[HADOOP-9446] Support Kerberos HTTP SPNEGO authentication for non-SUN JDK

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.1.1, 2.0.2-alpha
• Fix Version/s: 2.1.1-beta
• Component/s: security
• Hadoop Flags: Reviewed
• Assignee: Yu Gao
• Reporter: Yu Gao
• Created: 01/Apr/13 09:28
• Updated: 24/Sep/13 23:33
• Resolved: 13/Aug/13 23:16

Description

Class KerberosAuthenticator and KerberosAuthenticationHandler currently only support running with SUN JDK when Kerberos is enabled. In order to support alternative JDKs like IBM JDK which has different options supported by Krb5LoginModule and different login module classes, the HTTP Kerberos authentication classes need to be changed.

In addition, NT_GSS_KRB5_PRINCIPAL, which is used in KerberosAuthenticator to get the corresponding oid instance, is a field defined in SUN JDK, but not in IBM JDK.

This JIRA is to fix the existing problems and add support for Kerberos HTTP SPNEGO authentication with non-SUN　JDK.