[ACCUMULO-3568] getDiskUsage server implementation recreates Connector from user credentials

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 1.7.0
• Component/s: tserver

Environment

kerberos

• Assignee: Josh Elser
• Reporter: Josh Elser
• Created: 06/Feb/15 19:18
• Updated: 11/Feb/15 03:26
• Resolved: 11/Feb/15 03:26

Description

The server-side impl for TableOperationsImpl.getDiskUsage pulls the credentials from the RPC and makes a Connector from them instead of using its own credentials. With Kerberos enabled, this results in the server "accumulo/hostname@REALM" trying to act as "user@REALM" which (correctly) fails.

The getDiskUsage implementation should use its own Connector (using the SystemToken from the ServerContext), perform the correct security checks for permissions and act on behalf of the user instead of trying to be the user.

Issue Links

• is related to: ACCUMULO-2815 Kerberos authentication for clients