[
https://issues.apache.org/jira/browse/HADOOP-9363?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13873798#comment-13873798
]
Daryn Sharp commented on HADOOP-9363:
-------------------------------------
I've determined the problem for this old issue and am working on a patch. If
the the spnego auth fails, it returns a 401 with no WWW-Authenticate header.
This violates the RFC which mandates a 401 always contains a WWW-Authenticate
header.
If any kerberos error occurs, the 401 sans WWW-Authenticate header triggers a
NPE in the client due to a JDK bug that assumes a RFC-compliant response.
Examples of errors include but are not limited to:
# server's kerberos principal/keytab and the http server started anyway
# server's TGT expires
# server principal's kvno is stale
# client has no TGT
# client sends an invalid service ticket - expired, wrong enc_type, wrong kvno,
etc)
# kdc is not available - down or transient network failure
# clock skew causes a kerberos failure
# replay attack is triggered (another JDK bug triggered by AuthenticatedURL)
The NPE is particularly bad for daemon services. For example, the RM will
crash if an NPE occurs while renewing/canceling a token.
> AuthenticatedURL will NPE if server closes connection
> -----------------------------------------------------
>
> Key: HADOOP-9363
> URL: https://issues.apache.org/jira/browse/HADOOP-9363
> Project: Hadoop Common
> Issue Type: Bug
> Components: security
> Affects Versions: 0.23.0, 2.0.0-alpha, 3.0.0
> Reporter: Daryn Sharp
>
> A NPE occurs if the server unexpectedly closes the connection for an
> {{AuthenticatedURL}} w/o sending a response.
--
This message was sent by Atlassian JIRA
(v6.1.5#6160)
