[HADOOP-10398] KerberosAuthenticator failed to fall back to PseudoAuthenticator after HADOOP-10078

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Invalid
• Component/s: security
• Assignee: Tsz-wo Sze
• Reporter: Tsz-wo Sze
• Created: 10/Mar/14 19:44
• Updated: 20/Nov/14 18:47
• Resolved: 22/Mar/14 00:52

Description

//KerberosAuthenticator.java
      if (conn.getResponseCode() == HttpURLConnection.HTTP_OK) {
        LOG.debug("JDK performed authentication on our behalf.");
        // If the JDK already did the SPNEGO back-and-forth for
        // us, just pull out the token.
        AuthenticatedURL.extractToken(conn, token);
        return;
      } else ...

The problem of the code above is that HTTP_OK does not implies authentication completed. We should check if the token can be extracted successfully.

This problem was reported by bowenzhangusa in this comment earlier.

Issue Links

• is broken by: HADOOP-10078 KerberosAuthenticator always does SPNEGO
• is related to: OOZIE-800 Job start/kill gives authorization error
• relates to: HADOOP-10417 There is no token for anonymous authentication
• relates to: HADOOP-10416 For pseudo authentication, what to do if there is an expired token?