Details
-
Improvement
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
3.4.0, 3.3.5
-
Running in Kubernetes using Java 11 in an HA configuration. JournalNodes run on separate pods and have their own Kerberos principal "jn/<hostname>@<realm>".
Description
GetJournalEditServlet uses request.getRemoteuser() to determine the remoteShortName for Kerberos authorization, which fails to match when the JournalNode uses its own Kerberos principal (e.g. jn/<hostname>@<realm>).
This can be fixed by using the UserGroupInformation provided by the base DfsServlet class using the getUGI(request, conf) call.
Attachments
Issue Links
- is a child of
-
HADOOP-18396 Issues running in dynamic / managed environments
- In Progress
- links to