You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-issues@hadoop.apache.org by "Xiaoyu Yao (JIRA)" <ji...@apache.org> on 2016/12/12 07:30:58 UTC
[jira] [Comment Edited] (HADOOP-13565)
KerberosAuthenticationHandler#authenticate should not rebuild SPN based on
client request
[ https://issues.apache.org/jira/browse/HADOOP-13565?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15741174#comment-15741174 ]
Xiaoyu Yao edited comment on HADOOP-13565 at 12/12/16 7:30 AM:
---------------------------------------------------------------
Looks like a bug in KerberosName parsing where the SPNEGO principal used in these failed tests "HTTP/localhost" (without realm name) can not be parsed correctly. KerberosName returns "HTTP/localhost" as the service name and null hostname and null realm.
I've posted a patch to fix the test SPNEGO principles to include the realm name.
HADOOP-13891 is opened for KerberosName parsing issue.
was (Author: xyao):
Looks like a bug in KerberosName parsing where the SPNEGO principal used in these failed tests "HTTP/localhost" (without realm name) can not be parsed correct.
KerberosName returns "HTTP/localhost" as the service name and null hostname and null realm.
I will post a patch to fix the test SPNEGO principles to include the realm name and open separate ticket for KerberosName parsing issue.
> KerberosAuthenticationHandler#authenticate should not rebuild SPN based on client request
> -----------------------------------------------------------------------------------------
>
> Key: HADOOP-13565
> URL: https://issues.apache.org/jira/browse/HADOOP-13565
> Project: Hadoop Common
> Issue Type: Bug
> Components: security
> Affects Versions: 2.5.0
> Reporter: Xiaoyu Yao
> Assignee: Xiaoyu Yao
> Fix For: 2.8.0, 3.0.0-alpha2
>
> Attachments: HADOOP-13565.00.patch, HADOOP-13565.01.patch, HADOOP-13565.02.patch, HADOOP-13565.03.patch
>
>
> In KerberosAuthenticationHandler#authenticate, we use canonicalized server name derived from HTTP request to build server SPN and authenticate client. This can be problematic if the HTTP client/server are running from a non-local Kerberos realm that the local realm has trust with (e.g., NN UI).
> For example,
> The server is running its HTTP endpoint using SPN from the client realm:
> <name>hadoop.http.authentication.kerberos.principal</name>
> <value>HTTP/_HOST/TEST.COM</value>
> When client sends request to namenode at http://NN1.example.com:50070 from client.test.com@TEST.COM.
> The client talks to KDC first and gets a service ticket HTTP/NN1.example.com/TEST.COM to authenticate with the server via SPNEGO negotiation.
> The authentication will end up with either no valid credential error or checksum failure depending on the HTTP client naming resolution or HTTP Host field from the request header provided by the browser.
> The root cause is KerberosUtil.getServicePrincipal("HTTP", serverName)}} will always return a SPN with local realm (HTTP/NN.example.com@EXAMPLE.COM) no matter the server login SPN is from that domain or not.
> The proposed fix is to change to use default server login principal (by passing null as the 1st parameter to gssManager.createCredential()) instead. This way we avoid dependency on HTTP client behavior (Host header or name resolution like CNAME) or assumption on the local realm.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org