[HDFS-16686] GetJournalEditServlet fails to authorize valid Kerberos request

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.0, 3.3.5
• Fix Version/s: 3.4.0, 3.3.5
• Component/s: journal-node
• Labels: pull-request-available

Environment

Running in Kubernetes using Java 11 in an HA configuration.  JournalNodes run on separate pods and have their own Kerberos principal "jn/<hostname>@<realm>".

• Target Version/s: 3.4.0, 3.3.5
• Hadoop Flags: Reviewed
• Assignee: Steve Vaughan
• Reporter: Steve Vaughan
• Created: 25/Jul/22 14:41
• Updated: 13/Sep/22 17:50
• Resolved: 13/Sep/22 17:50

Description

GetJournalEditServlet uses request.getRemoteuser() to determine the remoteShortName for Kerberos authorization, which fails to match when the JournalNode uses its own Kerberos principal (e.g. jn/<hostname>@<realm>).

This can be fixed by using the UserGroupInformation provided by the base DfsServlet class using the getUGI(request, conf) call.

Issue Links

• is a child of: HADOOP-18396 Issues running in dynamic / managed environments
• links to: GitHub Pull Request #4724
• links to: GitHub Pull Request #4794