[
https://issues.apache.org/jira/browse/HADOOP-15922?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16689748#comment-16689748
]
Eric Yang edited comment on HADOOP-15922 at 11/16/18 5:59 PM:
--------------------------------------------------------------
[~hexiaoqiao] If the client is changed to proxy from client/host, then
hadoop.kms.proxyuser.client.hosts should include host:
{code}
+ conf.set("hadoop.kms.proxyuser.client.hosts", "localhost,host");
{code}
I am not sure why KMS doesn't use standard hadoop.proxyuser.client.groups and
hadoop.proxyuser.client.hosts. It seems to let bugs slip through like client
user origin is not validated, or the impersonating user doesn't belong to any
primary group.
Do we want to open a bug that proxyuser origin is not validated for KMS?
was (Author: eyang):
[~hexiaoqiao] If the client is changed to proxy from client/host, then
hadoop.kms.proxyuser.client.hosts should include host:
{code}
+ conf.set("hadoop.kms.proxyuser.client.hosts", "localhost,host");
{code}
I am not sure why KMS doesn't use standard hadoop.proxyuser.client.groups and
hadoop.proxyuser.client.hosts. It seems to let bugs slip through like client
user origin is not validated, or the impersonating user doesn't belong to any
primary group.
> DelegationTokenAuthenticationFilter get wrong doAsUser since it does not
> decode URL
> -----------------------------------------------------------------------------------
>
> Key: HADOOP-15922
> URL: https://issues.apache.org/jira/browse/HADOOP-15922
> Project: Hadoop Common
> Issue Type: Bug
> Components: common, kms
> Reporter: He Xiaoqiao
> Assignee: He Xiaoqiao
> Priority: Major
> Attachments: HADOOP-15922.001.patch, HADOOP-15922.002.patch,
> HADOOP-15922.003.patch, HADOOP-15922.004.patch
>
>
> DelegationTokenAuthenticationFilter get wrong doAsUser when proxy user from
> client is complete kerberos name (e.g., user/hostn...@realm.com, actually it
> is acceptable), because DelegationTokenAuthenticationFilter does not decode
> DOAS parameter in URL which is encoded by {{URLEncoder}} at client.
> e.g. KMS as example:
> a. KMSClientProvider creates connection to KMS Server using
> DelegationTokenAuthenticatedURL#openConnection.
> b. If KMSClientProvider is a doAsUser, KMSClientProvider will put {{doas}}
> with url encoded user as one parameter of http request.
> {code:java}
> // proxyuser
> if (doAs != null) {
> extraParams.put(DO_AS, URLEncoder.encode(doAs, "UTF-8"));
> }
> {code}
> c. when KMS server receives the request, it does not decode the proxy user.
> As result, KMS Server will get the wrong proxy user if this proxy user is
> complete Kerberos Name or it includes some special character. Some other
> authentication and authorization exception will throws next to it.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
