KEY and DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY even if entries for both principals were contained in a single keytab. We should make NameNodeHttpServer try DFS_NAMENODE_KEYTAB_FILE_KEY first, and then fall back on trying DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY if the first one does not contain an entry for the appropriate principal.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Alejandro Abdelnur (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13285197#comment-13285197 ]
Alejandro Abdelnur commented on HDFS-3466:
------------------------------------------
@Arpit, if you want to keep a separate configuration property for SPNEGO keytab, it should not be called DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY but SPNEGO_AUTHENTICATION_KERBEROS_KEYTAB_KEY.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Eli Collins (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13446325#comment-13446325 ]
Eli Collins commented on HDFS-3466:
-----------------------------------
+1 lgtm
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch, hdfs-3466-trunk-3.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Alejandro Abdelnur (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13285102#comment-13285102 ]
Alejandro Abdelnur commented on HDFS-3466:
------------------------------------------
Also, it does not seem correct using the webhdfs property key for NN checkpoint configuration.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Owen O'Malley (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Owen O'Malley updated HDFS-3466:
--------------------------------
Attachment: hdfs-3466-trunk-3.patch
Thanks, for the catch of the bad merge. Here's the updated patch.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch, hdfs-3466-trunk-3.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Closed] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Arun C Murthy (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Arun C Murthy closed HDFS-3466.
-------------------------------
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Fix For: 1.1.0, 2.0.2-alpha
>
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch, hdfs-3466-trunk-3.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Hadoop QA (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13446300#comment-13446300 ]
Hadoop QA commented on HDFS-3466:
---------------------------------
-1 overall. Here are the results of testing the latest attachment
http://issues.apache.org/jira/secure/attachment/12543314/hdfs-3466-trunk-3.patch
against trunk revision .
+1 @author. The patch does not contain any @author tags.
-1 tests included. The patch doesn't appear to include any new or modified tests.
Please justify why no new tests are needed for this patch.
Also please list what manual steps were performed to verify this patch.
+1 javac. The applied patch does not increase the total number of javac compiler warnings.
+1 javadoc. The javadoc tool did not generate any warning messages.
+1 eclipse:eclipse. The patch built with eclipse:eclipse.
+1 findbugs. The patch does not introduce any new Findbugs (version 1.3.9) warnings.
+1 release audit. The applied patch does not increase the total number of release audit warnings.
-1 core tests. The patch failed these unit tests in hadoop-hdfs-project/hadoop-hdfs:
org.apache.hadoop.hdfs.TestHftpDelegationToken
+1 contrib tests. The patch passed contrib unit tests.
Test results: https://builds.apache.org/job/PreCommit-HDFS-Build/3133//testReport/
Console output: https://builds.apache.org/job/PreCommit-HDFS-Build/3133//console
This message is automatically generated.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch, hdfs-3466-trunk-3.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Hudson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13446489#comment-13446489 ]
Hudson commented on HDFS-3466:
------------------------------
Integrated in Hadoop-Mapreduce-trunk-Commit #2694 (See [https://builds.apache.org/job/Hadoop-Mapreduce-trunk-Commit/2694/])
HDFS-3466. Get HTTP kerberos principal from the web authentication keytab.
(omalley) (Revision 1379646)
Result = FAILURE
omalley : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1379646
Files :
* /hadoop/common/trunk/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
* /hadoop/common/trunk/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/NameNodeHttpServer.java
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Fix For: 1.1.0, 2.1.0-alpha
>
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch, hdfs-3466-trunk-3.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Owen O'Malley (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Owen O'Malley updated HDFS-3466:
--------------------------------
Attachment: hdfs-3466-trunk-2.patch
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Aaron T. Myers (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13285290#comment-13285290 ]
Aaron T. Myers commented on HDFS-3466:
--------------------------------------
bq. The reason i think it will be easier is because if there is a separate file for HTTP principal for a give host, even if you regenerate the keytab for that host the latest keytab will still be valid for that host so the user would not have to know.
But they'd have to know the location(s) where the old (now invalid) keytab was, and be sure to replace it with the new one. My point is that, either way, the user is going to have to know that they've already exported a keytab for a given principal. No way around that.
bq. Regarding whether to change the keyname as @Alejandro suggested or fall back if the key is not found this got changed when HDFS-2617 was committed. Before that trunk used DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY key for the keytab for the HTTP principal. Branch 1.0 still uses the same key. So the users that are already using webhdfs on a secure cluster will have to change their configs if we change the config keys.
Whether we change the config key is orthogonal to whether or not we check multiple configuration keys to find the keytab. The concern I have is that those users who _don't_ use WebHDFS shouldn't have to set multiple keytab location config options if their principals are in a single keytab.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Hudson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13446718#comment-13446718 ]
Hudson commented on HDFS-3466:
------------------------------
Integrated in Hadoop-Mapreduce-trunk #1183 (See [https://builds.apache.org/job/Hadoop-Mapreduce-trunk/1183/])
HDFS-3466. Get HTTP kerberos principal from the web authentication keytab.
(omalley) (Revision 1379646)
Result = SUCCESS
omalley : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1379646
Files :
* /hadoop/common/trunk/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
* /hadoop/common/trunk/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/NameNodeHttpServer.java
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Fix For: 1.1.0, 2.1.0-alpha
>
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch, hdfs-3466-trunk-3.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Eli Collins (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13443810#comment-13443810 ]
Eli Collins commented on HDFS-3466:
-----------------------------------
Hey Owen, I think you meant to remove the 2nd initialization of httpKeytab.
{code}
+ String httpKeytab = conf.get(
+ DFSConfigKeys.DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY);
+ if (httpKeytab == null) {
+ httpKeytab = conf.get(DFSConfigKeys.DFS_NAMENODE_KEYTAB_FILE_KEY);
+ }
String httpKeytab = conf
.get(DFSConfigKeys.DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY);
{code}
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Arpit Gupta (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13285230#comment-13285230 ]
Arpit Gupta commented on HDFS-3466:
-----------------------------------
@Aaron
The reason i think it will be easier is because if there is a separate file for HTTP principal for a give host, even if you regenerate the keytab for that host the latest keytab will still be valid for that host so the user would not have to know.
Regarding whether to change the keyname as @Alejandro suggested or fall back if the key is not found this got changed when HDFS-2617 was committed. Before that trunk used DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY key for the keytab for the HTTP principal. Branch 1.0 still uses the same key. So the users that are already using webhdfs on a secure cluster will have to change their configs if we change the config keys.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Hadoop QA (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13443645#comment-13443645 ]
Hadoop QA commented on HDFS-3466:
---------------------------------
-1 overall. Here are the results of testing the latest attachment
http://issues.apache.org/jira/secure/attachment/12542858/hdfs-3466-trunk-2.patch
against trunk revision .
+1 @author. The patch does not contain any @author tags.
-1 tests included. The patch doesn't appear to include any new or modified tests.
Please justify why no new tests are needed for this patch.
Also please list what manual steps were performed to verify this patch.
-1 javac. The patch appears to cause the build to fail.
Console output: https://builds.apache.org/job/PreCommit-HDFS-Build/3115//console
This message is automatically generated.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1-2.patch, hdfs-3466-b1.patch, hdfs-3466-trunk-2.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Owen O'Malley (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Owen O'Malley updated HDFS-3466:
--------------------------------
Status: Patch Available (was: Open)
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 2.0.0-alpha, 1.1.0
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HDFS-3466) The SPNEGO filter for the NameNode
should come out of the web keytab file
Posted by "Arpit Gupta (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13285147#comment-13285147 ]
Arpit Gupta commented on HDFS-3466:
-----------------------------------
{quote}
It is an unnecessary flexibility (adding extra complexity) to have 2 keys for a keytab. IMO, we should consolidate both keys in one instead.
{quote}
Multiple keytabs are needed when you have multiple services needing access to HTTP principal. For example if oozie will run on the same node as the namenode, then rather than sharing one keytab that has hdfs, oozie and HTTP principals in one keytab you can create a different keytab which just has HTTP principal.
We need to do this because as soon as you add the same principal do a different keytab, earlier keytabs become invalidated.
> The SPNEGO filter for the NameNode should come out of the web keytab file
> -------------------------------------------------------------------------
>
> Key: HDFS-3466
> URL: https://issues.apache.org/jira/browse/HDFS-3466
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: name-node, security
> Affects Versions: 1.1.0, 2.0.0-alpha
> Reporter: Owen O'Malley
> Assignee: Owen O'Malley
> Attachments: hdfs-3466-b1.patch, hdfs-3466-trunk.patch
>
>
> Currently, the spnego filter uses the DFS_NAMENODE_KEYTAB_FILE_KEY to find the keytab. It should use the DFS_WEB_AUTHENTICATION_KERBEROS_KEYTAB_KEY to do it.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira