[HADOOP-8410] SPNEGO filter should have better error messages when not fully configured

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 2.0.0-alpha
• Component/s: security
• Assignee: Unassigned
• Reporter: Todd Lipcon
• Created: 18/May/12 21:49
• Updated: 16/Nov/12 23:22

Description

I upgraded to a build which includes SPNEGO, but neglected to configure dfs.web.authentication.kerberos.principal. This resulted in the following error:

12/05/18 14:46:20 INFO server.KerberosAuthenticationHandler: Login using keytab //home/todd/confs/conf.pseudo.security//hdfs.keytab, for principal ${dfs.web.authentication.kerberos.principal}
12/05/18 14:46:20 WARN mortbay.log: failed SpnegoFilter: javax.servlet.ServletException: javax.security.auth.login.LoginException: Unable to obtain password from user

Instead, it should give an error that the principal needs to be configured. Even better would be if we could default to HTTP/_HOST@<default realm>

Issue Links

• relates to: HDFS-3813 Log error message if security and WebHDFS are enabled but principal/keytab are not configured