Github user YolandaMDavis commented on the issue:
https://github.com/apache/nifi/pull/873
@mcgilman I was able to validate the changes to separate spnego
authentication from kerberos service authentication. I summarized my tests here:
[NIFI-2561-PR-873 Test
Summary.docx](https://github.com/apache/nifi/files/422040/NIFI-2561-PR-873.Test.Summary.docx)
My tests utilized a remote standalone nifi instance which ran alongside an
instance of Apache Ranger and a KDC. Upon proper configuration for kerberos
locally and on NiFi for each test case I did not encounter any issues related
to kerberos authentication. I think it looks good for merge pending comments
review/discussion.
In addition to the comment I made above, I was wondering, since now two
types of keytabs could be referenced, what's the potential that they could for
different realms, e.g. Ranger existing Realm or different KDC then one used to
authenticate users ? If so it may be useful to have documentation highlighting
that krb5.conf may need to be adjusted for that case (multiple realms).
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
