[
https://issues.apache.org/jira/browse/IMPALA-7504?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16962626#comment-16962626
]
ASF subversion and git services commented on IMPALA-7504:
---------------------------------------------------------
Commit bb1229411c2b19e1258450e6dc2003f9676ee236 in impala's branch
refs/heads/master from xiaomeng
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=bb12294 ]
IMPALA-7504/KUDU-2979 ParseKerberosPrincipal() should use krb5_parse_name()
instead
We want to use krb5_parse_name() to parse the principal instead of
using custom code.
When kerberos is initialized in Impala's copy of Kudu code, it stores a
global context which is used when accessing the Krb5 library. To use
this global context the code that parses the principal name is moved
into the Impala Kudu code. This new code is then called from the
existing ParseKerberosPrincipal method.
Test done:
Add two tests to authentication-test, one to verify parsing a principal
containing a special character. The other to verify exception when
parsing bad format principal, new error code is 2 instead of original 112
which is BAD_PRINCIPAL_FORMAT error code.
Run impala-private-parameterized tests.
Change-Id: Ifddafa7aae25d66ed7d9fa0306f17501a191cdac
Reviewed-on: http://gerrit.cloudera.org:8080/14520
Tested-by: Kudu Jenkins
Reviewed-by: Alexey Serbin <[email protected]>
Change-Id: I0e64ebdc10f102dbdc5b87f6fe3f2a0310b1be24
Reviewed-on: http://gerrit.cloudera.org:8080/14433
Reviewed-by: Impala Public Jenkins <[email protected]>
Tested-by: Impala Public Jenkins <[email protected]>
> ParseKerberosPrincipal() should use krb5_parse_name() instead
> -------------------------------------------------------------
>
> Key: IMPALA-7504
> URL: https://issues.apache.org/jira/browse/IMPALA-7504
> Project: IMPALA
> Issue Type: Improvement
> Components: Security
> Affects Versions: Impala 3.0, Impala 2.12.0
> Reporter: Michael Ho
> Assignee: Xiaomeng Zhang
> Priority: Minor
> Labels: ramp-up
>
> [~tlipcon] pointed out during code review that we should be using
> krb5_parse_name() to parse the principal instead of creating our own
> bq. I wonder whether we should just be using krb5_parse_name here instead of
> implementing our own parsing? According to
> [http://web.mit.edu/kerberos/krb5-1.15/doc/appdev/refs/api/krb5_parse_name.html]
> there are various escapings, etc, that this function isn't currently
> supporting.
> We currently do the following to parse the principal:
> {noformat}
> vector<string> names;
> split(names, principal, is_any_of("/"));
> if (names.size() != 2) return Status(TErrorCode::BAD_PRINCIPAL_FORMAT,
> principal);
> *service_name = names[0];
> string remaining_principal = names[1];
> split(names, remaining_principal, is_any_of("@"));
> if (names.size() != 2) return Status(TErrorCode::BAD_PRINCIPAL_FORMAT,
> principal);
> {noformat}
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
