[HBASE-19852] HBase Thrift 1 server SPNEGO Improvements

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0-alpha-1, 2.1.0
• Component/s: Thrift
• Hadoop Flags: Reviewed

Release Note

Adds two new properties for hbase-site.xml for THRIFT SPNEGO when in HTTP mode:
* hbase.thrift.spnego.keytab.file
* hbase.thrift.spnego.principal

• Assignee: Kevin Risden
• Reporter: Kevin Risden
• Created: 23/Jan/18 22:46
• Updated: 27/Nov/19 04:13
• Resolved: 11/Jun/18 17:58

Description

HBase Thrift1 server has some issues when trying to use SPNEGO.

From mailing list:
http://mail-archives.apache.org/mod_mbox/hbase-user/201801.mbox/%3CCAJU9nmh5YtZ%2BmAQSLo91yKm8pRVzAPNLBU9vdVMCcxHRtRqgoA%40mail.gmail.com%3E

While setting up the HBase Thrift server with HTTP, there were a
significant amount of 401 errors where the HBase Thrift wasn't able to
handle the incoming Kerberos request. Documentation online is sparse when
it comes to setting up the principal/keytab for HTTP Kerberos.

I noticed that the HBase Thrift HTTP implementation was missing SPNEGO
principal/keytab like other Thrift based servers (HiveServer2). It looks
like HiveServer2 Thrift implementation and HBase Thrift v1 implementation
were very close to the same at one point. I made the following changes to
HBase Thrift v1 server implementation to make it work:

• add SPNEGO principal/keytab if in HTTP mode
• return 401 immediately if no authorization header instead of waiting for
  try/catch down in program flow

Issue Links

• causes: HBASE-23312 HBase Thrift SPNEGO configs (HBASE-19852) should be backwards compatible
• links to: Review Board (master)