[
https://issues.apache.org/jira/browse/HBASE-26284?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17430139#comment-17430139
]
Hudson commented on HBASE-26284:
--------------------------------
Results for branch branch-2
[build #368 on
builds.a.o|https://ci-hadoop.apache.org/job/HBase/job/HBase%20Nightly/job/branch-2/368/]:
(x) *{color:red}-1 overall{color}*
----
details (if available):
(x) {color:red}-1 general checks{color}
-- For more information [see general
report|https://ci-hadoop.apache.org/job/HBase/job/HBase%20Nightly/job/branch-2/368/General_20Nightly_20Build_20Report/]
(/) {color:green}+1 jdk8 hadoop2 checks{color}
-- For more information [see jdk8 (hadoop2)
report|https://ci-hadoop.apache.org/job/HBase/job/HBase%20Nightly/job/branch-2/368/JDK8_20Nightly_20Build_20Report_20_28Hadoop2_29/]
(/) {color:green}+1 jdk8 hadoop3 checks{color}
-- For more information [see jdk8 (hadoop3)
report|https://ci-hadoop.apache.org/job/HBase/job/HBase%20Nightly/job/branch-2/368/JDK8_20Nightly_20Build_20Report_20_28Hadoop3_29/]
(x) {color:red}-1 jdk11 hadoop3 checks{color}
-- For more information [see jdk11
report|https://ci-hadoop.apache.org/job/HBase/job/HBase%20Nightly/job/branch-2/368/JDK11_20Nightly_20Build_20Report_20_28Hadoop3_29/]
(/) {color:green}+1 source release artifact{color}
-- See build output for details.
(/) {color:green}+1 client integration test{color}
> Add HBase Thrift API to get all table names along with whether it is enabled
> or not
> -----------------------------------------------------------------------------------
>
> Key: HBASE-26284
> URL: https://issues.apache.org/jira/browse/HBASE-26284
> Project: HBase
> Issue Type: New Feature
> Components: Thrift
> Affects Versions: 3.0.0-alpha-1, 2.2.7, 2.3.6, 2.4.7
> Reporter: Dóra Horváth
> Assignee: Dóra Horváth
> Priority: Major
> Fix For: 2.5.0, 3.0.0-alpha-2, 2.3.7, 2.4.8
>
>
> When loading Hue HBase page, hue will firstly get all the table names in one
> thrift call, then hue will send a request as a new connection to Hbase thrift
> server for each table to check if the table is enabled or not. When the
> number of table becomes big, for example a few hundreds. Hue will have the
> chance to fail to show the table list, and it shows an error message on Hue
> web UI "Api Error: Unable to authenticate". In Hbase thrift server log, we
> can see error message, below is an example from test environment:
> ======================================
> 2020-07-02 21:54:01,025 INFO
> org.apache.hadoop.hbase.thrift.ThriftHttpServlet: Failed to authenticate with
> HTTP/[...]@HADOOP.COM kerberos principal
> 2020-07-02 21:54:01,025 ERROR
> org.apache.hadoop.hbase.thrift.ThriftHttpServlet: Kerberos Authentication
> failed
> org.apache.hadoop.hbase.thrift.HttpAuthenticationException:
> java.lang.reflect.UndeclaredThrowableException
> ......
> Caused by: java.lang.reflect.UndeclaredThrowableException
> ......
> Caused by: org.apache.hadoop.hbase.thrift.HttpAuthenticationException:
> Kerberos authentication failed:
> ......
> Caused by: GSSException: Failure unspecified at GSS-API level (Mechanism
> level: Request is a replay (34))
> ......
> Caused by: KrbException: Request is a replay (34)
> ======================================
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> My current understanding of the cause is Hue sends requests too fast so that
> it has the chance to send 2 requests with the same Kerberos authenticator
> (timestamp is same). So Hbase thrift server will think this is a replay
> attack. We came up with this assumption based on tcpdump observation and this
> document, https://web.mit.edu/kerberos/krb5-latest/doc/basic/rcache_def.html
> If HBase Thrift server can have an API call that Hue can call it once and get
> all table names with whether is enabled or not, we can avoid above issue.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
