[HADOOP-14295] Authentication proxy filter may fail authorization because of getRemoteAddr

• Type: Bug
• Status: Open
• Priority: Critical
• Resolution: Unresolved
• Affects Version/s: 2.7.4, 3.0.0-alpha2, 2.8.1
• Component/s: common
• Release Note: Path has code refactored and testcases
• Assignee: Jeffrey E Rodriguez
• Reporter: Jeffrey E Rodriguez
• Created: 08/Apr/17 14:24
• Updated: 02/Oct/19 17:15

Description

When we turn on Hadoop UI Kerberos and try to access Datanode /logs the proxy (Knox) would get an Authorization failure and it hosts would should as 127.0.0.1 even though Knox wasn't in local host to Datanode, error message:

"2017-04-08 07:01:23,029 ERROR security.AuthenticationWithProxyUserFilter (AuthenticationWithProxyUserFilter.java:getRemoteUser(94)) - Unable to verify proxy user: Unauthorized connection for super-user: knox from IP 127.0.0.1"

We were able to figure out that Datanode have Jetty listening on localhost and that Netty is used to server request to DataNode, this was a measure to improve performance because of Netty Async NIO design.

I propose to add a check for x-forwarded-for header since proxys usually inject that header before we do a getRemoteAddr