[HADOOP-8830] org.apache.hadoop.security.authentication.server.AuthenticationFilter might be called twice, causing kerberos replay errors

• Type: Bug
• Status: Patch Available
• Priority: Critical
• Resolution: Unresolved
• Affects Version/s: 2.0.1-alpha, 2.1.0-beta, 2.1.1-beta, 2.2.0
• Labels: BB2015-05-TBR
• Assignee: Omkar Vinit Joshi
• Reporter: Moritz Moeller
• Created: 20/Sep/12 12:58
• Updated: 23/Mar/17 15:49

Description

AuthenticationFilter.doFilter is called twice (not sure if that is intentional or not).

The second time it is called the ServletRequest is already authenticated, i.e. httpRequest.getRemoteUser() returns non-null info.

If the kerberos authentication is triggered a second time it'll return a replay attack exception.

I solved this by adding a if (httpRequest.getRemoteUser() == null) at the very beginning of doFilter.

Alternatively one can set an attribute on the request, or figure out why doFilter is called twice.

Issue Links

• duplicates: YARN-621 RM triggers web auth failure before first job
• duplicates: HADOOP-9521 krb5 replay error triggers log file DoS with Safari