Repository navigation
Conversation
…cipals BaseHttpServer never told HttpServer2 which host to use, so _HOST was expanded from the first endpoint, which is the bind address. A wildcard or interface-specific bind host does not name the node and matches no keytab entry; the S3 Gateway secret endpoint read the bind host key directly for the same purpose.
|
Documentation follow-up for this change is in progress: #11479 is unrelated; the SPNEGO Please add a short pointer in the HDDS-16347 Jira (or the doc PR) so operators know to set |
|
Correction: doc follow-up for HDDS-16347 is #11495 (updates SecuringOzoneHTTP.md: |
|
Doc Jira: https://issues.apache.org/jira/browse/HDDS-16945 (related to HDDS-16347). Doc PR: #11495 |
Store previous Kerberos realm and KDC properties to restore them after tests. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
Operator doc PR (HDDS-16945): apache/ozone-site#569 — updates the Kerberos SPNEGO page. Closed incorrect #11495. |
|
TestLogLevelEndpointSecure appears to be problematic. |
What changes were proposed in this pull request?
BaseHttpServernever sets a host onHttpServer2.Builder, so_HOSTin the SPNEGO principal is expanded from the first endpoint, which is the bind address. The S3 Gateway secret endpoint readsozone.s3g.webadmin.http-bind-hostdirectly for the same purpose.A bind host is not the name a keytab was issued for. The IPv6 wildcard that HDDS-16307 made usable gives
HTTP/[0:0:0:0:0:0:0:0]@REALM, and an interface-specific bind host gives whatever it reverse-resolves to. Only the IPv4 wildcard works today, becauseSecurityUtil.getServerPrincipalspecial-cases the literal0.0.0.0; the JIRA description is inaccurate on that point.BaseHttpServerpasses the builder the host of the advertised HTTP, then HTTPS, address when it is not a wildcard, otherwise the canonical local hostname.S3GatewayWebAdminServerexpands the secret endpoint principal from the same host.The fallback is what Hadoop already substitutes for
0.0.0.0, so deployments that leave the*-addressproperties at their0.0.0.0:<port>defaults keep their current principal; failing startup on a wildcard bind host instead would have broken exactly that default. OM, SCM and Recon expand_HOSTfor their RPC login from the advertised RPC address, so the secret endpoint was the only other principal built from a listener address.What is the link to the Apache JIRA?
https://issues.apache.org/jira/browse/HDDS-16347
How was this patch tested?
Unit tests in
TestBaseHttpServercover the host resolution for unset, wildcard, hostname and IPv6-literal advertised addresses, and the SPNEGO filter's resultingkerberos.principalfor bind hosts0.0.0.0,::and127.0.0.1;TestS3GatewayHttpServerscovers the secret endpoint with an IPv6 wildcard bind host. Without the production change the principal assertions fail withHTTP/<local hostname>@,HTTP/[0:0:0:0:0:0:0:0]@,HTTP/localhost@andHTTP/::@respectively.Generated-by: Claude Code (Fable 5.1)