[HADOOP-13707] If kerberos is enabled while HTTP SPNEGO is not configured, some links cannot be accessed

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.8.0, 3.0.0-alpha2
• Labels: security
• Target Version/s: 2.8.0, 2.9.0, 3.0.0-alpha2, 2.7.5
• Assignee: Yuanbo Liu
• Reporter: Yuanbo Liu
• Created: 11/Oct/16 10:05
• Updated: 02/Oct/19 17:12
• Resolved: 16/Oct/16 04:29

Description

In HttpServer2#hasAdministratorAccess, it uses `hadoop.security.authorization` to detect whether HTTP is authenticated.
It's not correct, because enabling Kerberos and HTTP SPNEGO are two steps. If Kerberos is enabled while HTTP SPNEGO is not, some links cannot be accessed, such as "/logs", and it will return error message as below:

HTTP ERROR 403
Problem accessing /logs/. Reason:
User dr.who is unauthorized to access this page.

We should make sure HttpServletRequest#getAuthType is not null before we invoke HttpServer2#hasAdministratorAccess.

getAuthType means to get the authorization scheme of this request

Issue Links

• breaks: HADOOP-14024 KMS JMX endpoint throws ClassNotFoundException
• is related to: HADOOP-13119 Add ability to secure log servlet using proxy users