[AMBARI-22715] Kafka broken by auth_to_local rules when case_insensitive_username_rules=true

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.5.2
• Assignee: Robert Levas
• Reporter: Sean Roberts
• Created: 02/Jan/18 13:10
• Updated: 11/Jul/18 22:14
• Resolved: 11/Jul/18 22:14

Description

https://issues.apache.org/jira/browse/AMBARI-22715

Kafka brokers will fail to start when Kerberos is set with:
case_insensitive_username_rules=true

This is due to Kafka not supporting the lower case (/L) functionality.

How to reproduce:
1. Deploy a cluster which includes Kafka
2. Kerberize cluster
3. Ensure following is set in 'kerberos-env':

case_insensitive_username_rules=true
manage_auth_to_local=true

4. Start Kafka brokers
5. They will fail to start.

Note the /Ls in the configuration below.

For Kafka to function, Ambari will need to not include the "/L"s in the Kafka configuration.

"sasl.kerberos.principal.to.local.rules" : "RULE:[1:$1@$0]([e-mail])s/.*/ambari-qa/,RULE:[1:$1@$0]([e-mail])s/.*/hbase/,RULE:[1:$1@$0]([e-mail])s/.*/hdfs/,RULE:[1:$1@$0]([e-mail])s/.*/spark/,RULE:[1:$1@$0]([e-mail])s/.*/zeppelin/,RULE:[1:$1@$0](.*@CLUSTER.TEST.COM)s/@.*///L,RULE:[2:$1@$0]([e-mail])s/.*/activity_analyzer/,RULE:[2:$1@$0]([e-mail])s/.*/activity_explorer/,RULE:[2:$1@$0]([e-mail])s/.*/ams/,RULE:[2:$1@$0]([e-mail])s/.*/ams/,RULE:[2:$1@$0]([e-mail])s/.*/atlas/,RULE:[2:$1@$0]([e-mail])s/.*/hdfs/,RULE:[2:$1@$0]([e-mail])s/.*/hbase/,RULE:[2:$1@$0]([e-mail])s/.*/hive/,RULE:[2:$1@$0]([e-mail])s/.*/mapred/,RULE:[2:$1@$0]([e-mail])s/.*/hdfs/,RULE:[2:$1@$0]([e-mail])s/.*/knox/,RULE:[2:$1@$0]([e-mail])s/.*/livy/,RULE:[2:$1@$0]([e-mail])s/.*/yarn/,RULE:[2:$1@$0]([e-mail])s/.*/hdfs/,RULE:[2:$1@$0]([e-mail])s/.*/oozie/,RULE:[2:$1@$0]([e-mail])s/.*/ranger/,RULE:[2:$1@$0]([e-mail])s/.*/keyadmin/,RULE:[2:$1@$0]([e-mail])s/.*/rangertagsync/,RULE:[2:$1@$0]([e-mail])s/.*/rangerusersync/,RULE:[2:$1@$0]([e-mail])s/.*/yarn/,RULE:[2:$1@$0]([e-mail])s/.*/yarn/,DEFAULT",