[KNOX-1959] HadoopAuthCookieStore should not read krb5 login config each time

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.4.0
• Assignee: Kevin Risden
• Reporter: Kevin Risden
• Created: 31/Jul/19 17:45
• Updated: 31/Jul/19 19:21
• Resolved: 31/Jul/19 18:49

Description

Currently HadoopAuthCookieStore isKnoxCookie checks the configured principal over and over again from krb5 login config file on each cookie. This is unnecessary and can be improved.

Specifically the following section doesn't need to read the krb5 login config each time. We can do this once in the constructor. We should not expect krb5 config to change from underneath us.

        if (principal != null) {
            String krb5Config = config.getKerberosLoginConfig();
            if (krb5Config != null && !krb5Config.isEmpty()) {
              Properties p = new Properties();
              try (InputStream in = Files.newInputStream(Paths.get(krb5Config))){
                p.load(in);
                String configuredPrincipal = p.getProperty("principal");
                // Strip off enclosing quotes, if present
                if (configuredPrincipal.startsWith("\"")) {
                  configuredPrincipal = configuredPrincipal.substring(1, configuredPrincipal.length() - 1);
                }
                // Check if they're the same principal
                result = principal.equals(configuredPrincipal);
              } catch (IOException e) {
                LOG.errorReadingKerberosLoginConfig(krb5Config, e);
              }
            }
          }

Issue Links

• is related to: KNOX-1962 CM discovery - Avoid reading krb5 login config multiple times
• relates to: KNOX-1624 Ensure streams and readers are properly closed
• links to: GitHub Pull Request #124