accumulo-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From els...@apache.org
Subject accumulo git commit: ACCUMULO-3695 Fix incorrect system credentials assertion.
Date Wed, 25 Mar 2015 02:30:45 GMT
Repository: accumulo
Updated Branches:
  refs/heads/master bbf5b7c3e -> 0228da0a7


ACCUMULO-3695 Fix incorrect system credentials assertion.

System credentials could only be authenticated from the same node
which didn't really work too well on a distributed system.


Project: http://git-wip-us.apache.org/repos/asf/accumulo/repo
Commit: http://git-wip-us.apache.org/repos/asf/accumulo/commit/0228da0a
Tree: http://git-wip-us.apache.org/repos/asf/accumulo/tree/0228da0a
Diff: http://git-wip-us.apache.org/repos/asf/accumulo/diff/0228da0a

Branch: refs/heads/master
Commit: 0228da0a765c322ff04636d305ccc38b876152c0
Parents: bbf5b7c
Author: Josh Elser <elserj@apache.org>
Authored: Tue Mar 24 21:48:14 2015 -0400
Committer: Josh Elser <elserj@apache.org>
Committed: Tue Mar 24 21:48:14 2015 -0400

----------------------------------------------------------------------
 .../accumulo/server/security/SecurityOperation.java  | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/accumulo/blob/0228da0a/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java
----------------------------------------------------------------------
diff --git a/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java
b/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java
index ba6a1fb..19f2219 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java
@@ -165,9 +165,18 @@ public class SecurityOperation {
     Credentials creds = Credentials.fromThrift(credentials);
 
     if (isSystemUser(credentials)) {
-      if (!(context.getCredentials().equals(creds))) {
-        log.debug("Provided credentials did not match server's expected credentials. Expected
" + context.getCredentials() + " but got " + creds);
-        throw new ThriftSecurityException(creds.getPrincipal(), SecurityErrorCode.BAD_CREDENTIALS);
+      if (isKerberos) {
+        // Don't need to re-check the principal as TCredentialsUpdatingInvocationHandler
will check the provided against
+        // the credentials provided on the wire.
+        if (!context.getCredentials().getToken().equals(creds.getToken())) {
+          log.debug("With SASL enabled, System AuthenticationTokens did not match.");
+          throw new ThriftSecurityException(creds.getPrincipal(), SecurityErrorCode.BAD_CREDENTIALS);
+        }
+      } else {
+        if (!(context.getCredentials().equals(creds))) {
+          log.debug("Provided credentials did not match server's expected credentials. Expected
" + context.getCredentials() + " but got " + creds);
+          throw new ThriftSecurityException(creds.getPrincipal(), SecurityErrorCode.BAD_CREDENTIALS);
+        }
       }
     } else {
       // Not the system user


Mime
View raw message