Details
-
Bug
-
Status: Resolved
-
Major
-
Resolution: Not A Problem
-
3.2.0
-
None
-
None
Description
On Secure Cluster With hadoop.http.authentication.type simple and hadoop.http.authentication.anonymous.allowed is true, WebHdfs Rest Api fails when user.name is not set. It runs fine if user.name=ambari-qa is set..
[knox@pjosephdocker-1 ~]$ curl -sS -L -w '%{http_code}' -X GET -d '' -H 'Content-Length: 0' --negotiate -u : 'http://pjosephdocker-1.openstacklocal:50070/webhdfs/v1/services/sync/yarn-ats?op=GETFILESTATUS' {"RemoteException":{"exception":"SecurityException","javaClassName":"java.lang.SecurityException","message":"Failed to obtain user group information: java.io.IOException: Security enabled but user not authenticated by filter"}}403[knox@pjosephdocker-1 ~]$
JspHelper#getUGI checks UserGroupInformation.isSecurityEnabled() instead of conf.get(hadoop.http.authentication.type).equals("kerberos") to check if Http is Secure causing the issue.