[AMBARI-11687] Kerberos: Force principal names to resolve to lowercase lower usernames in auth-to-local default rules

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.0.1
• Fix Version/s: 2.1.0
• Component/s: ambari-server
• Assignee: Emil Anca
• Reporter: Emil Anca
• Created: 04/Jun/15 14:04
• Updated: 09/Jun/15 17:15
• Resolved: 09/Jun/15 15:22

Description

Force principals names to resolve to lowercase local usernames in auth-to-local rules. This will help when the KDC is an MIT KDC or an Active Directory and user accounts have uppercase letters that need to be converted to lowercase letters. For example: USER1234@REALM should resolve to user1234.

Solution

1. Provide a kerberos-env configuration to optionally create case-insensitive rules
2. If creating case-insensitive rules, generic auth-to-local rules should contain the L option, as in:

   RULE:[1:$1@$0](.*@REALM)s/@.*///L
   

Issue Links

• links to: Review Request