[HADOOP-14330] Kerby breaks multiple SPN support

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Duplicate
• Affects Version/s: 3.0.0-alpha1
• Component/s: security
• Target Version/s: 3.0.0-beta1
• Assignee: Unassigned
• Reporter: Wei-Chiu Chuang
• Created: 20/Apr/17 01:58
• Updated: 23/May/17 20:19
• Resolved: 23/May/17 20:15

Description

Hadoop 3 currently pulls in Kerby 1.0.0 RC2. Via downstream application tests, we found a bug in this version that breaks multiple SPN support implemented in HADOOP-10158, because Kerby can't read keytabs generated by some applications, and it gets malformed SPNs. The bug is fixed by DIRKRB-621, targeting Kerby 1.0.0 GA release.

I also verified this regression is fixed in latest Kerby, by having my local Hadoop repo depend on my local 1.0.0-RC3-SNAPSHOT Kerby artifacts. So the easiest fix is to wait for a Kerby 1.0 RC3/GA, and update Hadoop pom.xml to depend on Kerby 1.0 GA.

The planned alpha 3 release is approaching, so I don't anticipate this can get resolved by then. Beta1 is probably a more realistic target version.

Issue Links

• duplicates: HADOOP-14426 Upgrade Kerby version from 1.0.0-RC2 to 1.0.0