[HADOOP-8999] SASL negotiation is flawed

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.3-alpha
• Component/s: ipc
• Hadoop Flags: Incompatible change, Reviewed

Release Note

The RPC SASL negotiation now always ends with final response. If the SASL mechanism does not have a final response (GSSAPI, PLAIN), then an empty success response is sent to the client. The client will now always expect a final response to definitively know if negotiation is complete/successful.

• Assignee: Daryn Sharp
• Reporter: Daryn Sharp
• Created: 31/Oct/12 17:27
• Updated: 03/Sep/14 23:11
• Resolved: 13/Nov/12 17:12

Description

The RPC protocol used for SASL negotiation is flawed. The server's RPC response contains the next SASL challenge token, but a SASL server can return null (I'm done) or a N-many byte challenge. The server currently will not send a RPC success response to the client if the SASL server returns null, which causes the client to hang until it times out.

Issue Links

• relates to: HADOOP-9034 SASL negotiation is insufficient to support all types
• relates to: HBASE-7081 Consider SASL improvements