Return-Path: X-Original-To: apmail-hadoop-common-issues-archive@minotaur.apache.org Delivered-To: apmail-hadoop-common-issues-archive@minotaur.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 8D1B719182 for ; Thu, 21 Apr 2016 21:56:13 +0000 (UTC) Received: (qmail 18027 invoked by uid 500); 21 Apr 2016 21:56:13 -0000 Delivered-To: apmail-hadoop-common-issues-archive@hadoop.apache.org Received: (qmail 17971 invoked by uid 500); 21 Apr 2016 21:56:13 -0000 Mailing-List: contact common-issues-help@hadoop.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: common-issues@hadoop.apache.org Delivered-To: mailing list common-issues@hadoop.apache.org Received: (qmail 17914 invoked by uid 99); 21 Apr 2016 21:56:13 -0000 Received: from arcas.apache.org (HELO arcas) (140.211.11.28) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 21 Apr 2016 21:56:13 +0000 Received: from arcas.apache.org (localhost [127.0.0.1]) by arcas (Postfix) with ESMTP id 0E3BF2C1F64 for ; Thu, 21 Apr 2016 21:56:13 +0000 (UTC) Date: Thu, 21 Apr 2016 21:56:13 +0000 (UTC) From: "Bolke de Bruin (JIRA)" To: common-issues@hadoop.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Updated] (HADOOP-12751) While using kerberos Hadoop incorrectly assumes names with '@' to be non-simple MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/HADOOP-12751?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Bolke de Bruin updated HADOOP-12751: ------------------------------------ Attachment: 0008-HADOOP-12751-leave-user-validation-to-os.patch Updated tests to support Malformed Kerberos name > While using kerberos Hadoop incorrectly assumes names with '@' to be non-simple > ------------------------------------------------------------------------------- > > Key: HADOOP-12751 > URL: https://issues.apache.org/jira/browse/HADOOP-12751 > Project: Hadoop Common > Issue Type: Bug > Components: security > Affects Versions: 2.7.2 > Environment: kerberos > Reporter: Bolke de Bruin > Assignee: Bolke de Bruin > Priority: Critical > Labels: kerberos > Attachments: 0001-HADOOP-12751-leave-user-validation-to-os.patch, 0001-Remove-check-for-user-name-characters-and.patch, 0002-HADOOP-12751-leave-user-validation-to-os.patch, 0003-HADOOP-12751-leave-user-validation-to-os.patch, 0004-HADOOP-12751-leave-user-validation-to-os.patch, 0005-HADOOP-12751-leave-user-validation-to-os.patch, 0006-HADOOP-12751-leave-user-validation-to-os.patch, 0007-HADOOP-12751-leave-user-validation-to-os.patch, 0007-HADOOP-12751-leave-user-validation-to-os.patch, 0008-HADOOP-12751-leave-user-validation-to-os.patch > > > In the scenario of a trust between two directories, eg. FreeIPA (ipa.local) and Active Directory (ad.local) users can be made available on the OS level by something like sssd. The trusted users will be of the form 'user@ad.local' while other users are will not contain the domain. Executing 'id -Gn user@ad.local' will successfully return the groups the user belongs to if configured correctly. > However, it is assumed by Hadoop that users of the format with '@' cannot be correct. This code is in KerberosName.java and seems to be a validator if the 'auth_to_local' rules are applied correctly. > In my opinion this should be removed or changed to a different kind of check or maybe logged as a warning while still proceeding, as the current behavior limits integration possibilities with other standard tools. > Workaround are difficult to apply (by having a rewrite by system tools to for example user_ad_local) due to down stream consequences. -- This message was sent by Atlassian JIRA (v6.3.4#6332)