hadoop-common-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Laxman (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (HADOOP-8554) KerberosAuthenticator should use the configured principal
Date Mon, 09 Jul 2012 05:36:35 GMT

    [ https://issues.apache.org/jira/browse/HADOOP-8554?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13409192#comment-13409192

Laxman commented on HADOOP-8554:

@Eli & Alejandro, IMHO this issue is valid.

On server side, there is a provision to configure a principal like "web/hadoop@MYREALM"
Here second component "hadoop" refers to my cluster/domain identifier but not the canonical
Also, Kerberos doesn't mandate to use hostname only. 

So, I think this is a valid issue. Correct me if I'm missing something here.

Please refer to ZOOKEEPER-1467 for similar issue of client side hardcoding.
> KerberosAuthenticator should use the configured principal
> ---------------------------------------------------------
>                 Key: HADOOP-8554
>                 URL: https://issues.apache.org/jira/browse/HADOOP-8554
>             Project: Hadoop Common
>          Issue Type: Bug
>          Components: security
>    Affects Versions: 1.0.0, 2.0.0-alpha, 2.0.1-alpha, 3.0.0
>            Reporter: Eli Collins
>              Labels: security, webconsole
> In KerberosAuthenticator we construct the principal as follows:
> {code}
> String servicePrincipal = "HTTP/" + KerberosAuthenticator.this.url.getHost();
> {code}
> Seems like we should use the configured hadoop.http.authentication.kerberos.principal
instead right?
> I hit this issue as a distcp using webhdfs://localhost fails because HTTP/localhost is
not in the kerb DB but using webhdfs://eli-thinkpad works because HTTP/eli-thinkpad is (and
is my configured principal). distcp using Hftp://localhost with the same config works so it
looks like this check is webhdfs specific for some reason (webhdfs is using spnego and hftp
is not?).

This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira


View raw message