[ZOOKEEPER-1195] SASL authorizedID being incorrectly set: should use getHostName() rather than getServiceName()

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.0
• Fix Version/s: 3.4.0
• Release Note: One-line fix for bug identified by Tom Klonikowski
• Assignee: Eugene Joseph Koontz
• Reporter: Eugene Joseph Koontz
• Created: 20/Sep/11 15:15
• Updated: 02/May/13 02:29
• Resolved: 29/Sep/11 07:42

Description

Tom Klonikowski writes:

Hello developers,

the SaslServerCallbackHandler in trunk changes the principal name
service/host@REALM to service/service@REALM (i guess unintentionally).

lines 131-133:
if (!removeHost() && (kerberosName.getHostName() != null))

{ userName += "/" + kerberosName.getServiceName(); }

Server Log:

SaslServerCallbackHandler@115] - Successfully authenticated client:
authenticationID=fetcher/ubook@QUINZOO;
authorizationID=fetcher/ubook@QUINZOO.

SaslServerCallbackHandler@137] - Setting authorizedID:
fetcher/fetcher@QUINZOO

Issue Links

• depends upon: ZOOKEEPER-938 Support Kerberos authentication of clients.
• is part of: ZOOKEEPER-1201 Clean SaslServerCallbackHandler.java
• relates to: ZOOKEEPER-1196 improve Kerberos name parsing and canonicalization testing