Copilot commented on code in PR #567: URL: https://github.com/apache/ozone-site/pull/567#discussion_r4210601899
########## docs/05-administrator-guide/02-configuration/03-security/03-https.md: ########## @@ -17,6 +17,8 @@ By default Ozone HTTP web-consoles (OM, SCM, S3G, Recon, Datanode) allow access If you have an SPNEGO enabled Ozone cluster and want to disable it for all Ozone services, just make sure the two key mentioned are configured as above. +Without SPNEGO a request carries no authenticated identity, so endpoints that are restricted to administrators cannot check the caller. This includes the DB checkpoint endpoints of OM (`/dbCheckpoint`, `/v2/dbCheckpoint`) and SCM (`/dbCheckpoint`), which serve a copy of the service's metadata DB. The OM DB contains the S3 secrets of all users. On a secure cluster, enable SPNEGO for OM and SCM as described below, or restrict network access to their HTTP ports. Review Comment: The new remediation points operators to the SCM instructions below, but that table uses `ozone.scm.http.auth.*`; SCM's actual properties are `hdds.scm.http.auth.type`, `hdds.scm.http.auth.kerberos.principal`, and `hdds.scm.http.auth.kerberos.keytab` (see the generated appendix at lines 251–253). Following the current link therefore leaves SCM SPNEGO disabled and `/dbCheckpoint` exposed. Please correct the SCM table or state the valid keys here. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
