[YARN-4006] YARN AltKerberos HTTP Authentication doesn't work

• Type: Improvement
• Status: Open
• Priority: Blocker
• Resolution: Unresolved
• Affects Version/s: 2.5.0, 2.6.0, 2.7.0, 2.5.1, 2.6.1, 2.8.0, 2.7.1, 2.7.2
• Component/s: security, timelineserver
• Assignee: Unassigned
• Reporter: Greg Senia
• Created: 31/Jul/15 17:20
• Updated: 10/Oct/17 18:55

Description

When attempting to use The Hadoop Alternate Authentication Classes. They do not exactly work with what was built with YARN-1935.

I went ahead and made the following changes to support using a Custom AltKerberos DelegationToken custom class.

Changes to: TimelineAuthenticationFilterInitializer.class

   String authType = filterConfig.get(AuthenticationFilter.AUTH_TYPE);


    LOG.info("AuthType Configured: "+authType);
    if (authType.equals(PseudoAuthenticationHandler.TYPE)) {

      filterConfig.put(AuthenticationFilter.AUTH_TYPE,
          PseudoDelegationTokenAuthenticationHandler.class.getName());
        LOG.info("AuthType: PseudoDelegationTokenAuthenticationHandler");

    } else if (authType.equals(KerberosAuthenticationHandler.TYPE) || (UserGroupInformation.isSecurityEnabled() && conf.get("hadoop.security.authentication").equals(KerberosAuthenticationHandler.TYPE))) {

      if (!(authType.equals(KerberosAuthenticationHandler.TYPE))) {
        filterConfig.put(AuthenticationFilter.AUTH_TYPE,
          authType);
        LOG.info("AuthType: "+authType);
      } else {
        filterConfig.put(AuthenticationFilter.AUTH_TYPE,
          KerberosDelegationTokenAuthenticationHandler.class.getName());
        LOG.info("AuthType: KerberosDelegationTokenAuthenticationHandler");
      } 


      // Resolve _HOST into bind address
      String bindAddress = conf.get(HttpServer2.BIND_ADDRESS);
      String principal =
          filterConfig.get(KerberosAuthenticationHandler.PRINCIPAL);
      if (principal != null) {
        try {
          principal = SecurityUtil.getServerPrincipal(principal, bindAddress);
        } catch (IOException ex) {
          throw new RuntimeException(
              "Could not resolve Kerberos principal name: " + ex.toString(), ex);
        }
        filterConfig.put(KerberosAuthenticationHandler.PRINCIPAL,
            principal);
      }
    }
 

Issue Links

• is related to: YARN-1935 Security for timeline server
• is related to: HADOOP-9054 Add AuthenticationHandler that uses Kerberos but allows for an alternate form of authentication for browsers
• is related to: HADOOP-12082 Support multiple authentication schemes via AuthenticationFilter