[
https://issues.apache.org/jira/browse/HADOOP-18666?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17700880#comment-17700880
]
ASF GitHub Bot commented on HADOOP-18666:
-----------------------------------------
eubnara commented on PR #5480:
URL: https://github.com/apache/hadoop/pull/5480#issuecomment-1470910613
RM
```
[root@ambari-agent-2 conf]# curl http://ambari-agent-2.example.com:8088/jmx
-v
* About to connect() to ambari-agent-2.example.com port 8088 (#0)
* Trying 172.20.0.2...
* Connected to ambari-agent-2.example.com (172.20.0.2) port 8088 (#0)
> GET /jmx HTTP/1.1
> User-Agent: curl/7.29.0
> Host: ambari-agent-2.example.com:8088
> Accept: */*
>
< HTTP/1.1 401 Authentication required
< Date: Wed, 15 Mar 2023 22:07:43 GMT
< Date: Wed, 15 Mar 2023 22:07:43 GMT
< Pragma: no-cache
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< WWW-Authenticate: Negotiate
< Set-Cookie: hadoop.auth=; HttpOnly
< Cache-Control: must-revalidate,no-cache,no-store
< Content-Type: text/html;charset=iso-8859-1
< Content-Length: 263
<
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>Error 401 Authentication required</title>
</head>
<body><h2>HTTP ERROR 401</h2>
<p>Problem accessing /jmx. Reason:
<pre> Authentication required</pre></p>
</body>
</html>
* Connection #0 to host ambari-agent-2.example.com left intact
```
JHS
```
[root@ambari-agent-2 conf]# curl http://ambari-agent-2.example.com:19888/jmx
-v
* About to connect() to ambari-agent-2.example.com port 19888 (#0)
* Trying 172.20.0.2...
* Connected to ambari-agent-2.example.com (172.20.0.2) port 19888 (#0)
> GET /jmx HTTP/1.1
> User-Agent: curl/7.29.0
> Host: ambari-agent-2.example.com:19888
> Accept: */*
>
< HTTP/1.1 401 Authentication required
< Date: Wed, 15 Mar 2023 22:08:03 GMT
< Date: Wed, 15 Mar 2023 22:08:03 GMT
< Pragma: no-cache
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< WWW-Authenticate: Negotiate
< Set-Cookie: hadoop.auth=; HttpOnly
< Cache-Control: must-revalidate,no-cache,no-store
< Content-Type: text/html;charset=iso-8859-1
< Content-Length: 263
<
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>Error 401 Authentication required</title>
</head>
<body><h2>HTTP ERROR 401</h2>
<p>Problem accessing /jmx. Reason:
<pre> Authentication required</pre></p>
</body>
</html>
* Connection #0 to host ambari-agent-2.example.com left intact
```
> A whitelist of endpoints to skip Kerberos authentication doesn't work for
> ResourceManager and Job History Server
> ----------------------------------------------------------------------------------------------------------------
>
> Key: HADOOP-18666
> URL: https://issues.apache.org/jira/browse/HADOOP-18666
> Project: Hadoop Common
> Issue Type: Bug
> Components: security
> Reporter: YUBI LEE
> Assignee: YUBI LEE
> Priority: Major
> Labels: pull-request-available
> Attachments: HADOOP-18666-branch-3.3.4.patch
>
>
> Thanks to HADOOP-16527, we can add a whitelist of endpoints to skip Kerberos
> authentication such as {{/isActive}}, {{/jmx}}, {{/prom}}.
> However, I found that ResourceManager and Job History Server doesn't repect
> {{hadoop.http.authentication.kerberos.endpoint.whitelist}}.
> To workaround this issue for ResourceManager, set
> {{yarn.resourcemanager.webapp.delegation-token-auth-filter.enabled=true}} in
> yarn-site.xml.
> However, there is no workaround for Job History Server.
> This bug is caused by {{HttpServer2#initSpnego}} call without proper
> configurations which starts with "{{hadoop.http.authentication.}}".
> I will make a PR soon.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
