[HDFS-17276] The nn fetch editlog forbidden in kerberos environment

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.3.5, 3.3.6
• Component/s: qjm, security
• Labels: pull-request-available
• Assignee: Unassigned
• Reporter: kuper
• Created: 06/Dec/23 12:25
• Updated: 09/May/24 17:02

Description

• In a Kerberos environment, the namenode cannot fetch editlog from journalnode because the request is rejected (403).
• GetJournalEditServlet checks if the request's username meets the requirements through the isValidRequestor function. After HDFS-16686 is merged, remotePrincipal becomes ugi.getUserName().
• In a Kerberos environment, ugi.getUserName() gets the request.getRemoteUser() via DfsServlet's getUGI to get the username, and this username is not a full name.
• Therefore, the obtained username is similar to namenode01 instead of namenode01/[e-mail], which meansit fails to pass the isValidRequestor check.

reproduction

• In the TestGetJournalEditServlet add testSecurityRequestNameNode

@Test
public void testSecurityRequestNameNode() throws IOException, ServletException {
  // Test: Make a request from a namenode
  CONF.set(HADOOP_SECURITY_AUTHENTICATION, "kerberos");
  UserGroupInformation.setConfiguration(CONF);
  
  HttpServletRequest request = mock(HttpServletRequest.class);
    when(request.getParameter(UserParam.NAME)).thenReturn("nn/[e-mail]");
  when(request.getRemoteUser()).thenReturn("jn");
  boolean isValid = SERVLET.isValidRequestor(request, CONF);
  
  assertThat(isValid).isTrue();
} 

Issue Links

• links to: GitHub Pull Request #6326