[
https://issues.apache.org/jira/browse/HADOOP-15518?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16504877#comment-16504877
]
Eric Yang commented on HADOOP-15518:
------------------------------------
This is a race condition if multiple instances of AuthenticationFilters are
chained together by accident, and the token has already been checked once by
first instance of AuthenticationFilter, and the token has not been committed to
HttpResponse. "authenticate" method will get called twice. The javadoc is not
wrong, except how to go about validating the current request is already
authenticated is not trivial when token has not been received by browser yet.
It might be possible to add checks for either HttpRequest.getRemoteUser() or
HttpResponse header committing state to see if Authentication had already
occurred to prevent the race condition.
> Authentication filter calling handler after request already authenticated
> -------------------------------------------------------------------------
>
> Key: HADOOP-15518
> URL: https://issues.apache.org/jira/browse/HADOOP-15518
> Project: Hadoop Common
> Issue Type: Bug
> Components: security
> Affects Versions: 2.7.1
> Reporter: Kevin Minder
> Priority: Major
> Attachments: HADOOP-15518-001.patch
>
>
> The hadoop-auth AuthenticationFilter will invoke its handler even if a prior
> successful authentication has occurred. This primarily affects situations
> where multipole authentication mechanism has been configured. For example
> when core-site.xml's has hadoop.http.authentication.type and yarn-site.xml
> has yarn.timeline-service.http-authentication.type the result is an attempt
> to perform two Kerberos authentications for the same request. This in turn
> results in Kerberos triggering a replay attack detection. The javadocs for
> AuthenticationHandler
> ([https://github.com/apache/hadoop/blob/trunk/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationHandler.java)]
> indicate for the authenticate method that
> {quote}This method is invoked by the AuthenticationFilter only if the HTTP
> client request is not yet authenticated.
> {quote}
> This does not appear to be the cause in practice.
> I've create a patch and tested on a limited number of functional use cases
> (e.g. the timeline-service issue noted above). If there is general agreement
> that the change is valid I'll add unit tests to the patch.
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
