[HADOOP-11404] Clarify the "expected client Kerberos principal is null" authorization message

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.2.0
• Fix Version/s: 2.9.0, 3.0.0-alpha1
• Component/s: security
• Labels: BB2015-05-TBR supportability
• Assignee: Stephen Chu
• Reporter: Stephen Chu
• Created: 14/Dec/14 07:06
• Updated: 30/Aug/16 01:31
• Resolved: 11/Mar/16 00:43

Description

In ServiceAuthorizationManager#authorize, we throw an AuthorizationException with message "expected client Kerberos principal is null" when authorization fails.

However, this is a confusing log message, because it leads users to believe there was a Kerberos authentication problem, when in fact the the user could have authenticated successfully.

if((clientPrincipal != null && !clientPrincipal.equals(user.getUserName())) || 
       acls.length != 2  || !acls[0].isUserAllowed(user) || acls[1].isUserAllowed(user)) {
      AUDITLOG.warn(AUTHZ_FAILED_FOR + user + " for protocol=" + protocol
          + ", expected client Kerberos principal is " + clientPrincipal);
      throw new AuthorizationException("User " + user + 
          " is not authorized for protocol " + protocol + 
          ", expected client Kerberos principal is " + clientPrincipal);
    }
    AUDITLOG.info(AUTHZ_SUCCESSFUL_FOR + user + " for protocol="+protocol);

In the above code, if clientPrincipal is null, then the user is authenticated successfully but denied by a configured ACL, not a Kerberos issue. We should improve this log message to state this.

Thanks to tlipcon for finding this and proposing a fix.

Issue Links

• is depended upon by: HADOOP-12649 Improve Kerberos diagnostics and failure handling