You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@knox.apache.org by "Kevin Minder (JIRA)" <ji...@apache.org> on 2014/11/14 16:10:34 UTC
[jira] [Resolved] (KNOX-465) Initial audit record can contain
leftover principal name
[ https://issues.apache.org/jira/browse/KNOX-465?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Kevin Minder resolved KNOX-465.
-------------------------------
Resolution: Fixed
> Initial audit record can contain leftover principal name
> --------------------------------------------------------
>
> Key: KNOX-465
> URL: https://issues.apache.org/jira/browse/KNOX-465
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 0.4.0
> Reporter: Kevin Minder
> Assignee: Kevin Minder
> Priority: Critical
> Fix For: 0.6.0
>
>
> The log fragment below illustrates the case in the second group where 'sam' is logged as the user prior to authentication having occurred.
> {code}
> 14/11/01 17:02:15 ||055eedda-3a2e-4207-9a58-f5317c224397|audit|WEBHDFS|sam|||access|uri|/gateway/sandbox/webhdfs/v1/?op=GETHOMEDIRECTORY|unavailable|
> 14/11/01 17:02:15 ||055eedda-3a2e-4207-9a58-f5317c224397|audit|WEBHDFS|sam|||access|uri|/gateway/sandbox/webhdfs/v1/?op=GETHOMEDIRECTORY|success|Response status: 401
> ...
> 14/11/01 17:03:38 ||ebc09492-dd96-4795-a55f-aad1d3526973|audit|WEBHDFS|sam|||access|uri|/gateway/sandbox/webhdfs/v1/?op=GETHOMEDIRECTORY|unavailable|
> 14/11/01 17:03:38 ||ebc09492-dd96-4795-a55f-aad1d3526973|audit|WEBHDFS|tom|||authentication|uri|/gateway/sandbox/webhdfs/v1/?op=GETHOMEDIRECTORY|success|
> 14/11/01 17:03:38 ||ebc09492-dd96-4795-a55f-aad1d3526973|audit|WEBHDFS|tom|||dispatch|uri|http://localhost:50070/webhdfs/v1/?user.name=tom&op=GETHOMEDIRECTORY|success|Response status: 200
> 14/11/01 17:03:38 ||ebc09492-dd96-4795-a55f-aad1d3526973|audit|WEBHDFS|tom|||access|uri|/gateway/sandbox/webhdfs/v1/?op=GETHOMEDIRECTORY|success|Response status: 200
> {code}
> Due to thread pooling in the container this is difficult to reproduce but using these three curl command in various combinations will eventually do so.
> {code}
> curl -i -k -u tom:tom-password -X GET 'https://localhost:8443/gateway/sandbox/webhdfs/v1/?op=GETHOMEDIRECTORY'
> curl -i -k -u sam:sam-password -X GET 'https://localhost:8443/gateway/sandbox/webhdfs/v1/?op=GETHOMEDIRECTORY'
> curl -i -k -u sam:wrong-password -X GET 'https://localhost:8443/gateway/sandbox/webhdfs/v1/?op=GETHOMEDIRECTORY'
> {code}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)