[ZOOKEEPER-2344] Provide more diagnostics/stack traces on SASL Auth failure

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.4.7, 3.5.1, 3.4.11
• Component/s: java client, server
• Assignee: Unassigned
• Reporter: Steve Loughran
• Created: 15/Dec/15 17:47
• Updated: 22/Jun/18 04:49

Description

When Kerberos decides it doesn't want to work, the JRE libraries provide some terse and unhelpful error messages.

The only way to debug the problem is (a) to have complete stack traces and (b) as much related information as possible.

Zookeeper could do more here. Currently too much of the code loses stack traces; sometimes auth errors aren't reported back to the client (the connection is closed) +others

Everyone who has tried to diagnose kerberos problems will appreciate improvements here

Issue Links

• is related to: HADOOP-12649 Improve Kerberos diagnostics and failure handling
• relates to: ZOOKEEPER-2035 diagnostics on SASL connection problems doesn't match error strings sent back
• relates to: ZOOKEEPER-2346 SASL Auth failure manifested to client as connection refusal

Sub-Tasks

• ServerCnxnFactory.configureSaslLogin() loses stack trace on auth failures: Open