[HDFS-8572] DN always uses HTTP/localhost@REALM principals in SPNEGO

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 2.8.0, 2.7.1, 3.0.0-alpha1
• Target Version/s: 2.7.1
• Hadoop Flags: Reviewed
• Assignee: Haohui Mai
• Reporter: Haohui Mai
• Created: 10/Jun/15 18:23
• Updated: 05/Jan/17 22:43
• Resolved: 12/Jun/15 02:31

Description

In HDFS-7279 the Netty server in DN proxies all servlet requests to the local Jetty instance.

The Jetty server is configured incorrectly so that it always uses HTTP/locahost@REALM to authenticate spnego requests. As a result, servlets like JMX are no longer accessible in secure deployments.

Issue Links

• breaks: HDFS-9045 DatanodeHttpServer is not setting Endpoint based on configured policy and not loading ssl configuration.
• breaks: HDFS-8596 TestDistributedFileSystem et al tests are broken in branch-2 due to incorrect setting of "datanode" attribute
• is broken by: HDFS-7279 Use netty to implement DatanodeWebHdfsMethods
• is related to: HDFS-8588 DN should not support SPNEGO authenticator