senthh commented on code in PR #3863:
URL: https://github.com/apache/celeborn/pull/3863#discussion_r4244738010
##########
service/src/main/scala/org/apache/celeborn/server/common/http/authentication/AuthenticationFilter.scala:
##########
@@ -157,10 +157,23 @@ class AuthenticationFilter(conf: CelebornConf,
serviceName: String) extends Filt
try {
if (matchedHandler == null) {
logDebug(s"No auth scheme matched for url:
${httpRequest.getRequestURL}")
- httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED)
- httpResponse.sendError(
- HttpServletResponse.SC_UNAUTHORIZED,
- s"No auth scheme matched for $authorization")
+ if (authorization == null || authorization.isEmpty) {
+ // First request with no Authorization header. Send WWW-Authenticate
+ // challenge(s) to initiate auth handshake (e.g. SPNEGO/Kerberos
+ // requires a 401+WWW-Authenticate to start the handshake).
+ authSchemeHandlers.keys.foreach { scheme =>
+ httpResponse.addHeader("WWW-Authenticate", scheme.toString)
Review Comment:
Addressed. Added an automated test for the unauthenticated challenge path in
`ApiBaseResourceAuthenticationSuite` (which configures BASIC + BEARER):
- a request with no `Authorization` header returns 401 with one
`WWW-Authenticate` header per registered scheme — asserting `Basic
realm="Celeborn"` and `BEARER` are present;
- a second test covers the unmatched-`Authorization`-header path, asserting
it still returns 401 (nonmatching-header behavior unchanged).
`service` test-compile and `spotless:check` pass. Pushed to the PR branch.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
