You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@kudu.apache.org by "Anonymous Coward (Code Review)" <ge...@cloudera.org> on 2023/07/28 07:18:27 UTC
[kudu-CR] KUDU-3496 support spnego dedicated keytab
rlagk741@gmail.com has uploaded this change for review. ( http://gerrit.cloudera.org:8080/20278
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
KUDU-3496 support spnego dedicated keytab
Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
---
M src/kudu/security/gssapi.cc
M src/kudu/security/gssapi.h
M src/kudu/security/init.cc
M src/kudu/server/webserver.cc
4 files changed, 17 insertions(+), 1 deletion(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/78/20278/1
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 1
Gerrit-Owner: Anonymous Coward <rl...@gmail.com>
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Zoltan Martonka, Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/20278
to look at the new patch set (#6).
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
KUDU-3496 support spnego dedicated keytab
Add a --spnego_keytab_file flag for seperation of service keytab file
and spnego keytab file. If --webserver_require_spnego flag is true and
--spnego_keytab_file is not empty but specifies a keytab location, web
console gss acceptor registers specified keytab location so that web
server is able to find spnego principal from spnego_keytab_file. if
--spnego_keytab_file is empty even --webserver_require_spnego, web
server will use --keytab_file flag as it is.
Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
---
M src/kudu/security/gssapi.h
M src/kudu/security/init.cc
M src/kudu/security/test/mini_kdc.cc
M src/kudu/security/test/mini_kdc.h
M src/kudu/server/webserver-test.cc
M src/kudu/server/webserver.cc
6 files changed, 86 insertions(+), 1 deletion(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/78/20278/6
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 6
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Attila Bukor (Code Review)" <ge...@cloudera.org>.
Attila Bukor has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 9:
(4 comments)
http://gerrit.cloudera.org:8080/#/c/20278/9/src/kudu/security/init.cc
File src/kudu/security/init.cc:
http://gerrit.cloudera.org:8080/#/c/20278/9/src/kudu/security/init.cc@90
PS9, Line 90: spnego
nit: SPNEGO
http://gerrit.cloudera.org:8080/#/c/20278/9/src/kudu/security/test/mini_kdc.h
File src/kudu/security/test/mini_kdc.h:
http://gerrit.cloudera.org:8080/#/c/20278/9/src/kudu/security/test/mini_kdc.h@95
PS9, Line 95: Status CreateServiceKeytabWithName(const std::string& spn, const std::string& name,
nit: missing doc comment
http://gerrit.cloudera.org:8080/#/c/20278/9/src/kudu/server/webserver-test.cc
File src/kudu/server/webserver-test.cc:
http://gerrit.cloudera.org:8080/#/c/20278/9/src/kudu/server/webserver-test.cc@270
PS9, Line 270: #ifndef __APPLE__
Can you also add a brief summary of why this is ignored (similar to the one in negotiation-test)? It would make it easier to understand without having to leave the editor/IDE.
http://gerrit.cloudera.org:8080/#/c/20278/9/src/kudu/server/webserver.cc
File src/kudu/server/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/20278/9/src/kudu/server/webserver.cc@323
PS9, Line 323: const char* kt_file = FLAGS_spnego_keytab_file.empty() ?
nit: update the comment above
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 9
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Wang Xixu <14...@qq.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Wed, 13 Dec 2023 10:20:52 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Zoltan Martonka, Kudu Jenkins, Wang Xixu,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/20278
to look at the new patch set (#9).
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
KUDU-3496 support spnego dedicated keytab
Add a --spnego_keytab_file flag for seperation of service keytab file
and spnego keytab file. If --webserver_require_spnego flag is true and
--spnego_keytab_file is not empty but specifies a keytab location, web
console gss acceptor registers specified keytab location so that web
server is able to find spnego principal from spnego_keytab_file. if
--spnego_keytab_file is empty even --webserver_require_spnego=true, web
server will use --keytab_file flag as it is.
Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
---
M src/kudu/security/init.cc
M src/kudu/security/test/mini_kdc.cc
M src/kudu/security/test/mini_kdc.h
M src/kudu/server/webserver-test.cc
M src/kudu/server/webserver.cc
5 files changed, 65 insertions(+), 1 deletion(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/78/20278/9
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 9
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Wang Xixu <14...@qq.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Halim Kim has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 6:
@Marton Greber
I Finally found that the reason why the webserver-test has failed on MacOS.
It is because MacOS uses Heimdal kerberos implementation which is kind of different from MIT kerberos implementation.
I was able to notice that by checking test log files. In both kerberos implementations, setting 'KRB5_TRACE' env variable as stderr(/dev/stderr) provided me the detailed process of GSSAPI. For the case of CentOS which uses MIT kerberos, the test log left successful negotiation process on each unit test case. On the other hand, the test log for MacOS did not. All the TGS Requests were sent to kdc with wrong port number except the first unit test case. All the unit test cases use same kdc port number that is used in the first test case so that only first test case can be passed and others can't not.
In my opinion, Heimdal kerberos implementation caches a port number somewhere. I tried to find how to totally purge the cache but i couldn't.
I think we need a work-around that skips some tests on MacOS like what negotiation-test've done (https://github.com/apache/kudu/blob/ae7b08c006167da1ebb0c4302e5d6d7aa739a862/src/kudu/rpc/negotiation-test.cc#L1399-L1402)
What do you think?
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 6
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Wang Xixu <14...@qq.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Mon, 11 Dec 2023 06:44:21 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Halim Kim has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 3:
(2 comments)
http://gerrit.cloudera.org:8080/#/c/20278/3/src/kudu/security/gssapi.cc
File src/kudu/security/gssapi.cc:
http://gerrit.cloudera.org:8080/#/c/20278/3/src/kudu/security/gssapi.cc@137
PS3, Line 137: if (!FLAGS_spnego_keytab_file.empty()) {
> Is this code executed in every step SpnegoStep call? Is it intended?
As far as I know, The keytab_file flag value will be stored in the KRB5_KTNAME env variable. GSS Acceptor uses this KRB5_KTNAME as default.
I tend to use another keytab file name that user specifed in spnege_keytab_file flag instead of KRB5_KTNAME. So I put gss_register_acceptor_indentity function to change keytab file name.
Actually I don't have much information about gss api. If you have better idea or something still curios, Please Let me know. Thank you.
http://gerrit.cloudera.org:8080/#/c/20278/3/src/kudu/security/init.cc
File src/kudu/security/init.cc:
http://gerrit.cloudera.org:8080/#/c/20278/3/src/kudu/security/init.cc@88
PS3, Line 88: DEFINE_string(spnego_keytab_file, "",
: "Absolute path to Kerberos keytab file "
: "for HTTP spnego. If it is empty, --keytab_file flag will be used.");
: TAG_FLAG(spnego_keytab_file, advanced);
> Please add some explanation in the commit description why do we need a new
Ok I will add explanation like I did in impala commit.
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 3
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Sat, 14 Oct 2023 15:05:47 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Halim Kim has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 3:
Thanks for reply @Marton Greber
I'm willing to put some test codes. But I don't know how to do that.
Can you provide any guide(If available) or let me know where to put test code.
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 3
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Sat, 14 Oct 2023 14:35:07 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Zoltan Martonka, Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/20278
to look at the new patch set (#4).
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
KUDU-3496 support spnego dedicated keytab
Add a --spnego_keytab_file flag for seperation of service keytab file
and spnego keytab file. If --webserver_require_spnego flag is true and
--spnego_keytab_file is not empty but specifies a keytab location, web
console gss acceptor registers specified keytab location so that web
server is able to find spnego principal from spnego_keytab_file. if
--spnego_keytab_file is empty even --webserver_require_spnego, web
server will use --keytab_file flag as it is.
Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
---
M src/kudu/security/gssapi.cc
M src/kudu/security/gssapi.h
M src/kudu/security/init.cc
M src/kudu/server/webserver.cc
4 files changed, 17 insertions(+), 1 deletion(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/78/20278/4
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 4
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Zoltan Martonka (Code Review)" <ge...@cloudera.org>.
Zoltan Martonka has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 3:
(2 comments)
http://gerrit.cloudera.org:8080/#/c/20278/3/src/kudu/security/gssapi.cc
File src/kudu/security/gssapi.cc:
http://gerrit.cloudera.org:8080/#/c/20278/3/src/kudu/security/gssapi.cc@137
PS3, Line 137: if (!FLAGS_spnego_keytab_file.empty()) {
Is this code executed in every step SpnegoStep call? Is it intended?
http://gerrit.cloudera.org:8080/#/c/20278/3/src/kudu/security/init.cc
File src/kudu/security/init.cc:
http://gerrit.cloudera.org:8080/#/c/20278/3/src/kudu/security/init.cc@88
PS3, Line 88: DEFINE_string(spnego_keytab_file, "",
: "Absolute path to Kerberos keytab file "
: "for HTTP spnego. If it is empty, --keytab_file flag will be used.");
: TAG_FLAG(spnego_keytab_file, advanced);
Please add some explanation in the commit description why do we need a new flag, and why does just merging the 2 keytab files not an option?
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 3
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Wed, 11 Oct 2023 15:25:39 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Halim Kim has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 6:
(4 comments)
http://gerrit.cloudera.org:8080/#/c/20278/6//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/20278/6//COMMIT_MSG@14
PS6, Line 14: even --webserver_require_spnego
> even --webserver_require_spnego=true?
that's what i mean. I'll correct this.
http://gerrit.cloudera.org:8080/#/c/20278/6/src/kudu/security/test/mini_kdc.h
File src/kudu/security/test/mini_kdc.h:
http://gerrit.cloudera.org:8080/#/c/20278/6/src/kudu/security/test/mini_kdc.h@95
PS6, Line 95: CreateServiceKeytabWithName
> Could you give some comments about this function?
Ok, I will. thanks
http://gerrit.cloudera.org:8080/#/c/20278/6/src/kudu/security/test/mini_kdc.cc
File src/kudu/security/test/mini_kdc.cc:
http://gerrit.cloudera.org:8080/#/c/20278/6/src/kudu/security/test/mini_kdc.cc@283
PS6, Line 283: string kt_path = name;
: kt_path = JoinPathSegments(options_.data_root, kt_path) + ".keytab";
> How about:
that's possbile too. I just made it like code line 266~268
http://gerrit.cloudera.org:8080/#/c/20278/6/src/kudu/server/webserver-test.cc
File src/kudu/server/webserver-test.cc:
http://gerrit.cloudera.org:8080/#/c/20278/6/src/kudu/server/webserver-test.cc@259
PS6, Line 259: FLAGS_spnego_keytab_file = kt_path;
> Should test another case, which FLAGS_spnego_keytab_file is empty?
Do you mean that failure test case is needed?
I agree with you. I'll put some test codes soon.
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 6
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Wang Xixu <14...@qq.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Thu, 09 Nov 2023 10:50:48 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Halim Kim has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 4:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/20278/3/src/kudu/security/gssapi.cc
File src/kudu/security/gssapi.cc:
http://gerrit.cloudera.org:8080/#/c/20278/3/src/kudu/security/gssapi.cc@137
PS3, Line 137: if (!FLAGS_spnego_keytab_file.empty()) {
> Is this code executed in every step SpnegoStep call? Is it intended?
Today, I read the krb5_gss_register_acceptor_identity function spec once again and found that there is no need to run this function in every SpnegoStep.
I guess it is fine to put krb5_gss_register_acceptor_identity in start function of Webserver class so that the function will be called only one time.
I will test it and share the result. thank you for your comment.
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 4
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Fri, 27 Oct 2023 13:12:22 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Attila Bukor (Code Review)" <ge...@cloudera.org>.
Attila Bukor has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
KUDU-3496 support spnego dedicated keytab
Add a --spnego_keytab_file flag for seperation of service keytab file
and spnego keytab file. If --webserver_require_spnego flag is true and
--spnego_keytab_file is not empty but specifies a keytab location, web
console gss acceptor registers specified keytab location so that web
server is able to find spnego principal from spnego_keytab_file. if
--spnego_keytab_file is empty even --webserver_require_spnego=true, web
server will use --keytab_file flag as it is.
Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Reviewed-on: http://gerrit.cloudera.org:8080/20278
Tested-by: Kudu Jenkins
Reviewed-by: Attila Bukor <ab...@apache.org>
---
M src/kudu/security/init.cc
M src/kudu/security/test/mini_kdc.cc
M src/kudu/security/test/mini_kdc.h
M src/kudu/server/webserver-test.cc
M src/kudu/server/webserver.cc
5 files changed, 74 insertions(+), 4 deletions(-)
Approvals:
Kudu Jenkins: Verified
Attila Bukor: Looks good to me, approved
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 11
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Wang Xixu <14...@qq.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Zoltan Martonka, Kudu Jenkins, Wang Xixu,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/20278
to look at the new patch set (#8).
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
KUDU-3496 support spnego dedicated keytab
Add a --spnego_keytab_file flag for seperation of service keytab file
and spnego keytab file. If --webserver_require_spnego flag is true and
--spnego_keytab_file is not empty but specifies a keytab location, web
console gss acceptor registers specified keytab location so that web
server is able to find spnego principal from spnego_keytab_file. if
--spnego_keytab_file is empty even --webserver_require_spnego=true, web
server will use --keytab_file flag as it is.
Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
---
M src/kudu/security/gssapi.h
M src/kudu/security/init.cc
M src/kudu/security/test/mini_kdc.cc
M src/kudu/security/test/mini_kdc.h
M src/kudu/server/webserver-test.cc
M src/kudu/server/webserver.cc
6 files changed, 65 insertions(+), 1 deletion(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/78/20278/8
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 8
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Wang Xixu <14...@qq.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Halim Kim has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 6:
One more, TestUnauthenticatedBadKeytab test case also has a flaw. Like I said, All the test cases that execute DoSpnegoCurl() use same kdc port number. TestUnauthenticatedBadKeytab do so too. However it returns "Remote error: HTTP 401" as expected and passes.
The thing is 401 response number is not caused by radomized principal key but just absence of HTTP service ticket. (unable to retrieve service ticket because TGS Request is sent to wrong)
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 6
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Wang Xixu <14...@qq.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Mon, 11 Dec 2023 06:58:31 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Marton Greber (Code Review)" <ge...@cloudera.org>.
Marton Greber has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 6:
> Patch Set 6:
>
> @Marton Greber
>
> I Finally found that the reason why the webserver-test has failed on MacOS.
>
> It is because MacOS uses Heimdal kerberos implementation which is kind of different from MIT kerberos implementation.
>
> I was able to notice that by checking test log files. In both kerberos implementations, setting 'KRB5_TRACE' env variable as stderr(/dev/stderr) provided me the detailed process of GSSAPI. For the case of CentOS which uses MIT kerberos, the test log left successful negotiation process on each unit test case. On the other hand, the test log for MacOS did not. All the TGS Requests were sent to kdc with wrong port number except the first unit test case. All the unit test cases use same kdc port number that is used in the first test case so that only first test case can be passed and others can't not.
>
> In my opinion, Heimdal kerberos implementation caches a port number somewhere. I tried to find how to totally purge the cache but i couldn't.
>
> I think we need a work-around that skips some tests on MacOS like what negotiation-test've done (https://github.com/apache/kudu/blob/ae7b08c006167da1ebb0c4302e5d6d7aa739a862/src/kudu/rpc/negotiation-test.cc#L1399-L1402)
>
> What do you think?
Thank you very much for investigating the issue and getting to the bottom of it!
In this case I think it is reasonable to use #ifndef __APPLE__ for the test.
Since your explanation is longer what I would except in source code comments, I think your could put your findings into a new jira ticket. Then add just the essence of the issue into the source code as comment, with the corresponding jira number, and maybe a TODO.
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 6
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Wang Xixu <14...@qq.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Tue, 12 Dec 2023 12:51:01 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Marton Greber (Code Review)" <ge...@cloudera.org>.
Marton Greber has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 3:
> Patch Set 3:
>
> (2 comments)
I'm thinking that a test similar to:
https://github.com/apache/kudu/blob/master/src/kudu/server/webserver-test.cc#L246-L251
with the addition of using the dedicated keytab.
Some pointers:
We have webserver-test.cc where we have spnego related tests:
https://github.com/apache/kudu/blob/master/src/kudu/server/webserver-test.cc#L200C1-L252C1
This uses the MiniKdc:
https://github.com/apache/kudu/blob/master/src/kudu/security/test/mini_kdc.h
Where you can create keytab:
https://github.com/apache/kudu/blob/master/src/kudu/security/test/mini_kdc.cc#L263-L278
For further details on how to deal with kdc, the mini_kdc-test is a good starting point:
https://github.com/apache/kudu/blob/master/src/kudu/security/test/mini_kdc-test.cc
Hope this helps!
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 3
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Tue, 17 Oct 2023 11:03:41 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Marton Greber (Code Review)" <ge...@cloudera.org>.
Marton Greber has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 3:
Thank you for the contribution!
Couple things:
* could you please consider if its possible add some tests to cover the functionality?
* I saw in the Impala change you provided detailed commit message. Could you please do the same for the Kudu change as well?
Thanks!
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 3
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 11 Oct 2023 14:25:01 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Zoltan Martonka, Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/20278
to look at the new patch set (#5).
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
KUDU-3496 support spnego dedicated keytab
Add a --spnego_keytab_file flag for seperation of service keytab file
and spnego keytab file. If --webserver_require_spnego flag is true and
--spnego_keytab_file is not empty but specifies a keytab location, web
console gss acceptor registers specified keytab location so that web
server is able to find spnego principal from spnego_keytab_file. if
--spnego_keytab_file is empty even --webserver_require_spnego, web
server will use --keytab_file flag as it is.
Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
---
M src/kudu/security/gssapi.h
M src/kudu/security/init.cc
M src/kudu/security/test/mini_kdc.cc
M src/kudu/security/test/mini_kdc.h
M src/kudu/server/webserver-test.cc
M src/kudu/server/webserver.cc
6 files changed, 86 insertions(+), 1 deletion(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/78/20278/5
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 5
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Marton Greber (Code Review)" <ge...@cloudera.org>.
Marton Greber has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 6:
Overall looks good to me, thanks for adding tests!
There is a macOS test issue on my end:
Running the webserver-test fails with: SpnegoWebserverTest.TestAuthenticated
However if I run this test individually, it runs successfully.
If you have a macOS station, could you please check this issue out?(maybe its just an env issue on my end) If you don't have access to macOS station, let me know, and I can help look into this.
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 6
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Tue, 07 Nov 2023 07:06:16 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Zoltan Martonka, Attila Bukor, Kudu Jenkins, Wang Xixu,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/20278
to look at the new patch set (#10).
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
KUDU-3496 support spnego dedicated keytab
Add a --spnego_keytab_file flag for seperation of service keytab file
and spnego keytab file. If --webserver_require_spnego flag is true and
--spnego_keytab_file is not empty but specifies a keytab location, web
console gss acceptor registers specified keytab location so that web
server is able to find spnego principal from spnego_keytab_file. if
--spnego_keytab_file is empty even --webserver_require_spnego=true, web
server will use --keytab_file flag as it is.
Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
---
M src/kudu/security/init.cc
M src/kudu/security/test/mini_kdc.cc
M src/kudu/security/test/mini_kdc.h
M src/kudu/server/webserver-test.cc
M src/kudu/server/webserver.cc
5 files changed, 74 insertions(+), 4 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/78/20278/10
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 10
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Wang Xixu <14...@qq.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Halim Kim has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 10:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/20278/9/src/kudu/server/webserver-test.cc
File src/kudu/server/webserver-test.cc:
http://gerrit.cloudera.org:8080/#/c/20278/9/src/kudu/server/webserver-test.cc@270
PS9, Line 270: ASSERT_OK(DoSpnegoCurl());
> Can you also add a brief summary of why this is ignored (similar to the one
Ok I will put more description. thanks
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 10
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Wang Xixu <14...@qq.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Mon, 15 Jan 2024 02:57:23 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Attila Bukor (Code Review)" <ge...@cloudera.org>.
Attila Bukor has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 10: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 10
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Wang Xixu <14...@qq.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Mon, 15 Jan 2024 13:18:26 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Halim Kim has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 3:
> > Patch Set 3:
> >
> > (2 comments)
It's really helpful to understand the test process.
I'll work on this and add a test code for my change soon.
Thanks.
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 3
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Sun, 22 Oct 2023 14:33:18 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Zoltan Martonka, Kudu Jenkins, Wang Xixu,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/20278
to look at the new patch set (#7).
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
KUDU-3496 support spnego dedicated keytab
Add a --spnego_keytab_file flag for seperation of service keytab file
and spnego keytab file. If --webserver_require_spnego flag is true and
--spnego_keytab_file is not empty but specifies a keytab location, web
console gss acceptor registers specified keytab location so that web
server is able to find spnego principal from spnego_keytab_file. if
--spnego_keytab_file is empty even --webserver_require_spnego=true, web
server will use --keytab_file flag as it is.
Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
---
M src/kudu/security/gssapi.h
M src/kudu/security/init.cc
M src/kudu/security/test/mini_kdc.cc
M src/kudu/security/test/mini_kdc.h
M src/kudu/server/webserver-test.cc
M src/kudu/server/webserver.cc
6 files changed, 63 insertions(+), 1 deletion(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/78/20278/7
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 7
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Wang Xixu <14...@qq.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Wang Xixu (Code Review)" <ge...@cloudera.org>.
Wang Xixu has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 6:
(4 comments)
http://gerrit.cloudera.org:8080/#/c/20278/6//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/20278/6//COMMIT_MSG@14
PS6, Line 14: even --webserver_require_spnego
even --webserver_require_spnego=true?
http://gerrit.cloudera.org:8080/#/c/20278/6/src/kudu/security/test/mini_kdc.h
File src/kudu/security/test/mini_kdc.h:
http://gerrit.cloudera.org:8080/#/c/20278/6/src/kudu/security/test/mini_kdc.h@95
PS6, Line 95: CreateServiceKeytabWithName
Could you give some comments about this function?
http://gerrit.cloudera.org:8080/#/c/20278/6/src/kudu/security/test/mini_kdc.cc
File src/kudu/security/test/mini_kdc.cc:
http://gerrit.cloudera.org:8080/#/c/20278/6/src/kudu/security/test/mini_kdc.cc@283
PS6, Line 283: string kt_path = name;
: kt_path = JoinPathSegments(options_.data_root, kt_path) + ".keytab";
How about:
string kt_path = JoinPathSegments(options_.data_root, name) + ".keytab";
http://gerrit.cloudera.org:8080/#/c/20278/6/src/kudu/server/webserver-test.cc
File src/kudu/server/webserver-test.cc:
http://gerrit.cloudera.org:8080/#/c/20278/6/src/kudu/server/webserver-test.cc@259
PS6, Line 259: FLAGS_spnego_keytab_file = kt_path;
Should test another case, which FLAGS_spnego_keytab_file is empty?
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 6
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Wang Xixu <14...@qq.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Thu, 09 Nov 2023 09:55:43 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3496 support spnego dedicated keytab
Posted by "Halim Kim (Code Review)" <ge...@cloudera.org>.
Halim Kim has posted comments on this change. ( http://gerrit.cloudera.org:8080/20278 )
Change subject: KUDU-3496 support spnego dedicated keytab
......................................................................
Patch Set 6:
> Overall looks good to me, thanks for adding tests!
> There is a macOS test issue on my end:
> Running the webserver-test fails with: SpnegoWebserverTest.TestAuthenticated
> However if I run this test individually, it runs successfully.
> If you have a macOS station, could you please check this issue
> out?(maybe its just an env issue on my end) If you don't have
> access to macOS station, let me know, and I can help look into
> this.
I've checked the same situation happens on my mac.
---
[ RUN ] SpnegoWebserverTest.TestAuthenticated
Initializing database '/private/tmp/kudutest-501/webserver-test.0.SpnegoWebserverTest.TestAuthenticated.1699520747882600-92342-0/krb5kdc/principal' for realm 'KRBTEST.COM',
master key name 'K/M@KRBTEST.COM'
11 09 18:05:49 MyMac.local krb5kdc[92386](info): Loaded
11 09 18:05:49 MyMac.local krb5kdc[92386](Error): preauth pkinit failed to initialize: PKINIT initialization failed: No pkinit_identity supplied for realm KRBTEST.COM
11 09 18:05:49 MyMac.local krb5kdc[92386](Error): preauth spake failed to initialize: No SPAKE preauth groups configured
11 09 18:05:49 MyMac.local krb5kdc[92386](info): setting up network...
11 09 18:05:49 MyMac.local krb5kdc[92386](info): setsockopt(9,IPV6_V6ONLY,1) worked
11 09 18:05:49 MyMac.local krb5kdc[92386](info): set up 2 sockets
11 09 18:05:49 MyMac.local krb5kdc[92386](info): commencing operation
krb5kdc: starting...
No policy specified for HTTP/127.0.0.1@KRBTEST.COM; defaulting to no policy
Authenticating as principal user/admin@KRBTEST.COM with password.
Principal "HTTP/127.0.0.1@KRBTEST.COM" created.
Authenticating as principal user/admin@KRBTEST.COM with password.
Entry for principal HTTP/127.0.0.1 with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:/private/tmp/kudutest-501/webserver-test.0.SpnegoWebserverTest.TestAuthenticated.1699520747882600-92342-0/krb5kdc/HTTP_127.0.0.1.keytab.
Entry for principal HTTP/127.0.0.1 with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/private/tmp/kudutest-501/webserver-test.0.SpnegoWebserverTest.TestAuthenticated.1699520747882600-92342-0/krb5kdc/HTTP_127.0.0.1.keytab.
No policy specified for alice@KRBTEST.COM; defaulting to no policy
Authenticating as principal user/admin@KRBTEST.COM with password.
Principal "alice@KRBTEST.COM" created.
I20231109 18:05:49.678123 5597282 webserver.cc:412] Webserver started at http://0.0.0.0:57966/ using document root /private/tmp/kudutest-501/webserver-test.0.SpnegoWebserverTest.TestAuthenticated.1699520747882600-92342-0/webserver-docroot and password file <none>
11 09 18:05:49 MyMac.local krb5kdc[92386](info): AS_REQ (2 etypes {aes128-cts-hmac-sha1-96(17), DEPRECATED:des3-cbc-sha1(16)}) 127.0.0.1: ISSUE: authtime 1699520749, etypes {rep=aes128-cts-hmac-sha1-96(17), tkt=aes128-cts-hmac-sha1-96(17), ses=aes128-cts-hmac-sha1-96(17)}, alice@KRBTEST.COM for krbtgt/KRBTEST.COM@KRBTEST.COM
Password for alice@KRBTEST.COM:
/Users/user/IdeaProjects/kudu/src/kudu/server/webserver-test.cc:304: Failure
Failed
Bad status: Remote error: HTTP 401
I20231109 18:05:49.726493 5597282 test_util.cc:175] -----------------------------------------------
I20231109 18:05:49.726526 5597282 test_util.cc:176] Had fatal failures, leaving test files at /private/tmp/kudutest-501/webserver-test.0.SpnegoWebserverTest.TestAuthenticated.1699520747882600-92342-0
[ FAILED ] SpnegoWebserverTest.TestAuthenticated (214 ms)
---
I'll let you know if i find the cause.
--
To view, visit http://gerrit.cloudera.org:8080/20278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I01646207954854d67308f99e6b71ba32c019ed6a
Gerrit-Change-Number: 20278
Gerrit-PatchSet: 6
Gerrit-Owner: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Halim Kim <rl...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Wang Xixu <14...@qq.com>
Gerrit-Reviewer: Zoltan Martonka <zm...@cloudera.com>
Gerrit-Comment-Date: Thu, 09 Nov 2023 10:40:12 +0000
Gerrit-HasComments: No