[HADOOP-16214] Kerberos name implementation in Hadoop does not accept principals with more than two components

• Type: Bug
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Component/s: auth
• Assignee: Eric Yang
• Reporter: Issac Buenrostro
• Created: 27/Mar/19 16:14
• Updated: 02/Aug/19 15:55

Description

org.apache.hadoop.security.authentication.util.KerberosName is in charge of converting a Kerberos principal to a user name in Hadoop for all of the services requiring authentication.

Although the Kerberos spec (https://web.mit.edu/kerberos/krb5-1.5/krb5-1.5.4/doc/krb5-user/What-is-a-Kerberos-Principal_003f.html) allows for an arbitrary number of components in the principal, the Hadoop implementation will throw a "Malformed Kerberos name:" error if the principal has more than two components (because the regex can only read serviceName and hostName).