[
https://issues.apache.org/jira/browse/YARN-8258?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16502190#comment-16502190
]
Eric Yang commented on YARN-8258:
---------------------------------
[~sunilg] While I agree that pathSpec plays a important role to ensure the
filtering is applied properly, I don't agree on RMAuthenticationFilter and
Spnego filter are both required. RMAuthenticationFilter is extended from
DelegationTokenAuthenticationFilter which extends from AuthenticationFilter.
There should be one or the other filter per server:port, not both because the
same Kerberos TGT may be checked twice and try to grant two TGS of the same
name when PathSpecs overlaps one or another. It may not be surfacing as error
now when there is not interception between webapp paths, but it might become
difficult to debug in the future. Proxy webapp path overlapping with RM is a
perfect example of how difficult the problem has became in YARN-8108. If we
can avoid to initialize another instance of RMAuthenticationFilter, and Spnego
filter, and commit YARN-8108 to make this filter global. I think it will
nullified the problem once for all embedded web applications.
> YARN webappcontext for UI2 should inherit all filters from default context
> --------------------------------------------------------------------------
>
> Key: YARN-8258
> URL: https://issues.apache.org/jira/browse/YARN-8258
> Project: Hadoop YARN
> Issue Type: Bug
> Components: webapp
> Reporter: Sumana Sathish
> Assignee: Sunil Govindan
> Priority: Major
> Attachments: YARN-8258.001.patch, YARN-8258.002.patch,
> YARN-8258.003.patch, YARN-8258.004.patch, YARN-8258.005.patch,
> YARN-8258.006.patch, YARN-8258.007.patch
>
>
> Thanks [[email protected]] for finding this.
> Ideally all filters from default context has to be inherited to UI2 context
> as well.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
