[HADOOP-10301] AuthenticationFilter should return Forbidden for failed authentication

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 0.23.0, 2.0.0-alpha, 3.0.0-alpha1
• Fix Version/s: 2.4.0
• Component/s: security
• Target Version/s: 2.4.0
• Hadoop Flags: Reviewed
• Assignee: Daryn Sharp
• Reporter: Daryn Sharp
• Created: 28/Jan/14 21:28
• Updated: 12/May/16 18:22
• Resolved: 28/Mar/14 21:32

Description

The hadoop-auth AuthenticationFilter returns a 401 Unauthorized without a WWW-Authenticate headers. The is illegal per the HTTP RPC and causes a NPE in the HttpUrlConnection.

This is half of a fix that affects webhdfs. See HDFS-4564.

Issue Links

• breaks: OOZIE-2485 Oozie client keeps trying to use expired auth token
• duplicates: HADOOP-9311 hadoop-auth: Kerberos token expiration results in an error
• is required by: HDFS-4564 Webhdfs returns incorrect http response codes for denied operations