Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

HDFS-16686. GetJournalEditServlet fails to authorize valid Kerberos request #4724

Merged
merged 9 commits into from
Aug 23, 2022
Merged

HDFS-16686. GetJournalEditServlet fails to authorize valid Kerberos request #4724

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
18b1d9c
HDFS-16686. GetJournalEditServlet fails to authorize valid Kerberos r…
Jul 25, 2022
32431de
Add tests for isValidRequestor
Aug 11, 2022
17b6fd0
Address Checkstyle and license issues
Aug 12, 2022
f777e41
Use try-with-resources to ensure close/shutdown
Aug 17, 2022
a228eed
Make MiniQJMHACluster AutoCloseable like MIniDFSCluster
Aug 17, 2022
e2b1133
Use try-with-resources for mini clusters
Aug 17, 2022
1c8f552
Use test-specific data directories
Aug 17, 2022
3fee706
Fix whitespace and remove debug logger
Aug 22, 2022
a0e2cac
Restore shutdown IOException
Aug 22, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 10 additions & 16 deletions ...doop-hdfs/src/main/java/org/apache/hadoop/hdfs/qjournal/server/GetJournalEditServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,11 @@

import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.text.StringEscapeUtils;
import org.apache.hadoop.hdfs.server.namenode.DfsServlet;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.apache.hadoop.classification.InterfaceAudience;
Expand Down Expand Up @@ -64,7 +64,7 @@
* </ul>
*/
@InterfaceAudience.Private
public class GetJournalEditServlet extends HttpServlet {
public class GetJournalEditServlet extends DfsServlet {

private static final long serialVersionUID = -4635891628211723009L;
private static final Logger LOG =
Expand All @@ -77,17 +77,11 @@ public class GetJournalEditServlet extends HttpServlet {

protected boolean isValidRequestor(HttpServletRequest request, Configuration conf)
throws IOException {
String remotePrincipal = request.getUserPrincipal().getName();
String remoteShortName = request.getRemoteUser();
if (remotePrincipal == null) { // This really shouldn't happen...
LOG.warn("Received null remoteUser while authorizing access to " +
"GetJournalEditServlet");
return false;
}
UserGroupInformation ugi = getUGI(request, conf);

if (LOG.isDebugEnabled()) {
LOG.debug("Validating request made by " + remotePrincipal +
" / " + remoteShortName + ". This user is: " +
LOG.debug("Validating request made by " + ugi.getUserName() +
" / " + ugi.getShortUserName() + ". This user is: " +
UserGroupInformation.getLoginUser());
}

Expand Down Expand Up @@ -115,26 +109,26 @@ protected boolean isValidRequestor(HttpServletRequest request, Configuration con
for (String v : validRequestors) {
if (LOG.isDebugEnabled())
LOG.debug("isValidRequestor is comparing to valid requestor: " + v);
if (v != null && v.equals(remotePrincipal)) {
if (v != null && v.equals(ugi.getUserName())) {
if (LOG.isDebugEnabled())
LOG.debug("isValidRequestor is allowing: " + remotePrincipal);
LOG.debug("isValidRequestor is allowing: " + ugi.getUserName());
return true;
}
}

// Additionally, we compare the short name of the requestor to this JN's
// username, because we want to allow requests from other JNs during
// recovery, but we can't enumerate the full list of JNs.
if (remoteShortName.equals(
if (ugi.getShortUserName().equals(
UserGroupInformation.getLoginUser().getShortUserName())) {
if (LOG.isDebugEnabled())
LOG.debug("isValidRequestor is allowing other JN principal: " +
remotePrincipal);
ugi.getUserName());
return true;
}

if (LOG.isDebugEnabled())
LOG.debug("isValidRequestor is rejecting: " + remotePrincipal);
LOG.debug("isValidRequestor is rejecting: " + ugi.getUserName());
return false;
}

Expand Down
Loading