Dian-Xuan Yang created HDDS-16347:
-------------------------------------
Summary: Stop expanding _HOST to the bind host in HTTP SPNEGO
principals
Key: HDDS-16347
URL: https://issues.apache.org/jira/browse/HDDS-16347
Project: Apache Ozone
Issue Type: Task
Reporter: Dian-Xuan Yang
h3. Problem
{{BaseHttpServer}} never calls {{HttpServer2.Builder.hostName()}}, so
{{build()}} falls back to the host of the first endpoint:
{code:java}
if (hostName == null) {
hostName = endpoints.get(0).getHost();
}
...
server.initSpnego(conf, hostName, usernameConfKey, keytabConfKey);
{code}
{{initSpnego}} hands that value to {{SecurityUtil.getServerPrincipal}}, which
substitutes it for {{_HOST}}. The endpoint is built from the bind address, and
in {{BaseHttpServer.getBindAddress}} a configured bind host takes precedence
over the advertised address, so an operator who sets a bind host explicitly
ends up with it in the Kerberos principal.
This is not IPv6-specific. {{ozone.om.http-bind-host=0.0.0.0}} already produces
{{HTTP/0.0.0.0@REALM}} today. It surfaced while reviewing HDDS-16307, which
makes an IPv6 bind host usable for the first time and turns {{::}} into
{{HTTP/[::]@REALM}}. No keytab matches either form.
The OEP for HDDS-15763 states that wildcard addresses "must not be advertised
as peer or client endpoints, Kerberos principals, or certificate identities".
h3. Solution
Resolve {{_HOST}} from an address that identifies the host, rather than from
the listener's bind address. The candidates are the advertised HTTP address
property, and the canonical local hostname when only a bind host is configured.
h3. Open Questions
# Should {{_HOST}} fall back to the canonical local hostname when the
advertised address property is unset, or should a wildcard bind host with
security enabled fail at startup with an explicit message?
# Does the same substitution path affect any other Ozone component that builds
a principal from a listener address?
h3. Testing
Verify the principal produced for a wildcard bind host, IPv4 and IPv6, and for
an explicitly configured advertised address.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
