richardantal commented on PR #104:
URL:
https://github.com/apache/phoenix-queryserver/pull/104#issuecomment-1218089248
I created this pull request to ask your opinion about it.
Let me give a little background for this.
I started working by bumping the avatica and the jetty version, ran some
test and got the following exception in HttpParamImpersonationQueryServerIT:
```
java.lang.IllegalArgumentException: Illegal principal name
securecluster/localhost:
org.apache.hadoop.security.authentication.util.KerberosName$NoMatchingRule: No
rules applied to securecluster/localhost
at org.apache.hadoop.security.User.<init>(User.java:51)
at
org.apache.hadoop.security.UserGroupInformation.createProxyUser(UserGroupInformation.java:1347)
at
org.apache.phoenix.queryserver.server.QueryServer$PhoenixDoAsCallback.lambda$createProxyUser$0(QueryServer.java:615)
at
java.util.concurrent.ConcurrentHashMap.computeIfAbsent(ConcurrentHashMap.java:1660)
at
org.apache.phoenix.util.SimpleLRUCache.computeIfAbsent(SimpleLRUCache.java:56)
at
org.apache.phoenix.queryserver.server.QueryServer$PhoenixDoAsCallback.createProxyUser(QueryServer.java:615)
at
org.apache.phoenix.queryserver.server.QueryServer$PhoenixDoAsCallback.doAsRemoteUser(QueryServer.java:598)
```
Then I checked the remoteUserName here:
https://github.com/apache/phoenix-queryserver/blob/master/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/server/QueryServer.java#L598
Turns out, that before CALCITE-4152 we had
`securecluster/[email protected]` and no we have `securecluster/localhost`
Which will not match later and cause exception.
So I trimmed the hostname because in hadoop we would set it to null if there
is no realm anyway:
https://github.com/apache/hadoop/blob/branch-3.1.4/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/KerberosName.java#L125
Does this change makes sense?
Also @joshelser could you give us a little explanation why was the realm
trimmed off in calcite?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
