[
https://issues.apache.org/jira/browse/HADOOP-8830?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13779488#comment-13779488
]
Omkar Vinit Joshi commented on HADOOP-8830:
-------------------------------------------
If we look at the AuthenticationFilter.doFilter code
{code}
try {
token = getToken(httpRequest);
LOG.info(AuthenticationFilter.class.getName() + " token :"
+ (token == null));
}
{code}
then here it is getting the token from the cookie present in request. The
underlying problem is
* we have 2 AuthenticationFilter
* AuthenticationFilter if doesn't see the 'hadoop.auth' cookie in the request
then today
** first it is trying to authenticate
** second it sets the token information into to the cookie and add it *only in
the HttpResponse*.
* Therefore future AuthenticationFilter calls don't see the cookie and thinks
that request is still not authenticated. So they try to authenticate again and
fails with replay error. So basically we need a way to forward the
authenticated information to the other filters once it is authenticated.
Please let me know if this sounds correct.
> org.apache.hadoop.security.authentication.server.AuthenticationFilter might
> be called twice, causing kerberos replay errors
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: HADOOP-8830
> URL: https://issues.apache.org/jira/browse/HADOOP-8830
> Project: Hadoop Common
> Issue Type: Bug
> Affects Versions: 2.0.1-alpha, 2.1.0-beta, 2.1.1-beta, 2.1.2-beta
> Reporter: Moritz Moeller
> Assignee: Omkar Vinit Joshi
> Priority: Critical
>
> AuthenticationFilter.doFilter is called twice (not sure if that is
> intentional or not).
> The second time it is called the ServletRequest is already authenticated,
> i.e. httpRequest.getRemoteUser() returns non-null info.
> If the kerberos authentication is triggered a second time it'll return a
> replay attack exception.
> I solved this by adding a if (httpRequest.getRemoteUser() == null) at the
> very beginning of doFilter.
> Alternatively one can set an attribute on the request, or figure out why
> doFilter is called twice.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
