smengcl commented on code in PR #567: URL: https://github.com/apache/ozone-site/pull/567#discussion_r4210652928
########## docs/05-administrator-guide/02-configuration/03-security/03-https.md: ########## @@ -17,6 +17,8 @@ By default Ozone HTTP web-consoles (OM, SCM, S3G, Recon, Datanode) allow access If you have an SPNEGO enabled Ozone cluster and want to disable it for all Ozone services, just make sure the two key mentioned are configured as above. +Without SPNEGO a request carries no authenticated identity, so endpoints that are restricted to administrators cannot check the caller. This includes the DB checkpoint endpoints of OM (`/dbCheckpoint`, `/v2/dbCheckpoint`) and SCM (`/dbCheckpoint`), which serve a copy of the service's metadata DB. The OM DB contains the S3 secrets of all users. On a secure cluster, enable SPNEGO for OM and SCM as described below, or restrict network access to their HTTP ports. Review Comment: Corrected in 3a49f13: the SCM tables on this page (SPNEGO and SIMPLE) now use the `hdds.scm.http.auth.*` keys, matching the generated appendix. _🤖 Addressed by [Claude Code](https://claude.com/claude-code)_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
