[jira] [Comment Edited] (HADOOP-14708) FsckServlet can not create SaslRpcClient with auth KERBEROS_SSL
[ https://issues.apache.org/jira/browse/HADOOP-14708?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16119477#comment-16119477 ] Wei-Chiu Chuang edited comment on HADOOP-14708 at 8/9/17 6:33 AM: -- [~cltlfcjin] bq. But KERBEROS_SSL is also kerberos, right? Based on jira HDFS-3745 (unresolved), KERBEROS_SSL was meant to be SPNEGO. Probably some leftover relic. was (Author: jojochuang): [~cltlfcjin] bq. But KERBEROS_SSL is also kerberos, right? Based on jira HDFS-3745 (unresolved), KERBEROS_SSL is meant to be SPNEGO. > FsckServlet can not create SaslRpcClient with auth KERBEROS_SSL > --- > > Key: HADOOP-14708 > URL: https://issues.apache.org/jira/browse/HADOOP-14708 > Project: Hadoop Common > Issue Type: Bug > Components: security >Affects Versions: 2.7.3, 2.8.1, 3.0.0-alpha3 >Reporter: Lantao Jin >Assignee: Lantao Jin > Attachments: FSCK-2.log, FSCK.log, HADOOP-14708.001.patch > > > FSCK started by xx (auth:KERBEROS_SSL) failed with exception msg "fsck > encountered internal errors!" > FSCK use FSCKServlet to submit RPC to NameNode, it use {{KERBEROS_SSL}} as > its {{AuthenticationMethod}} in {{JspHelper.java}} > {code} > /** Same as getUGI(context, request, conf, KERBEROS_SSL, true). */ > public static UserGroupInformation getUGI(ServletContext context, > HttpServletRequest request, Configuration conf) throws IOException { > return getUGI(context, request, conf, AuthenticationMethod.KERBEROS_SSL, > true); > } > {code} > But when setup SaslConnection with server, KERBEROS_SSL will failed to create > SaslClient instance. See {{SaslRpcClient.java}} > {code} > private SaslClient createSaslClient(SaslAuth authType) > throws SaslException, IOException { > > case KERBEROS: { > if (ugi.getRealAuthenticationMethod().getAuthMethod() != > AuthMethod.KERBEROS) { > return null; // client isn't using kerberos > } > {code} -- This message was sent by Atlassian JIRA (v6.4.14#64029) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Comment Edited] (HADOOP-14708) FsckServlet can not create SaslRpcClient with auth KERBEROS_SSL
[ https://issues.apache.org/jira/browse/HADOOP-14708?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16114841#comment-16114841 ] Wei-Chiu Chuang edited comment on HADOOP-14708 at 8/4/17 7:06 PM: -- [~cltlfcjin] thanks for reporting the issue. However, I don't have the problem you described. The fsck command line tool as a client does not have problem authenticating with NN on my cluster. Furthermore, the log you posted suggests the problem is the authentication between the NameNode FsckServlet (which starts a dfsclient to connect to NN) and NameNode. If there's a bug, it is strictly a HDFS RPC authentication bug, nothing to do with JspHelper. Because it's a HDFS RPC, it should have not used KERBEROS_SSL at all. Can you check if you have the correct client authentication configuration in the NameNode configuration? was (Author: jojochuang): [~cltlfcjin] thanks for reporting the issue. However, I don't have the problem you described. The fsck command line tool as a client does not have problem authenticating with NN on my cluster. Furthermore, the log you posted suggests the problem is the authentication between the NameNode FsckServlet (which starts a dfsclient to connect to NN) and NameNode. If there's a bug, it is strictly a HDFS RPC authentication bug, nothing to do with JspHelper. Because it's a HDFS RPC, it should have not used KERBEROS_SSL at all. > FsckServlet can not create SaslRpcClient with auth KERBEROS_SSL > --- > > Key: HADOOP-14708 > URL: https://issues.apache.org/jira/browse/HADOOP-14708 > Project: Hadoop Common > Issue Type: Bug > Components: security >Affects Versions: 2.7.3, 2.8.1, 3.0.0-alpha3 >Reporter: Lantao Jin > Attachments: FSCK.log, HADOOP-14708.001.patch > > > FSCK started by xx (auth:KERBEROS_SSL) failed with exception msg "fsck > encountered internal errors!" > FSCK use FSCKServlet to submit RPC to NameNode, it use {{KERBEROS_SSL}} as > its {{AuthenticationMethod}} in {{JspHelper.java}} > {code} > /** Same as getUGI(context, request, conf, KERBEROS_SSL, true). */ > public static UserGroupInformation getUGI(ServletContext context, > HttpServletRequest request, Configuration conf) throws IOException { > return getUGI(context, request, conf, AuthenticationMethod.KERBEROS_SSL, > true); > } > {code} > But when setup SaslConnection with server, KERBEROS_SSL will failed to create > SaslClient instance. See {{SaslRpcClient.java}} > {code} > private SaslClient createSaslClient(SaslAuth authType) > throws SaslException, IOException { > > case KERBEROS: { > if (ugi.getRealAuthenticationMethod().getAuthMethod() != > AuthMethod.KERBEROS) { > return null; // client isn't using kerberos > } > {code} -- This message was sent by Atlassian JIRA (v6.4.14#64029) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Comment Edited] (HADOOP-14708) FsckServlet can not create SaslRpcClient with auth KERBEROS_SSL
[ https://issues.apache.org/jira/browse/HADOOP-14708?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16108653#comment-16108653 ] Lantao Jin edited comment on HADOOP-14708 at 8/3/17 7:17 AM: - Attach some logs. I think it can be fix by two options: # Change the enum {{AuthenticationMethod}} value KERBEROS_SSL(null) to KERBEROS_SSL(AuthMethod.KERBEROS) # relax the condition in createSaslClient() like {code} if (ugi.getRealAuthenticationMethod().getAuthMethod() != AuthMethod.KERBEROS && ugi.getRealAuthenticationMethod() != AuthenticationMethod.KERBEROS_SSL ) { return null; // client isn't using kerberos } {code} If any option is ok, I can attach the patch file. was (Author: cltlfcjin): Attach some logs. I think it can be fix by two options: # Change the enum {{AuthenticationMethod}} value KERBEROS_SSL(null) to KERBEROS_SSL(AuthMethod.KERBEROS) # relax the condition in createSaslClient() like {code} if (ugi.getRealAuthenticationMethod().getAuthMethod() != AuthMethod.KERBEROS || ugi.getRealAuthenticationMethod() != AuthenticationMethod.KERBEROS_SSL ) { return null; // client isn't using kerberos } {code} If any option is ok, I can attach the patch file. > FsckServlet can not create SaslRpcClient with auth KERBEROS_SSL > --- > > Key: HADOOP-14708 > URL: https://issues.apache.org/jira/browse/HADOOP-14708 > Project: Hadoop Common > Issue Type: Bug > Components: security >Affects Versions: 2.7.3, 2.8.1, 3.0.0-alpha3 >Reporter: Lantao Jin > Attachments: FSCK.log > > > FSCK started by xx (auth:KERBEROS_SSL) failed with exception msg "fsck > encountered internal errors!" > FSCK use FSCKServlet to submit RPC to NameNode, it use {{KERBEROS_SSL}} as > its {{AuthenticationMethod}} in {{JspHelper.java}} > {code} > /** Same as getUGI(context, request, conf, KERBEROS_SSL, true). */ > public static UserGroupInformation getUGI(ServletContext context, > HttpServletRequest request, Configuration conf) throws IOException { > return getUGI(context, request, conf, AuthenticationMethod.KERBEROS_SSL, > true); > } > {code} > But when setup SaslConnection with server, KERBEROS_SSL will failed to create > SaslClient instance. See {{SaslRpcClient.java}} > {code} > private SaslClient createSaslClient(SaslAuth authType) > throws SaslException, IOException { > > case KERBEROS: { > if (ugi.getRealAuthenticationMethod().getAuthMethod() != > AuthMethod.KERBEROS) { > return null; // client isn't using kerberos > } > {code} -- This message was sent by Atlassian JIRA (v6.4.14#64029) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org