[
https://issues.apache.org/jira/browse/PHOENIX-6750?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17580815#comment-17580815
]
ASF GitHub Bot commented on PHOENIX-6750:
-----------------------------------------
richardantal commented on PR #104:
URL:
https://github.com/apache/phoenix-queryserver/pull/104#issuecomment-1218089248
I created this pull request to ask your opinion about it.
Let me give a little background for this.
I started working by bumping the avatica and the jetty version, ran some
test and got the following exception in HttpParamImpersonationQueryServerIT:
```
java.lang.IllegalArgumentException: Illegal principal name
securecluster/localhost:
org.apache.hadoop.security.authentication.util.KerberosName$NoMatchingRule: No
rules applied to securecluster/localhost
at org.apache.hadoop.security.User.<init>(User.java:51)
at
org.apache.hadoop.security.UserGroupInformation.createProxyUser(UserGroupInformation.java:1347)
at
org.apache.phoenix.queryserver.server.QueryServer$PhoenixDoAsCallback.lambda$createProxyUser$0(QueryServer.java:615)
at
java.util.concurrent.ConcurrentHashMap.computeIfAbsent(ConcurrentHashMap.java:1660)
at
org.apache.phoenix.util.SimpleLRUCache.computeIfAbsent(SimpleLRUCache.java:56)
at
org.apache.phoenix.queryserver.server.QueryServer$PhoenixDoAsCallback.createProxyUser(QueryServer.java:615)
at
org.apache.phoenix.queryserver.server.QueryServer$PhoenixDoAsCallback.doAsRemoteUser(QueryServer.java:598)
```
Then I checked the remoteUserName here:
https://github.com/apache/phoenix-queryserver/blob/master/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/server/QueryServer.java#L598
Turns out, that before CALCITE-4152 we had
`securecluster/[email protected]` and no we have `securecluster/localhost`
Which will not match later and cause exception.
So I trimmed the hostname because in hadoop we would set it to null if there
is no realm anyway:
https://github.com/apache/hadoop/blob/branch-3.1.4/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/KerberosName.java#L125
Does this change makes sense?
Also @joshelser could you give us a little explanation why was the realm
trimmed off in calcite?
> Bump Avatica version to 1.21.0 in queryserver
> ---------------------------------------------
>
> Key: PHOENIX-6750
> URL: https://issues.apache.org/jira/browse/PHOENIX-6750
> Project: Phoenix
> Issue Type: Improvement
> Components: queryserver
> Affects Versions: queryserver-6.0.0
> Reporter: Richárd Antal
> Assignee: Richárd Antal
> Priority: Major
>
> Avatica 1.21 has been released.
> It has several fixes that we want.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
