Author: jitendra
Date: Tue Sep 27 02:59:45 2011
New Revision: 1176184
URL: http://svn.apache.org/viewvc?rev=1176184&view=rev
Log:
Merged r1176182 from branch-0.20-security for HDFS-2361.
Modified:
hadoop/common/branches/branch-0.20-security-205/CHANGES.txt (contents,
props changed)
hadoop/common/branches/branch-0.20-security-205/src/hdfs/org/apache/hadoop/hdfs/server/namenode/JspHelper.java
Modified: hadoop/common/branches/branch-0.20-security-205/CHANGES.txt
URL:
http://svn.apache.org/viewvc/hadoop/common/branches/branch-0.20-security-205/CHANGES.txt?rev=1176184&r1=1176183&r2=1176184&view=diff
==============================================================================
--- hadoop/common/branches/branch-0.20-security-205/CHANGES.txt (original)
+++ hadoop/common/branches/branch-0.20-security-205/CHANGES.txt Tue Sep 27
02:59:45 2011
@@ -220,6 +220,8 @@ Release 0.20.205.0 - 2011.09.12
HDFS-2366. Initialize WebHdfsFileSystem.ugi in object construction.
(szetszwo)
+ HDFS-2361. hftp is broken. Fixed username checks in JspHelper. (jitendra)
+
IMPROVEMENTS
MAPREDUCE-2928. MR-2413 improvements (Eli Collins via mattf)
Propchange: hadoop/common/branches/branch-0.20-security-205/CHANGES.txt
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Tue Sep 27 02:59:45 2011
@@ -1,6 +1,6 @@
/hadoop/common/branches/branch-0.20/CHANGES.txt:826138,826568,829987,831184,833001,880632,898713,909245,909723,960946,990003,1044225
/hadoop/common/branches/branch-0.20-append/CHANGES.txt:955380,955398,955448,956329
-/hadoop/common/branches/branch-0.20-security/CHANGES.txt:1170042,1170087,1170997,1171137,1171181,1171380,1171613,1171891,1171905,1172184,1172188,1172190,1172192,1173470,1173843,1174326,1174471,1174476,1174482,1175114,1176179
+/hadoop/common/branches/branch-0.20-security/CHANGES.txt:1170042,1170087,1170997,1171137,1171181,1171380,1171613,1171891,1171905,1172184,1172188,1172190,1172192,1173470,1173843,1174326,1174471,1174476,1174482,1175114,1176179,1176182
/hadoop/common/branches/branch-0.20-security-203/CHANGES.txt:1096071,1097011,1097249,1097269,1097281,1097966,1098816,1098819,1098823,1098827,1098832,1098839,1098854,1098863,1099088,1099191,1099324,1099330,1099333,1102071,1128115
/hadoop/common/branches/branch-0.20-security-204/CHANGES.txt:1128390,1147228,1148069,1149316,1154413,1159730,1161741
/hadoop/core/branches/branch-0.18/CHANGES.txt:727226
Modified:
hadoop/common/branches/branch-0.20-security-205/src/hdfs/org/apache/hadoop/hdfs/server/namenode/JspHelper.java
URL:
http://svn.apache.org/viewvc/hadoop/common/branches/branch-0.20-security-205/src/hdfs/org/apache/hadoop/hdfs/server/namenode/JspHelper.java?rev=1176184&r1=1176183&r2=1176184&view=diff
==============================================================================
---
hadoop/common/branches/branch-0.20-security-205/src/hdfs/org/apache/hadoop/hdfs/server/namenode/JspHelper.java
(original)
+++
hadoop/common/branches/branch-0.20-security-205/src/hdfs/org/apache/hadoop/hdfs/server/namenode/JspHelper.java
Tue Sep 27 02:59:45 2011
@@ -53,6 +53,7 @@ import org.apache.hadoop.hdfs.web.resour
import org.apache.hadoop.http.HtmlQuoting;
import org.apache.hadoop.net.NetUtils;
import org.apache.hadoop.security.AccessControlException;
+import org.apache.hadoop.security.KerberosName;
import org.apache.hadoop.security.SecurityUtil;
import org.apache.hadoop.security.UserGroupInformation;
import org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod;
@@ -464,7 +465,8 @@ public class JspHelper {
DelegationTokenIdentifier id = new DelegationTokenIdentifier();
id.readFields(in);
ugi = id.getUser();
- checkUsername(ugi.getUserName(), user);
+ checkUsername(ugi.getShortUserName(), usernameFromQuery);
+ checkUsername(ugi.getShortUserName(), user);
ugi.addToken(token);
ugi.setAuthenticationMethod(AuthenticationMethod.TOKEN);
} else {
@@ -473,13 +475,11 @@ public class JspHelper {
"authenticated by filter");
}
ugi = UserGroupInformation.createRemoteUser(user);
+ checkUsername(ugi.getShortUserName(), usernameFromQuery);
// This is not necessarily true, could have been auth'ed by user-facing
// filter
ugi.setAuthenticationMethod(secureAuthMethod);
}
-
- checkUsername(user, usernameFromQuery);
-
} else { // Security's not on, pull from url
ugi = usernameFromQuery == null?
getDefaultWebUser(conf) // not specified in request
@@ -492,10 +492,18 @@ public class JspHelper {
return ugi;
}
+ /**
+ * Expected user name should be a short name.
+ */
private static void checkUsername(final String expected, final String name
) throws IOException {
- if (name != null && !name.equals(expected)) {
- throw new IOException("Usernames not matched: name=" + name
+ if (name == null) {
+ return;
+ }
+ KerberosName u = new KerberosName(name);
+ String shortName = u.getShortName();
+ if (!shortName.equals(expected)) {
+ throw new IOException("Usernames not matched: name=" + shortName
+ " != expected=" + expected);
}
}
