senthh opened a new pull request, #3863: URL: https://github.com/apache/celeborn/pull/3863
## Description When the HTTP authentication filter receives a request with no Authorization header (e.g. the first request in a SPNEGO/Kerberos handshake), it currently returns a bare 401 response without any WWW-Authenticate header. This prevents SPNEGO-authenticated clients (such as curl --negotiate) from receiving the challenge and initiating the Kerberos handshake. ## Changes 1. **AuthenticationFilter.scala**: When no Authorization header is present but auth handlers are configured, the filter now sends WWW-Authenticate headers listing all registered auth schemes in the 401 response. If an Authorization header is present but doesn't match any handler, the original error message is preserved. 2. **CelebornConf.scala**: Fixed the documentation for `celeborn.master.http.auth.supportedSchemes` and `celeborn.worker.http.auth.supportedSchemes` which incorrectly listed the value as 'SPNEGO' instead of the correct enumeration value 'NEGOTIATE'. ## Testing Verified with curl --negotiate against a Celeborn server configured with: - celeborn.master.http.auth.supportedSchemes NEGOTIATE - celeborn.master.http.spnego.keytab /path/to/keytab - celeborn.master.http.spnego.principal HTTP/host@REALM Before: 401 without WWW-Authenticate header, curl never sends token After: 401 with WWW-Authenticate: NEGOTIATE, curl completes SPNEGO handshake, returns 200 Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
