[HDFS-2617] Replaced Kerberized SSL for image transfer and fsck with SPNEGO-based solution

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0-alpha
• Fix Version/s: 1.1.0, 2.0.2-alpha
• Component/s: security
• Target Version/s: 1.1.0, 2.0.0-alpha
• Hadoop Flags: Incompatible change, Reviewed

Release Note

Due to the requirement that KSSL use weak encryption types for Kerberos tickets, HTTP authentication to the NameNode will now use SPNEGO by default. This will require users of previous branch-1 releases with security enabled to modify their configurations and create new Kerberos principals in order to use SPNEGO. The old behavior of using KSSL can optionally be enabled by setting the configuration option "hadoop.security.use-weak-http-crypto" to "true".

• Assignee: Jakob Homan
• Reporter: Jakob Homan
• Created: 01/Dec/11 02:37
• Updated: 02/May/13 02:29
• Resolved: 19/Jul/12 23:18

Description

The current approach to secure and authenticate nn web services is based on Kerberized SSL and was developed when a SPNEGO solution wasn't available. Now that we have one, we can get rid of the non-standard KSSL and use SPNEGO throughout. This will simplify setup and configuration. Also, Kerberized SSL is a non-standard approach with its own quirks and dark corners (HDFS-2386).

Issue Links

• breaks: HDFS-3434 InvalidProtocolBufferException when visiting DN browseDirectory.jsp
• breaks: HDFS-3698 TestHftpFileSystem is failing in branch-1 due to changed default secure port
• is depended upon by: HDFS-3348 After HDFS-2617 can't use 0.0.0.0 in dfs.http.address
• is related to: HDFS-3426 Replaced Kerberized SSL for journal segment transfer with SPNEGO-based solution
• is related to: HDFS-3989 Remove duplicate Http server SSL code
• is related to: HDFS-3461 HFTP should use the same port & protocol for getting the delegation token
• relates to: HDFS-2386 with security enabled fsck calls lead to handshake_failure and hftp fails throwing the same exception in the logs

Sub-Tasks

• HftpFileSystem should try both KSSL and SPNEGO when authentication is required: Closed