[HADOOP-12751] While using kerberos Hadoop incorrectly assumes names with '@' to be non-simple

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.7.2
• Fix Version/s: 2.8.0, 3.0.0-alpha1, 2.7.6
• Component/s: security
• Labels: kerberos

Environment

kerberos

• Hadoop Flags: Reviewed
• Assignee: Bolke de Bruin
• Reporter: Bolke de Bruin
• Created: 29/Jan/16 19:11
• Updated: 10/Dec/18 22:15
• Resolved: 19/Jan/18 00:13

Description

In the scenario of a trust between two directories, eg. FreeIPA (ipa.local) and Active Directory (ad.local) users can be made available on the OS level by something like sssd. The trusted users will be of the form '[e-mail]' while other users are will not contain the domain. Executing 'id -Gn [e-mail]' will successfully return the groups the user belongs to if configured correctly.

However, it is assumed by Hadoop that users of the format with '@' cannot be correct. This code is in KerberosName.java and seems to be a validator if the 'auth_to_local' rules are applied correctly.

In my opinion this should be removed or changed to a different kind of check or maybe logged as a warning while still proceeding, as the current behavior limits integration possibilities with other standard tools.

Workaround are difficult to apply (by having a rewrite by system tools to for example user_ad_local) due to down stream consequences.

Issue Links

• is depended upon by: HADOOP-12649 Improve Kerberos diagnostics and failure handling
• is related to: HIVE-15174 Respect auth_to_local rules from hdfs configs (core-site.xml) for LDAP authentication too
• is related to: HIVE-12981 ThriftCLIService uses incompatible getShortName() implementation
• is related to: HADOOP-15996 Plugin interface to support more complex usernames in Hadoop
• is related to: HADOOP-15959 revert HADOOP-12751