[HDFS-16756] RBF proxies the client's user by the login user to enable CacheEntry

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.0
• Fix Version/s: 3.4.0
• Component/s: rbf
• Labels: pull-request-available
• Target Version/s: 3.4.0
• Hadoop Flags: Reviewed
• Assignee: ZanderXu
• Reporter: ZanderXu
• Created: 05/Sep/22 12:48
• Updated: 28/Jan/24 08:09
• Resolved: 09/Sep/22 07:18

Description

RBF just proxies the client's user by the login user for Kerberos authentication. If the cluster uses the SIMPLE authentication method, the RBF will not proxies the client's user by the login user, the downstream namespace will not use the real clientIp, clientPort, clientId and callId even if the namenode configured dfs.namenode.ip-proxy-users.

 

And the related code as bellow:

UserGroupInformation connUGI = ugi;
if (UserGroupInformation.isSecurityEnabled()) {
  UserGroupInformation routerUser = UserGroupInformation.getLoginUser();
  connUGI = UserGroupInformation.createProxyUser(
      ugi.getUserName(), routerUser);
} 

Issue Links

• relates to: HDFS-15079 RBF: Client maybe get an unexpected result with network anomaly
• relates to: HDFS-13248 RBF: Namenode need to choose block location for the client
• links to: GitHub Pull Request #4853