[HDDS-10803] HttpServer fails to start with wildcard principal

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.0, 1.4.1
• Component/s: Security
• Labels: pull-request-available
• Target Version/s: 2.0.0, 1.4.1
• Assignee: Attila Doroszlai
• Reporter: Attila Doroszlai
• Created: 03/May/24 16:48
• Updated: 24/Jul/24 06:40
• Resolved: 04/May/24 11:33

Description

Recon startup fails with ozone.recon.http.auth.kerberos.principal=* due to:

recon_1     | Exception in thread "main" java.lang.NoClassDefFoundError: org/apache/kerby/kerberos/kerb/keytab/Keytab
recon_1     | 	at org.apache.hadoop.security.authentication.util.KerberosUtil.getPrincipalNames(KerberosUtil.java:238)
recon_1     | 	at org.apache.hadoop.security.authentication.util.KerberosUtil.getPrincipalNames(KerberosUtil.java:257)
recon_1     | 	at org.apache.hadoop.security.authentication.server.KerberosAuthenticationHandler.init(KerberosAuthenticationHandler.java:163)
recon_1     | 	at org.apache.hadoop.security.authentication.server.AuthenticationFilter.initializeAuthHandler(AuthenticationFilter.java:194)
recon_1     | 	at org.apache.hadoop.security.authentication.server.AuthenticationFilter.init(AuthenticationFilter.java:180)
...
recon_1     | 	at org.apache.hadoop.hdds.server.http.HttpServer2.start(HttpServer2.java:1184)
recon_1     | 	at org.apache.hadoop.hdds.server.http.BaseHttpServer.start(BaseHttpServer.java:322)
recon_1     | 	at org.apache.hadoop.ozone.recon.ReconServer.start(ReconServer.java:219)

The same problem applies to other Ozone services + the corresponding HTTP auth principal config.

Issue Links

• links to: GitHub Pull Request #6631