[LIVY-692] Thrift server Kerberos authentication does not use configured principal

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Bug
• Affects Version/s: 0.6.0
• Component/s: Thriftserver
• Assignee: Unassigned
• Reporter: Wing Yew Poon
• Created: 05/Oct/19 01:50
• Updated: 16/Oct/19 22:24
• Resolved: 16/Oct/19 22:19

Description

I tried to use the Thrift server in Livy 0.6. I have a secure cluster, and I set

livy.server.thrift.authentication=KERBEROS

on the server side. I also have livy.server.auth.kerberos.keytab and livy.server.auth.kerberos.principal configured. In particular, in my system, I have

livy.server.auth.kerberos.principal=HTTP/<livy_server>@<REALM>

When I try to connect to the Thrift server using the beeline shipped with Hive, with

beeline -u 'jdbc:hive2://<livy_server>:<thrift_port>/<db>;principal=HTTP/<livy_server>@<REALM>'

it fails with

Error: Could not open client transport with JDBC Uri: ... :: Peer indicated failure: GSS initiate failed (state=08S01,code=0)

On the server side, the log shows

2019-10-03 15:21:09,536 ERROR org.apache.thrift.transport.TSaslTransport: SASL negotiation failure
javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: Failure unspecified at GSS-API level (Mechanism level: Invalid argument (400) - Cannot find key of appropriate type to decrypt AP REP - DES3 CBC mode with SHA1-KD)]
	at com.sun.security.sasl.gsskerb.GssKrb5Server.evaluateResponse(GssKrb5Server.java:199)
	at org.apache.thrift.transport.TSaslTransport$SaslParticipant.evaluateChallengeOrResponse(TSaslTransport.java:539)
	at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:283)
	at org.apache.thrift.transport.TSaslServerTransport.open(TSaslServerTransport.java:41)
	at org.apache.thrift.transport.TSaslServerTransport$Factory.getTransport(TSaslServerTransport.java:216)
	at org.apache.livy.thriftserver.auth.TUGIAssumingTransportFactory$$anon$1.run(AuthBridgeServer.scala:143)
	at org.apache.livy.thriftserver.auth.TUGIAssumingTransportFactory$$anon$1.run(AuthBridgeServer.scala:142)
	at java.security.AccessController.doPrivileged(Native Method)
	at javax.security.auth.Subject.doAs(Subject.java:360)
	at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1710)
	at org.apache.livy.thriftserver.auth.TUGIAssumingTransportFactory.getTransport(AuthBridgeServer.scala:142)
	at org.apache.thrift.server.TThreadPoolServer$WorkerProcess.run(TThreadPoolServer.java:269)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
	at java.lang.Thread.run(Thread.java:748)
Caused by: GSSException: Failure unspecified at GSS-API level (Mechanism level: Invalid argument (400) - Cannot find key of appropriate type to decrypt AP REP - DES3 CBC mode with SHA1-KD)
	at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:856)
	at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)
	at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)
	at com.sun.security.sasl.gsskerb.GssKrb5Server.evaluateResponse(GssKrb5Server.java:167)
	... 14 more
Caused by: KrbException: Invalid argument (400) - Cannot find key of appropriate type to decrypt AP REP - DES3 CBC mode with SHA1-KD
	at sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:278)
	at sun.security.krb5.KrbApReq.<init>(KrbApReq.java:149)
	at sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:108)
	at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:829)
	... 17 more

On debugging, I found that the UGI in the TUGIAssumingTransportFactory is not that of the configured HTTP principal but the UGI of the service principal (livy).

Issue Links

• links to: GitHub Pull Request #241