You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@celeborn.apache.org by "senthh (via GitHub)" <gi...@apache.org> on 2026/10/09 10:47:42 UTC
[PR] CELEBORN-9999: Send WWW-Authenticate challenge when no auth header present [celeborn]
senthh opened a new pull request, #3863:
URL: https://github.com/apache/celeborn/pull/3863
## Description
When the HTTP authentication filter receives a request with no Authorization header (e.g. the first request in a SPNEGO/Kerberos handshake), it currently returns a bare 401 response without any WWW-Authenticate header. This prevents SPNEGO-authenticated clients (such as curl --negotiate) from receiving the challenge and initiating the Kerberos handshake.
## Changes
1. **AuthenticationFilter.scala**: When no Authorization header is present but auth handlers are configured, the filter now sends WWW-Authenticate headers listing all registered auth schemes in the 401 response. If an Authorization header is present but doesn't match any handler, the original error message is preserved.
2. **CelebornConf.scala**: Fixed the documentation for `celeborn.master.http.auth.supportedSchemes` and `celeborn.worker.http.auth.supportedSchemes` which incorrectly listed the value as 'SPNEGO' instead of the correct enumeration value 'NEGOTIATE'.
## Testing
Verified with curl --negotiate against a Celeborn server configured with:
- celeborn.master.http.auth.supportedSchemes NEGOTIATE
- celeborn.master.http.spnego.keytab /path/to/keytab
- celeborn.master.http.spnego.principal HTTP/host@REALM
Before: 401 without WWW-Authenticate header, curl never sends token
After: 401 with WWW-Authenticate: NEGOTIATE, curl completes SPNEGO handshake, returns 200
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-2474] Send WWW-Authenticate challenge when no auth header present [celeborn]
Posted by "senthh (via GitHub)" <gi...@apache.org>.
senthh commented on PR #3863:
URL: https://github.com/apache/celeborn/pull/3863#issuecomment-6117891275
Good point — thanks. Addressed.
- Added `HttpAuthUtils.BASIC_AUTH_REALM = "Celeborn"` and a `challengeHeaderValue(scheme)` helper that emits `Basic realm="Celeborn"` for BASIC (RFC 7617) and the bare token for other schemes.
- The new no-Authorization-header challenge path now uses it (one `WWW-Authenticate` per registered scheme, Basic with realm).
- Also updated the pre-existing bare challenge in `BasicAuthenticationHandler.authenticate()` (when decoded credentials are incomplete) to use the same realm, so both paths are consistent, as you suggested.
- Added regression tests (in `ApiBaseResourceAuthenticationSuite`): no-Authorization-header request → 401 with `Basic realm="Celeborn"` and `BEARER` challenges; and an unmatched-scheme header → stays 401.
All new code passes `spotless:check` and `service` test-compile. Pushed to the PR branch.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-2474] Send WWW-Authenticate challenge when no auth header present [celeborn]
Posted by "RexXiong (via GitHub)" <gi...@apache.org>.
RexXiong closed pull request #3863: [CELEBORN-2474] Send WWW-Authenticate challenge when no auth header present
URL: https://github.com/apache/celeborn/pull/3863
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-2474] Send WWW-Authenticate challenge when no auth header present [celeborn]
Posted by "RexXiong (via GitHub)" <gi...@apache.org>.
RexXiong commented on PR #3863:
URL: https://github.com/apache/celeborn/pull/3863#issuecomment-6126222612
**Merge Summary:**
- merged into main https://github.com/apache/celeborn/commit/9a088699
*Posted by `merge_pr.py`*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-2474] Send WWW-Authenticate challenge when no auth header present [celeborn]
Posted by "senthh (via GitHub)" <gi...@apache.org>.
senthh commented on code in PR #3863:
URL: https://github.com/apache/celeborn/pull/3863#discussion_r4244738010
##########
service/src/main/scala/org/apache/celeborn/server/common/http/authentication/AuthenticationFilter.scala:
##########
@@ -157,10 +157,23 @@ class AuthenticationFilter(conf: CelebornConf, serviceName: String) extends Filt
try {
if (matchedHandler == null) {
logDebug(s"No auth scheme matched for url: ${httpRequest.getRequestURL}")
- httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED)
- httpResponse.sendError(
- HttpServletResponse.SC_UNAUTHORIZED,
- s"No auth scheme matched for $authorization")
+ if (authorization == null || authorization.isEmpty) {
+ // First request with no Authorization header. Send WWW-Authenticate
+ // challenge(s) to initiate auth handshake (e.g. SPNEGO/Kerberos
+ // requires a 401+WWW-Authenticate to start the handshake).
+ authSchemeHandlers.keys.foreach { scheme =>
+ httpResponse.addHeader("WWW-Authenticate", scheme.toString)
Review Comment:
Addressed. Added an automated test for the unauthenticated challenge path in `ApiBaseResourceAuthenticationSuite` (which configures BASIC + BEARER):
- a request with no `Authorization` header returns 401 with one `WWW-Authenticate` header per registered scheme — asserting `Basic realm="Celeborn"` and `BEARER` are present;
- a second test covers the unmatched-`Authorization`-header path, asserting it still returns 401 (nonmatching-header behavior unchanged).
`service` test-compile and `spotless:check` pass. Pushed to the PR branch.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-2474] Send WWW-Authenticate challenge when no auth header present [celeborn]
Posted by "RexXiong (via GitHub)" <gi...@apache.org>.
RexXiong commented on PR #3863:
URL: https://github.com/apache/celeborn/pull/3863#issuecomment-6126232312
Merge into main(v1.0)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-2474] Send WWW-Authenticate challenge when no auth header present [celeborn]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #3863:
URL: https://github.com/apache/celeborn/pull/3863#discussion_r4244295661
##########
service/src/main/scala/org/apache/celeborn/server/common/http/authentication/AuthenticationFilter.scala:
##########
@@ -157,10 +157,23 @@ class AuthenticationFilter(conf: CelebornConf, serviceName: String) extends Filt
try {
if (matchedHandler == null) {
logDebug(s"No auth scheme matched for url: ${httpRequest.getRequestURL}")
- httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED)
- httpResponse.sendError(
- HttpServletResponse.SC_UNAUTHORIZED,
- s"No auth scheme matched for $authorization")
+ if (authorization == null || authorization.isEmpty) {
+ // First request with no Authorization header. Send WWW-Authenticate
+ // challenge(s) to initiate auth handshake (e.g. SPNEGO/Kerberos
+ // requires a 401+WWW-Authenticate to start the handshake).
+ authSchemeHandlers.keys.foreach { scheme =>
+ httpResponse.addHeader("WWW-Authenticate", scheme.toString)
Review Comment:
Please add an automated test for the new unauthenticated challenge path. The existing authentication suite configures multiple schemes but never sends a request without `Authorization`; it should verify the 401 response contains one `WWW-Authenticate` value for every registered scheme, while the nonmatching-header path retains its existing behavior. This handshake bootstrap is the core regression being fixed and is otherwise covered only by the manual curl check.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-2474] Send WWW-Authenticate challenge when no auth header present [celeborn]
Posted by "RexXiong (via GitHub)" <gi...@apache.org>.
RexXiong commented on PR #3863:
URL: https://github.com/apache/celeborn/pull/3863#issuecomment-6116724399
Could we include a realm in the Basic challenge, e.g. `Basic realm="Celeborn"`, instead of emitting only the scheme name for every handler?
RFC 7617 requires a realm for Basic authentication. I verified with Python’s `HTTPBasicAuthHandler` that a bare `WWW-Authenticate: BASIC` results in a 401 without retrying with credentials, while adding the realm allows authentication to proceed.
It would also be helpful to add regression tests for missing/empty Authorization headers and multiple configured schemes.
*AI-assisted review by OpenAI Codex (GPT-6).*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org