[
https://issues.apache.org/jira/browse/HADOOP-10158?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13888020#comment-13888020
]
Daryn Sharp commented on HADOOP-10158:
--------------------------------------
CNAMEs are rather problematic for spnego because the RFC doesn't specify
behavior. Historically service principals are considered/expected to use the
canonicalized hostname. The client resolves the host to ip and ip back to host
to get the FQDN for the service principal. For example, I believe Firefox and
Safari canonicalize while Chrome does not.
# I don't think there's a way in java to dynamically discover all the
principals in the keytab. I wanted to do that but couldn't find a way to do
so. Did you? If yes, I'll happily build a static cache.
# I originally used request.getLocalName() but there's a problem. I use
negative entries to avoid clients causing the server to repeatedly try to
login. A malicious client can flood the server with bogus hostnames via the
Host: header which will cause the negative cache entries to grow w/o bound
until the server OOMs. Using the interface's hostname prevents this problem.
If #1 can be solved, a static cache requires no negative entries in which case
we can safely use the Host: header.
> SPNEGO should work with multiple interfaces/SPNs.
> -------------------------------------------------
>
> Key: HADOOP-10158
> URL: https://issues.apache.org/jira/browse/HADOOP-10158
> Project: Hadoop Common
> Issue Type: Bug
> Affects Versions: 2.2.0
> Reporter: Kihwal Lee
> Assignee: Daryn Sharp
> Priority: Critical
> Attachments: HADOOP-10158.patch, HADOOP-10158.patch,
> HADOOP-10158_multiplerealms.patch, HADOOP-10158_multiplerealms.patch,
> HADOOP-10158_multiplerealms.patch
>
>
> This is the list of internal servlets added by namenode.
> | Name | Auth | Need to be accessible by end users |
> | StartupProgressServlet | none | no |
> | GetDelegationTokenServlet | internal SPNEGO | yes |
> | RenewDelegationTokenServlet | internal SPNEGO | yes |
> | CancelDelegationTokenServlet | internal SPNEGO | yes |
> | FsckServlet | internal SPNEGO | yes |
> | GetImageServlet | internal SPNEGO | no |
> | ListPathsServlet | token in query | yes |
> | FileDataServlet | token in query | yes |
> | FileChecksumServlets | token in query | yes |
> | ContentSummaryServlet | token in query | yes |
> GetDelegationTokenServlet, RenewDelegationTokenServlet,
> CancelDelegationTokenServlet and FsckServlet are accessed by end users, but
> hard-coded to use the internal SPNEGO filter.
> If a name node HTTP server binds to multiple external IP addresses, the
> internal SPNEGO service principal name may not work with an address to which
> end users are connecting. The current SPNEGO implementation in Hadoop is
> limited to use a single service principal per filter.
> If the underlying hadoop kerberos authentication handler cannot easily be
> modified, we can at least create a separate auth filter for the end-user
> facing servlets so that their service principals can be independently
> configured. If not defined, it should fall back to the current behavior.
--
This message was sent by Atlassian JIRA
(v6.1.5#6160)
