Uploaded image for project: 'Hadoop HDFS'
  1. Hadoop HDFS
  2. HDFS-14525

JspHelper ignores hadoop.http.authentication.type

VotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Not A Problem
    • 3.2.0
    • None
    • webhdfs
    • None

    Description

      On Secure Cluster With hadoop.http.authentication.type simple and hadoop.http.authentication.anonymous.allowed is true, WebHdfs Rest Api fails when user.name is not set. It runs fine if user.name=ambari-qa is set..

      
      [knox@pjosephdocker-1 ~]$ curl -sS -L -w '%{http_code}' -X GET -d '' -H 'Content-Length: 0' --negotiate -u : 'http://pjosephdocker-1.openstacklocal:50070/webhdfs/v1/services/sync/yarn-ats?op=GETFILESTATUS'
      {"RemoteException":{"exception":"SecurityException","javaClassName":"java.lang.SecurityException","message":"Failed to obtain user group information: java.io.IOException: Security enabled but user not authenticated by filter"}}403[knox@pjosephdocker-1 ~]$ 
      
      

      JspHelper#getUGI checks UserGroupInformation.isSecurityEnabled() instead of conf.get(hadoop.http.authentication.type).equals("kerberos") to check if Http is Secure causing the issue.

      Attachments

        Activity

          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            Unassigned Unassigned
            prabhujoseph Prabhu Joseph
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Slack

                Issue deployment