hadoop-common-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Sunil Govindan (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (HADOOP-15518) Authentication filter calling handler after request already authenticated
Date Mon, 11 Jun 2018 12:07:00 GMT

    [ https://issues.apache.org/jira/browse/HADOOP-15518?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16507946#comment-16507946

Sunil Govindan commented on HADOOP-15518:

[~eyang] This latest issue (Problem accessing /proxy/application_1528498597648_0001/) is a
different problem, correct?

bq.If multiple AuthenticationFilters are configured, and service principal names are different

Are you mentioning a case where AuthenticationFilter is added multiple time (like Spnego Filter
and authentication) but will use different keytab? 

> Authentication filter calling handler after request already authenticated
> -------------------------------------------------------------------------
>                 Key: HADOOP-15518
>                 URL: https://issues.apache.org/jira/browse/HADOOP-15518
>             Project: Hadoop Common
>          Issue Type: Bug
>          Components: security
>    Affects Versions: 2.7.1
>            Reporter: Kevin Minder
>            Assignee: Kevin Minder
>            Priority: Major
>         Attachments: HADOOP-15518-001.patch
> The hadoop-auth AuthenticationFilter will invoke its handler even if a prior successful
authentication has occurred in the current request.  This primarily affects situations where
multiple authentication mechanism has been configured.  For example when core-site.xml's
has hadoop.http.authentication.type=kerberos and yarn-site.xml has yarn.timeline-service.http-authentication.type=kerberos
the result is an attempt to perform two Kerberos authentications for the same request.  This
in turn results in Kerberos triggering a replay attack detection.  The javadocs for AuthenticationHandler
([https://github.com/apache/hadoop/blob/trunk/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationHandler.java)] indicate
for the authenticate method that
> {quote}This method is invoked by the AuthenticationFilter only if the HTTP client request
is not yet authenticated.
> {quote}
> This does not appear to be the case in practice.
> I've create a patch and tested on a limited number of functional use cases (e.g. the
timeline-service issue noted above).  If there is general agreement that the change is valid
I'll add unit tests to the patch.

This message was sent by Atlassian JIRA

To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org

View raw message