Skip to content

HDFS-14668 Support Fuse with Users from multiple Security Realms #1739

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 27, 2020
Merged

HDFS-14668 Support Fuse with Users from multiple Security Realms #1739

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/fuse-dfs/fuse_connect.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -476,7 +476,6 @@ static int fuseNewConnect(const char *usrname, struct fuse_context *ctx,
if (gPort) {
hdfsBuilderSetNameNodePort(bld, gPort);
}
hdfsBuilderSetUserName(bld, usrname);
if (gHdfsAuthConf == AUTH_CONF_KERBEROS) {
findKerbTicketCachePath(ctx, kpath, sizeof(kpath));
if (stat(kpath, &st) < 0) {
Expand All @@ -495,6 +494,17 @@ static int fuseNewConnect(const char *usrname, struct fuse_context *ctx,
ret = -ENOMEM;
goto error;
}
} else {
// earlier the username was set to the builder always, but due to
// HADOOP-9747 if we specify the username in case of kerberos authentication
// the username will be used as the principal name, and that will conflict
// with ticket cache based authentication as we have the OS user name here
// not the real kerberos principal name. So with SIMPLE auth we pass on the
// OS username still, and the UGI will use that as the username, but with
// kerberos authentication we do not pass in the OS username and let the
// authentication happen with the principal who's ticket is in the ticket
// cache. (HDFS-15034 is still a possible improvement for SIMPLE AUTH.)
hdfsBuilderSetUserName(bld, usrname);
}
conn->usrname = strdup(usrname);
if (!conn->usrname) {
Expand Down