Return-Path: 
 <common-issues-return-13811-apmail-hadoop-common-issues-archive=hadoop.apache.org@hadoop.apache.org>
Delivered-To: apmail-hadoop-common-issues-archive@minotaur.apache.org
Received: (qmail 96616 invoked from network); 31 Mar 2011 01:13:43 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.3)
  by minotaur.apache.org with SMTP; 31 Mar 2011 01:13:43 -0000
Received: (qmail 24972 invoked by uid 500); 31 Mar 2011 00:13:43 -0000
Delivered-To: apmail-hadoop-common-issues-archive@hadoop.apache.org
Received: (qmail 24946 invoked by uid 500); 31 Mar 2011 00:13:43 -0000
Mailing-List: contact common-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:common-issues-help@hadoop.apache.org>
List-Unsubscribe: <mailto:common-issues-unsubscribe@hadoop.apache.org>
List-Post: <mailto:common-issues@hadoop.apache.org>
List-Id: <common-issues.hadoop.apache.org>
Reply-To: common-issues@hadoop.apache.org
Delivered-To: mailing list common-issues@hadoop.apache.org
Received: (qmail 24938 invoked by uid 99); 31 Mar 2011 00:13:43 -0000
Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 31 Mar 2011 00:13:43 +0000
X-ASF-Spam-Status: No, hits=-2000.0 required=5.0
	tests=ALL_TRUSTED,T_RP_MATCHES_RCVD
X-Spam-Check-By: apache.org
Received: from [140.211.11.116] (HELO hel.zones.apache.org) (140.211.11.116)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 31 Mar 2011 00:13:42 +0000
Received: from hel.zones.apache.org (hel.zones.apache.org [140.211.11.116])
	by hel.zones.apache.org (Postfix) with ESMTP id B2B628B5C5
	for <common-issues@hadoop.apache.org>; Thu, 31 Mar 2011 00:13:05 +0000 (UTC)
Date: Thu, 31 Mar 2011 00:13:05 +0000 (UTC)
From: "Suresh Srinivas (JIRA)" <jira@apache.org>
To: common-issues@hadoop.apache.org
Message-ID: 
 <314338492.22805.1301530385728.JavaMail.tomcat@hel.zones.apache.org>
In-Reply-To: 
 <298707236.22802.1301530265774.JavaMail.tomcat@hel.zones.apache.org>
Subject: [jira] [Commented] (HADOOP-7215) RPC clients must connect over a
 network interface corresponding to the host name in the client's kerberos
 principal key
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394


    [ https://issues.apache.org/jira/browse/HADOOP-7215?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13013756#comment-13013756 ] 

Suresh Srinivas commented on HADOOP-7215:
-----------------------------------------

Given that the server validate's the host name of the client's connection with the host name in the client's prinicipal name of format <service>/_HOST@realm, I propose binding the client's socket to the address specified in the principal name.



> RPC clients must connect over a network interface corresponding to the host name in the client's kerberos principal key
> -----------------------------------------------------------------------------------------------------------------------
>
>                 Key: HADOOP-7215
>                 URL: https://issues.apache.org/jira/browse/HADOOP-7215
>             Project: Hadoop Common
>          Issue Type: Bug
>          Components: security
>            Reporter: Suresh Srinivas
>            Assignee: Suresh Srinivas
>             Fix For: 0.20.203.0, 0.20.204.0, 0.23.0
>
>
> HDFS-7104 introduced a change where RPC server matches client's hostname with the hostname specified in the client's Kerberos principal name. RPC client binds the socket to a random local address, which might not match the hostname specified in the principal name. This results authorization failure of the client at the server.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira