[KUDU-2032] Kerberos authentication fails with rdns disabled in krb5.conf

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.3.1, 1.4.0
• Fix Version/s: 1.3.2, 1.5.0, 1.4.1
• Component/s: security
• Assignee: Todd Lipcon
• Reporter: Todd Lipcon
• Created: 06/Jun/17 19:02
• Updated: 05/Oct/17 21:08
• Resolved: 05/Oct/17 21:08

Description

Currently if 'rnds = false' is configured in krb5.conf, Kudu ends up using the IP addresses of remote hosts instead of the hostnames. This means that it will look for krb5 principals by IP, even if actual hostnames have been passed instead.

This prevents krb5 from working properly in most environments where rdns=false is set.

Issue Links

• is related to: KUDU-2096 Document necessary configuration for Kerberos with master CNAMEs