[PHOENIX-5904] Add log if the configed kerberos principal login failed

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: queryserver-6.0.0
• Component/s: queryserver
• Assignee: Guanghao Zhang
• Reporter: Guanghao Zhang
• Created: 19/May/20 11:31
• Updated: 03/Aug/21 08:35
• Resolved: 28/May/20 06:54

Description

SecurityUtil.login(getConf(), QueryServerProperties.QUERY_SERVER_KEYTAB_FILENAME_ATTRIB,
    QueryServerProperties.QUERY_SERVER_KERBEROS_PRINCIPAL_ATTRIB, hostname);
LOG.info("Login successful.");

But SecurityUtil.login may return directly if UserGroupInformation.isSecurityEnabled return false.

 

public static void login(final Configuration conf,
    final String keytabFileKey, final String userNameKey, String hostname)
    throws IOException {
  
  if(!UserGroupInformation.isSecurityEnabled()) 
    return;
  
  String keytabFilename = conf.get(keytabFileKey);
  if (keytabFilename == null || keytabFilename.length() == 0) {
    throw new IOException("Running in secure mode, but config doesn't have a keytab");
  }

  String principalConfig = conf.get(userNameKey, System
      .getProperty("user.name"));
  String principalName = SecurityUtil.getServerPrincipal(principalConfig,
      hostname);
  UserGroupInformation.loginUserFromKeytab(principalName, keytabFilename);
}

UserGroupInformation.isSecurityEnabled is configed by hadoop.security.authentication. But the document only said need to config hbase.security.authentication. So, I thought we need to add document about this, too. 

 

QueryServer doc: https://phoenix.apache.org/server.html

Issue Links

• links to: GitHub Pull Request #34