Hadoop Common
  1. Hadoop Common
  2. HADOOP-10918

JMXJsonServlet fails when used within Tomcat

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: 2.4.1
    • Fix Version/s: 2.6.0
    • Component/s: None
    • Labels:
      None
    • Target Version/s:
    • Hadoop Flags:
      Reviewed

      Description

      JMXJsonServlet.doGet() has the following check:

            if (!HttpServer2.isInstrumentationAccessAllowed(getServletContext(),
                                                           request, response)) {
      

      Loading the class HttpServer2 triggers loading Jetty specific classes:

      SEVERE: Servlet.service() for servlet jmx-servlet threw exception
      java.lang.ClassNotFoundException: org.mortbay.jetty.servlet.Context
              at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1680)
              at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1526)
              at org.apache.hadoop.jmx.JMXJsonServlet.doGet(JMXJsonServlet.java:157)
              at javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
              at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
              at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
              at org.apache.hadoop.crypto.key.kms.server.KMSMDCFilter.doFilter(KMSMDCFilter.java:84)
              at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
              at org.apache.hadoop.security.authentication.server.AuthenticationFilter.doFilter(AuthenticationFilter.java:438)
              at org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticationFilter.doFilter(DelegationTokenAuthenticationFilter.java:255)
              at org.apache.hadoop.security.authentication.server.AuthenticationFilter.doFilter(AuthenticationFilter.java:408)
              at org.apache.hadoop.crypto.key.kms.server.KMSAuthenticationFilter.doFilter(KMSAuthenticationFilter.java:128)
              at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
              at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
              at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
              at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
              at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
              at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
              at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
              at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:861)
              at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:606)
              at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
              at java.lang.Thread.run(Thread.java:695)
      Jul 31, 2014 2:46:24 PM org.apache.catalina.core.StandardWrapperValve invoke
      

      Because of this the JMX servlet fails to work in KMS

      1. HADOOP-10918.patch
        7 kB
        Alejandro Abdelnur
      2. HADOOP-10918.patch
        4 kB
        Alejandro Abdelnur

        Activity

        Hide
        Alejandro Abdelnur added a comment -

        Adding a protected method isInstrumentationAccessAllowed that can be overridden by services not running with Jetty

        Show
        Alejandro Abdelnur added a comment - Adding a protected method isInstrumentationAccessAllowed that can be overridden by services not running with Jetty
        Hide
        Alejandro Abdelnur added a comment -

        Patch that adds a method to the JMX servlet to allow subclassing and overriding the authorization check. It also changes the "UNAUTHORIZED" response to "FORBIDDEN" in HttpServer2 as UNAUTHORIZED on its own should indicate also the expected authentication mechanism.

        It also wires a subclassed JMX servlet for KMS.

        I've tested on local deployment that JMX works fine from KMS with the change (cannot do testcase for that).

        Show
        Alejandro Abdelnur added a comment - Patch that adds a method to the JMX servlet to allow subclassing and overriding the authorization check. It also changes the "UNAUTHORIZED" response to "FORBIDDEN" in HttpServer2 as UNAUTHORIZED on its own should indicate also the expected authentication mechanism. It also wires a subclassed JMX servlet for KMS. I've tested on local deployment that JMX works fine from KMS with the change (cannot do testcase for that).
        Hide
        Hadoop QA added a comment -

        -1 overall. Here are the results of testing the latest attachment
        http://issues.apache.org/jira/secure/attachment/12659176/HADOOP-10918.patch
        against trunk revision .

        +1 @author. The patch does not contain any @author tags.

        -1 tests included. The patch doesn't appear to include any new or modified tests.
        Please justify why no new tests are needed for this patch.
        Also please list what manual steps were performed to verify this patch.

        +1 javac. The applied patch does not increase the total number of javac compiler warnings.

        +1 javadoc. There were no new javadoc warning messages.

        +1 eclipse:eclipse. The patch built with eclipse:eclipse.

        +1 findbugs. The patch does not introduce any new Findbugs (version 2.0.3) warnings.

        +1 release audit. The applied patch does not increase the total number of release audit warnings.

        -1 core tests. The patch failed these unit tests in hadoop-common-project/hadoop-common hadoop-common-project/hadoop-kms:

        org.apache.hadoop.http.TestHttpServer

        +1 contrib tests. The patch passed contrib unit tests.

        Test results: https://builds.apache.org/job/PreCommit-HADOOP-Build/4400//testReport/
        Console output: https://builds.apache.org/job/PreCommit-HADOOP-Build/4400//console

        This message is automatically generated.

        Show
        Hadoop QA added a comment - -1 overall . Here are the results of testing the latest attachment http://issues.apache.org/jira/secure/attachment/12659176/HADOOP-10918.patch against trunk revision . +1 @author . The patch does not contain any @author tags. -1 tests included . The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch. +1 javac . The applied patch does not increase the total number of javac compiler warnings. +1 javadoc . There were no new javadoc warning messages. +1 eclipse:eclipse . The patch built with eclipse:eclipse. +1 findbugs . The patch does not introduce any new Findbugs (version 2.0.3) warnings. +1 release audit . The applied patch does not increase the total number of release audit warnings. -1 core tests . The patch failed these unit tests in hadoop-common-project/hadoop-common hadoop-common-project/hadoop-kms: org.apache.hadoop.http.TestHttpServer +1 contrib tests . The patch passed contrib unit tests. Test results: https://builds.apache.org/job/PreCommit-HADOOP-Build/4400//testReport/ Console output: https://builds.apache.org/job/PreCommit-HADOOP-Build/4400//console This message is automatically generated.
        Hide
        Alejandro Abdelnur added a comment -

        new patch fixing testcases because of the change from unauthorized to forbidden.

        Show
        Alejandro Abdelnur added a comment - new patch fixing testcases because of the change from unauthorized to forbidden.
        Hide
        Andrew Wang added a comment -

        You preempted both of my review comments +1 pending Jenkins

        Show
        Andrew Wang added a comment - You preempted both of my review comments +1 pending Jenkins
        Hide
        Hadoop QA added a comment -

        +1 overall. Here are the results of testing the latest attachment
        http://issues.apache.org/jira/secure/attachment/12659208/HADOOP-10918.patch
        against trunk revision .

        +1 @author. The patch does not contain any @author tags.

        +1 tests included. The patch appears to include 1 new or modified test files.

        +1 javac. The applied patch does not increase the total number of javac compiler warnings.

        +1 javadoc. There were no new javadoc warning messages.

        +1 eclipse:eclipse. The patch built with eclipse:eclipse.

        +1 findbugs. The patch does not introduce any new Findbugs (version 2.0.3) warnings.

        +1 release audit. The applied patch does not increase the total number of release audit warnings.

        +1 core tests. The patch passed unit tests in hadoop-common-project/hadoop-common hadoop-common-project/hadoop-kms.

        +1 contrib tests. The patch passed contrib unit tests.

        Test results: https://builds.apache.org/job/PreCommit-HADOOP-Build/4402//testReport/
        Console output: https://builds.apache.org/job/PreCommit-HADOOP-Build/4402//console

        This message is automatically generated.

        Show
        Hadoop QA added a comment - +1 overall . Here are the results of testing the latest attachment http://issues.apache.org/jira/secure/attachment/12659208/HADOOP-10918.patch against trunk revision . +1 @author . The patch does not contain any @author tags. +1 tests included . The patch appears to include 1 new or modified test files. +1 javac . The applied patch does not increase the total number of javac compiler warnings. +1 javadoc . There were no new javadoc warning messages. +1 eclipse:eclipse . The patch built with eclipse:eclipse. +1 findbugs . The patch does not introduce any new Findbugs (version 2.0.3) warnings. +1 release audit . The applied patch does not increase the total number of release audit warnings. +1 core tests . The patch passed unit tests in hadoop-common-project/hadoop-common hadoop-common-project/hadoop-kms. +1 contrib tests . The patch passed contrib unit tests. Test results: https://builds.apache.org/job/PreCommit-HADOOP-Build/4402//testReport/ Console output: https://builds.apache.org/job/PreCommit-HADOOP-Build/4402//console This message is automatically generated.
        Hide
        Alejandro Abdelnur added a comment -

        Committed to trunk.

        Show
        Alejandro Abdelnur added a comment - Committed to trunk.
        Hide
        Hudson added a comment -

        FAILURE: Integrated in Hadoop-trunk-Commit #6015 (See https://builds.apache.org/job/Hadoop-trunk-Commit/6015/)
        HADOOP-10918. JMXJsonServlet fails when used within Tomcat. (tucu) (tucu: http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1616002)

        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt
        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/jmx/JMXJsonServlet.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServer.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSJMXServlet.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/webapp/WEB-INF/web.xml
        Show
        Hudson added a comment - FAILURE: Integrated in Hadoop-trunk-Commit #6015 (See https://builds.apache.org/job/Hadoop-trunk-Commit/6015/ ) HADOOP-10918 . JMXJsonServlet fails when used within Tomcat. (tucu) (tucu: http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1616002 ) /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/jmx/JMXJsonServlet.java /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServer.java /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSJMXServlet.java /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/webapp/WEB-INF/web.xml
        Hide
        Hudson added a comment -

        FAILURE: Integrated in Hadoop-Yarn-trunk #635 (See https://builds.apache.org/job/Hadoop-Yarn-trunk/635/)
        HADOOP-10918. JMXJsonServlet fails when used within Tomcat. (tucu) (tucu: http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1616002)

        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt
        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/jmx/JMXJsonServlet.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServer.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSJMXServlet.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/webapp/WEB-INF/web.xml
        Show
        Hudson added a comment - FAILURE: Integrated in Hadoop-Yarn-trunk #635 (See https://builds.apache.org/job/Hadoop-Yarn-trunk/635/ ) HADOOP-10918 . JMXJsonServlet fails when used within Tomcat. (tucu) (tucu: http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1616002 ) /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/jmx/JMXJsonServlet.java /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServer.java /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSJMXServlet.java /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/webapp/WEB-INF/web.xml
        Hide
        Hudson added a comment -

        FAILURE: Integrated in Hadoop-Hdfs-trunk #1829 (See https://builds.apache.org/job/Hadoop-Hdfs-trunk/1829/)
        HADOOP-10918. JMXJsonServlet fails when used within Tomcat. (tucu) (tucu: http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1616002)

        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt
        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/jmx/JMXJsonServlet.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServer.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSJMXServlet.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/webapp/WEB-INF/web.xml
        Show
        Hudson added a comment - FAILURE: Integrated in Hadoop-Hdfs-trunk #1829 (See https://builds.apache.org/job/Hadoop-Hdfs-trunk/1829/ ) HADOOP-10918 . JMXJsonServlet fails when used within Tomcat. (tucu) (tucu: http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1616002 ) /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/jmx/JMXJsonServlet.java /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServer.java /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSJMXServlet.java /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/webapp/WEB-INF/web.xml
        Hide
        Hudson added a comment -

        FAILURE: Integrated in Hadoop-Mapreduce-trunk #1855 (See https://builds.apache.org/job/Hadoop-Mapreduce-trunk/1855/)
        HADOOP-10918. JMXJsonServlet fails when used within Tomcat. (tucu) (tucu: http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1616002)

        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt
        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/jmx/JMXJsonServlet.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServer.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSJMXServlet.java
        • /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/webapp/WEB-INF/web.xml
        Show
        Hudson added a comment - FAILURE: Integrated in Hadoop-Mapreduce-trunk #1855 (See https://builds.apache.org/job/Hadoop-Mapreduce-trunk/1855/ ) HADOOP-10918 . JMXJsonServlet fails when used within Tomcat. (tucu) (tucu: http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1616002 ) /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/jmx/JMXJsonServlet.java /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServer.java /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSJMXServlet.java /hadoop/common/trunk/hadoop-common-project/hadoop-kms/src/main/webapp/WEB-INF/web.xml

          People

          • Assignee:
            Alejandro Abdelnur
            Reporter:
            Alejandro Abdelnur
          • Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development