[AMBARI-21418] Ambari rebuilds custom auth_to_local rules changing its case sensitiveness option (/L) depending on the case_insensitive_username_rules.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.1.0
• Fix Version/s: 2.5.3
• Component/s: ambari-server
• Assignee: Attila Magyar
• Reporter: Tomas Sokorai
• Created: 06/Jul/17 18:43
• Updated: 11/Aug/17 16:28
• Resolved: 24/Jul/17 12:58

Description

Ambari changes the auth to local custom rules /L state on rebuild depending on case_insensitive_username_rules.
How to reproduce:
1) Kerberize Ambari.
2) Make sure these kerberos settings are set as follows:
case_insensitive_username_rules = false
manage_auth_to_local = true
3) Add custom auth_to_local rule:

RULE:[1:$1@$0](.*@HDP01.LOCAL)s/.*/ambari-qa//L

(NB: HDP01.LOCAL realm was chosen to avoid matching the default kerberos realm, EXAMPLE.COM in my tests)
4) Add a new service to the cluster that has kerberos configuration, in my case, tested with adding Spark2.
5) After successful service addition, check the auth_to_local mappings again; the mapping we added in point 3 should now be missing the /L and be:

RULE:[1:$1@$0](.*@HDP01.LOCAL)s/.*/ambari-qa/

Issue Links

• links to: review board