[HBASE-25051] DIGEST based auth broken for rpc based ConnectionRegistry

• Type: Sub-task
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.0.0-alpha-1, 2.3.0, 1.7.0
• Fix Version/s: 2.6.0, 3.0.0-beta-2
• Component/s: Client, security
• Labels: pull-request-available
• Hadoop Flags: Reviewed
• Release Note: We implement a new way to get information from a server through different rpc preamble headers, and use it to get the cluster id before actually setting up the secure rpc client.
• Assignee: Duo Zhang
• Reporter: Bharath Vissapragada
• Created: 16/Sep/20 16:13
• Updated: 22/Feb/24 11:18
• Resolved: 07/Feb/24 07:45

Description

DIGEST-MD5 based sasl auth depends on cluster-ID to obtain tokens. With master registry, we have a circular dependency here because master registry needs an rpcClient to talk to masters (and to get cluster ID) and rpc-Client needs a clusterId if DIGEST based auth is configured. Earlier, there was a ZK client that has its own authentication mechanism to fetch the cluster ID.

HBASE-23330, I think doesn't fully fix the problem. It depends on an active connection to fetch delegation tokens for the MR job and that inherently assumes that the active connection does not use a DIGEST auth.

It is not clear to me how common it is to use DIGEST based auth in connections.

Issue Links

• is blocked by: HBASE-28312 The bad auth exception can not be passed to client rpc calls properly
• links to: Design Doc
• links to: GitHub Pull Request #5631
• links to: GitHub Pull Request #5632
• links to: GitHub Pull Request #5664