[HADOOP-13119] Add ability to secure log servlet using proxy users

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.8.0, 2.7.4
• Fix Version/s: 2.9.0, 2.7.4, 3.0.0-alpha4, 2.8.2
• Labels: security
• Hadoop Flags: Incompatible change
• Assignee: Yuanbo Liu
• Reporter: Jeffrey E Rodriguez
• Created: 08/May/16 18:15
• Updated: 08/May/19 23:28
• Resolved: 10/Feb/17 15:05

Description

User Hadoop on secure mode.
login as kdc user, kinit.
start firefox and enable Kerberos
access http://localhost:50070/logs/
Get 403 authorization errors.
only hdfs user could access logs.
Would expect as a user to be able to web interface logs link.
Same results if using curl:
curl -v --negotiate -u tester: http://localhost:50070/logs/
HTTP/1.1 403 User tester is unauthorized to access this page.
so:
1. either don't show links if hdfs user is able to access.
2. provide mechanism to add users to web application realm.
3. note that we are pass authentication so the issue is authorization to /logs/

suspect that /logs/ path is secure in webdescriptor so suspect users by default don't have access to secure paths.

Issue Links

• breaks: HADOOP-14728 Configuring AuthenticationFilterInitializer throws IllegalArgumentException: Null user
• duplicates: HADOOP-13718 There is no filterInitializer for initializing DelegationTokenAuthenticationFilter in Hadoop common
• is related to: HADOOP-16287 KerberosAuthenticationHandler Trusted Proxy Support for Knox
• is related to: HADOOP-14077 Improve the patch of HADOOP-13119
• relates to: HADOOP-14060 HTTP servlet /logs should require authentication and authorization
• relates to: HADOOP-13707 If kerberos is enabled while HTTP SPNEGO is not configured, some links cannot be accessed