[
https://issues.apache.org/jira/browse/HADOOP-18666?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17700630#comment-17700630
]
ASF GitHub Bot commented on HADOOP-18666:
-----------------------------------------
eubnara commented on PR #5480:
URL: https://github.com/apache/hadoop/pull/5480#issuecomment-1469857746
[HADOOP-17371](https://github.com/apache/hadoop/commit/6340ac857b7ff3f73bbcf95b59b98aac134f33af)
upgrades jetty version. I found that `updateBeans(_filters,holders);` may
affect this behavior.
(https://github.com/eclipse/jetty.project/commit/b1e08ba4e0f7ad07be9ecaf2e5ad2f31f73540e1#diff-139accaf0a9751b1ec9461855e9e0f1d8fb9966c3c4685b8d6f8714add747a37R1551)
Maybe it makes `AuthenticationFilter` overwrite previously added
`AuthenticationFilter` filter?
> A whitelist of endpoints to skip Kerberos authentication doesn't work for
> ResourceManager and Job History Server
> ----------------------------------------------------------------------------------------------------------------
>
> Key: HADOOP-18666
> URL: https://issues.apache.org/jira/browse/HADOOP-18666
> Project: Hadoop Common
> Issue Type: Bug
> Components: security
> Reporter: YUBI LEE
> Assignee: YUBI LEE
> Priority: Major
> Labels: pull-request-available
> Attachments: HADOOP-18666-branch-3.3.4.patch
>
>
> Thanks to HADOOP-16527, we can add a whitelist of endpoints to skip Kerberos
> authentication such as {{/isActive}}, {{/jmx}}, {{/prom}}.
> However, I found that ResourceManager and Job History Server doesn't repect
> {{hadoop.http.authentication.kerberos.endpoint.whitelist}}.
> To workaround this issue for ResourceManager, set
> {{yarn.resourcemanager.webapp.delegation-token-auth-filter.enabled=true}} in
> yarn-site.xml.
> However, there is no workaround for Job History Server.
> This bug is caused by {{HttpServer2#initSpnego}} call without proper
> configurations which starts with "{{hadoop.http.authentication.}}".
> I will make a PR soon.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
