[HADOOP-15996] Plugin interface to support more complex usernames in Hadoop

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.2.0, 3.3.0, 3.1.2
• Component/s: security

Release Note

This patch enables "Hadoop" and "MIT" as options for "hadoop.security.auth_to_local.mechanism" and defaults to 'hadoop'. This should be backward compatible with pre-HADOOP-12751.

This is basically HADOOP-12751 plus configurable + extended tests.

• Assignee: Bolke de Bruin
• Reporter: Eric Yang
• Created: 10/Dec/18 22:14
• Updated: 08/Jan/19 16:47
• Resolved: 04/Jan/19 23:09

Description

Hadoop does not allow support of @ character in username in recent security mailing list vote to revert HADOOP-12751.  Hadoop auth_to_local rule must match to authorize user to login to Hadoop cluster.  This design does not work well in multi-realm environment where identical username between two realms do not map to the same user.  There is also possibility that lossy regex can incorrectly map users.  In the interest of supporting multi-realms, it maybe preferred to pass principal name without rewrite to uniquely distinguish users.  This jira is to revisit if Hadoop can support full principal names without rewrite and provide a plugin to override Hadoop's default implementation of auth_to_local for multi-realm use case.

Issue Links

• is depended upon by: HADOOP-15922 DelegationTokenAuthenticationFilter get wrong doAsUser since it does not decode URL
• is depended upon by: HADOOP-16023 Support system /etc/krb5.conf for auth_to_local rules
• is related to: HADOOP-16031 TestSecureLogins#testValidKerberosName fails
• relates to: HADOOP-12751 While using kerberos Hadoop incorrectly assumes names with '@' to be non-simple
• relates to: HADOOP-15959 revert HADOOP-12751