[HADOOP-10418] SaslRpcClient should not assume that remote principals are in the default_realm

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.4.0
• Fix Version/s: 2.5.0
• Component/s: security
• Target Version/s: 2.5.0
• Hadoop Flags: Reviewed
• Assignee: Aaron Myers
• Reporter: Aaron Myers
• Created: 22/Mar/14 01:29
• Updated: 30/Jun/15 07:11
• Resolved: 24/Mar/14 00:03

Description

In SaslRpcClient#getServerPrincipal, when constructing the KerberosPrincipal to compare to the configured value, we just assume that the remote principal is in the default realm configured in /etc/krb5.conf. This will not always be the case, however. Instead, we should use the configured domain_realm mapping to determine the realm of the remote principal.