You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "smengcl (via GitHub)" <gi...@apache.org> on 2026/10/07 18:08:48 UTC
[PR] HDDS-16759. Document that DB checkpoint endpoints are not authenticated without SPNEGO [ozone]
smengcl opened a new pull request, #11439:
URL: https://github.com/apache/ozone/pull/11439
Generated-by: Claude Code (Opus 5.5)
## What changes were proposed in this pull request?
The OM and SCM web servers authenticate requests only when HTTP Kerberos (SPNEGO) is enabled. It is off by default, also when `ozone.security.enabled=true`. The admin check of the DB checkpoint endpoints (OM `/dbCheckpoint` and `/v2/dbCheckpoint`, SCM `/dbCheckpoint`) needs an authenticated caller, so it is applied only with SPNEGO. Neither the docs nor the config descriptions say so.
Documentation only, no behavior change:
- `ozone-default.xml`: the descriptions of `ozone.om.http.auth.type` and `hdds.scm.http.auth.type` now say that `kerberos` takes effect only when `ozone.security.http.kerberos.enabled` is true, and that with `simple` the admin check of `/dbCheckpoint` is not applied.
- `THREAT_MODEL.md`: HTTP authentication is added to the controls that are off by default (section 5a) and to the operator hardening checklist (section 10).
The website page is updated in a separate apache/ozone-site PR under the same Jira.
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-16759
## How was this patch tested?
Documentation only. Checked with `xmllint` that `ozone-default.xml` is still well formed.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16759. Document that DB checkpoint endpoints are not authenticated without SPNEGO [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on code in PR #11439:
URL: https://github.com/apache/ozone/pull/11439#discussion_r4210484152
##########
THREAT_MODEL.md:
##########
@@ -178,9 +178,10 @@ stock install and must be explicitly enabled:
gRPC traffic when enabled.
- **TDE/KMS** is optional and protects data at rest only for encrypted buckets;
it requires a configured KMS, for example via `hadoop.security.key.provider.path`.
+- **HTTP authentication (SPNEGO)** is off by default (`ozone.security.http.kerberos.enabled=false`, and each web server's own type, for example `ozone.om.http.auth.type=simple`). Without it the web endpoints are not authenticated, and the admin check of the OM and SCM DB checkpoint endpoints, which serve the metadata DB, is not applied. *(documented — `ozone-default.xml`.)*
Review Comment:
Reworded in bc6ae866853: the bullet now states what the defaults give (the endpoints are served without an admin check) and no longer ties the check to SPNEGO being in effect. Kept it as one bullet because section 5a lists default states.
_🤖 Addressed by [Claude Code](https://claude.com/claude-code)_
##########
hadoop-hdds/common/src/main/resources/ozone-default.xml:
##########
@@ -3504,6 +3504,8 @@
<tag>OM, SECURITY, KERBEROS</tag>
<description> simple or kerberos. If kerberos is set, SPNEGO
will be used for http authentication.
+ kerberos takes effect only when ozone.security.http.kerberos.enabled is true.
+ With simple, requests are not authenticated, so the admin check of the /dbCheckpoint endpoint is not applied.
Review Comment:
Added `/v2/dbCheckpoint` to the `ozone.om.http.auth.type` description in bc6ae866853. The `hdds.scm.http.auth.type` description is unchanged because SCM serves only `/dbCheckpoint`.
_🤖 Addressed by [Claude Code](https://claude.com/claude-code)_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16759. Document that DB checkpoint endpoints are not authenticated without SPNEGO [ozone]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #11439:
URL: https://github.com/apache/ozone/pull/11439#discussion_r4210352542
##########
THREAT_MODEL.md:
##########
@@ -178,9 +178,10 @@ stock install and must be explicitly enabled:
gRPC traffic when enabled.
- **TDE/KMS** is optional and protects data at rest only for encrypted buckets;
it requires a configured KMS, for example via `hadoop.security.key.provider.path`.
+- **HTTP authentication (SPNEGO)** is off by default (`ozone.security.http.kerberos.enabled=false`, and each web server's own type, for example `ozone.om.http.auth.type=simple`). Without it the web endpoints are not authenticated, and the admin check of the OM and SCM DB checkpoint endpoints, which serve the metadata DB, is not applied. *(documented — `ozone-default.xml`.)*
Review Comment:
This statement does not match the current authorization paths. When authorization is enabled, OM decides whether to apply the administrator allowlist solely from `ozone.om.http.auth.type`, so `kerberos` selects the filter even when global HTTP Kerberos is disabled; SCM passes `false` unconditionally and never selects it. Describe the two services separately instead of asserting that both checks track actual SPNEGO authentication.
##########
hadoop-hdds/common/src/main/resources/ozone-default.xml:
##########
@@ -3504,6 +3504,8 @@
<tag>OM, SECURITY, KERBEROS</tag>
<description> simple or kerberos. If kerberos is set, SPNEGO
will be used for http authentication.
+ kerberos takes effect only when ozone.security.http.kerberos.enabled is true.
+ With simple, requests are not authenticated, so the admin check of the /dbCheckpoint endpoint is not applied.
Review Comment:
The PR explicitly covers both OM checkpoint APIs, and `/v2/dbCheckpoint` initializes the same authorization logic as `/dbCheckpoint`. Include both paths so operators do not assume this warning applies only to the legacy endpoint.
This issue also appears on line 3518 of the same file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16759. Document that DB checkpoint endpoints are not authenticated without SPNEGO [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on PR #11439:
URL: https://github.com/apache/ozone/pull/11439#issuecomment-6088755289
Thanks @smengcl for the patch.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16759. Document that DB checkpoint endpoints are not authenticated without SPNEGO [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai merged PR #11439:
URL: https://github.com/apache/ozone/pull/11439
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16759. Document that DB checkpoint endpoints are not authenticated without SPNEGO [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on PR #11439:
URL: https://github.com/apache/ozone/pull/11439#issuecomment-6089500788
Thanks @adoroszlai for the review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org