[ZOOKEEPER-2433] ZooKeeperSaslServer: allow user principals in subject

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.5.1
• Fix Version/s: 3.5.2, 3.6.0
• Component/s: security
• Labels: easyfix
• Hadoop Flags: Reviewed
• Flags: Patch
• Assignee: Andy B
• Reporter: Andy B
• Created: 23/May/16 09:47
• Updated: 21/Jul/16 20:18
• Resolved: 15/Jun/16 20:32

Description

The createSaslServer function in ZooKeeperSaslServer handles only service principal names (eg. service_name/machine_name@realm), though sometimes user/service principal names without host name (eg. service_name@realm) are used for authentication.

Issue Links

• Is contained by: ZOOKEEPER-1045 Support Quorum Peer mutual authentication via SASL
• relates to: ZOOKEEPER-1467 Make server principal configurable at client side.
• relates to: HADOOP-10183 Allow use of UPN style principals in keytab files