IMPALA-6477: rpc-mgr-kerberized-test fails on CentOS 6.4 On systems that have Kerberos 1.11 or earlier, service principals with IP addresses are not supported due to a bug:
http://krbdev.mit.edu/rt/Ticket/Display.html?id=7603 Since our BE tests use such principals, they fail on older platforms with the above mentioned kerberos versions. Kudu fixed this by adding a workaround which overrides krb5_realm_override. https://github.com/cloudera/kudu/commit/ba2ae3de4a7c43ff2f5873e822410e066ea99667 We realized that even though this is linked correctly on older platforms, it does not turn on until the KUDU_ENABLE_KRB5_REALM_FIX environment variable is set. This patch sets it only for tests. We DO NOT enable this workaround for live clusters. The reasoning is that if a user of Impala is using an older version of kerberos that has a known bug of not being able to handle numeric IP addresses, then it's not on Impala to fix that issue. We allow it for tests because we want to be able to run our tests on multiple platforms. Change-Id: I7227551aabd1ef4f8e8608fefb74293f9f763e13 Reviewed-on: http://gerrit.cloudera.org:8080/9519 Reviewed-by: Sailesh Mukil <sail...@cloudera.com> Tested-by: Impala Public Jenkins Project: http://git-wip-us.apache.org/repos/asf/impala/repo Commit: http://git-wip-us.apache.org/repos/asf/impala/commit/474f6407 Tree: http://git-wip-us.apache.org/repos/asf/impala/tree/474f6407 Diff: http://git-wip-us.apache.org/repos/asf/impala/diff/474f6407 Branch: refs/heads/master Commit: 474f64079b85fb8cfe8b2369aa11733b5d767897 Parents: dd08834 Author: Sailesh Mukil <sail...@apache.org> Authored: Tue Mar 6 14:24:10 2018 -0800 Committer: Impala Public Jenkins <impala-public-jenk...@gerrit.cloudera.org> Committed: Wed Mar 7 22:06:39 2018 +0000 ---------------------------------------------------------------------- be/src/rpc/rpc-mgr-kerberized-test.cc | 4 ++-- be/src/testutil/mini-kdc-wrapper.cc | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/impala/blob/474f6407/be/src/rpc/rpc-mgr-kerberized-test.cc ---------------------------------------------------------------------- diff --git a/be/src/rpc/rpc-mgr-kerberized-test.cc b/be/src/rpc/rpc-mgr-kerberized-test.cc index bb4b9db..6244c2d 100644 --- a/be/src/rpc/rpc-mgr-kerberized-test.cc +++ b/be/src/rpc/rpc-mgr-kerberized-test.cc @@ -53,10 +53,10 @@ class RpcMgrKerberizedTest : }; // TODO: IMPALA-6477: This test breaks on CentOS 6.4. Re-enable after a fix. -/*INSTANTIATE_TEST_CASE_P(KerberosOnAndOff, +INSTANTIATE_TEST_CASE_P(KerberosOnAndOff, RpcMgrKerberizedTest, ::testing::Values(USE_KUDU_KERBEROS, - USE_IMPALA_KERBEROS));*/ + USE_IMPALA_KERBEROS)); TEST_P(RpcMgrKerberizedTest, MultipleServicesTls) { // TODO: We're starting a seperate RpcMgr here instead of configuring http://git-wip-us.apache.org/repos/asf/impala/blob/474f6407/be/src/testutil/mini-kdc-wrapper.cc ---------------------------------------------------------------------- diff --git a/be/src/testutil/mini-kdc-wrapper.cc b/be/src/testutil/mini-kdc-wrapper.cc index d378ea4..eb9d9f1 100644 --- a/be/src/testutil/mini-kdc-wrapper.cc +++ b/be/src/testutil/mini-kdc-wrapper.cc @@ -66,6 +66,9 @@ Status MiniKdcWrapper::CreateServiceKeytab(const string& spn, string* kt_path) { Status MiniKdcWrapper::SetupAndStartMiniKDC(KerberosSwitch k) { if (k != KERBEROS_OFF) { + // Enable the workaround for MIT krb5 1.10 bugs from krb5_realm_override.cc. + setenv("KUDU_ENABLE_KRB5_REALM_FIX", "true", 0); + FLAGS_use_kudu_kinit = k == USE_KUDU_KERBEROS; // Check if the unique directory already exists, and create it if it doesn't.
