You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@impala.apache.org by ta...@apache.org on 2017/12/22 15:47:05 UTC
[2/5] impala git commit: KUDU-2198. Allow disregarding system-wide
auth-to-local mapping
KUDU-2198. Allow disregarding system-wide auth-to-local mapping
This adds a workaround for an issue reported on the user mailing list.
Some systems are configured such that the auth_to_local mapping provided
by the krb5 library doesn't work properly for service accounts.
This patch adds a new configuration which allows Kudu to disregard the
system auth_to_local rules and instead just map kerberos principals to
their first component, which is typically the username.
Change-Id: I2e893493f52965ea54d2ceaac83d375285b49486
Reviewed-on: http://gerrit.cloudera.org:8080/8373
Reviewed-by: Alexey Serbin <as...@cloudera.com>
Reviewed-by: Dan Burkert <da...@apache.org>
Tested-by: Kudu Jenkins
Reviewed-on: http://gerrit.cloudera.org:8080/8875
Reviewed-by: Joe McDonnell <jo...@cloudera.com>
Tested-by: Impala Public Jenkins
Project: http://git-wip-us.apache.org/repos/asf/impala/repo
Commit: http://git-wip-us.apache.org/repos/asf/impala/commit/ac9ca569
Tree: http://git-wip-us.apache.org/repos/asf/impala/tree/ac9ca569
Diff: http://git-wip-us.apache.org/repos/asf/impala/diff/ac9ca569
Branch: refs/heads/master
Commit: ac9ca569db3fa2dde5045fa19849d4086db148bf
Parents: f755910
Author: Todd Lipcon <to...@apache.org>
Authored: Tue Oct 24 12:44:23 2017 -0700
Committer: Impala Public Jenkins <im...@gerrit.cloudera.org>
Committed: Thu Dec 21 00:13:42 2017 +0000
----------------------------------------------------------------------
be/src/kudu/security/init.cc | 35 ++++++++++++++++++++++++-----------
1 file changed, 24 insertions(+), 11 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/impala/blob/ac9ca569/be/src/kudu/security/init.cc
----------------------------------------------------------------------
diff --git a/be/src/kudu/security/init.cc b/be/src/kudu/security/init.cc
index cbba8c8..8c448c2 100644
--- a/be/src/kudu/security/init.cc
+++ b/be/src/kudu/security/init.cc
@@ -43,6 +43,22 @@
DECLARE_string(keytab_file);
TAG_FLAG(keytab_file, stable);
+#ifndef __APPLE__
+static constexpr bool kDefaultSystemAuthToLocal = true;
+#else
+// macOS's Heimdal library has a no-op implementation of
+// krb5_aname_to_localname, so instead we just use the simple
+// implementation.
+static constexpr bool kDefaultSystemAuthToLocal = false;
+#endif
+DEFINE_bool_hidden(use_system_auth_to_local, kDefaultSystemAuthToLocal,
+ "When enabled, use the system krb5 library to map Kerberos principal "
+ "names to local (short) usernames. If not enabled, the first component "
+ "of the principal will be used as the short name. For example, "
+ "'kudu/foo.example.com@EXAMPLE' will map to 'kudu'.");
+TAG_FLAG(use_system_auth_to_local, advanced);
+
+
using std::mt19937;
using std::random_device;
using std::string;
@@ -400,18 +416,15 @@ Status MapPrincipalToLocalName(const std::string& principal, std::string* local_
krb5_free_principal(g_krb5_ctx, princ);
});
char buf[1024];
- krb5_error_code rc;
-#ifndef __APPLE__
- rc = krb5_aname_to_localname(g_krb5_ctx, princ, arraysize(buf), buf);
-#else
- // macOS's Heimdal library has a no-op implementation of
- // krb5_aname_to_localname, so instead we fall down to below and grab the
- // first component of the principal.
- rc = KRB5_LNAME_NOTRANS;
-#endif
+ krb5_error_code rc = KRB5_LNAME_NOTRANS;
+ if (FLAGS_use_system_auth_to_local) {
+ rc = krb5_aname_to_localname(g_krb5_ctx, princ, arraysize(buf), buf);
+ }
if (rc == KRB5_LNAME_NOTRANS || rc == KRB5_PLUGIN_NO_HANDLE) {
- // No name mapping specified. We fall back to simply taking the first component
- // of the principal, for compatibility with the default behavior of Hadoop.
+ // No name mapping specified, or krb5-based name mapping is disabled.
+ //
+ // We fall back to simply taking the first component of the principal, for
+ // compatibility with the default behavior of Hadoop.
//
// NOTE: KRB5_PLUGIN_NO_HANDLE isn't typically expected here, but works around
// a bug in SSSD's auth_to_local implementation: https://pagure.io/SSSD/sssd/issue/3459