From 0e47ebb32f62b9312b44ccbec97e302674cdee80 Mon Sep 17 00:00:00 2001
From: Kihwal Lee <kihwal@apache.org>
Date: Thu, 15 Aug 2013 19:22:09 +0000
Subject: [PATCH] HADOOP-9868. Server must not advertise kerberos realm.
 Contributed by Daryn Sharp.

git-svn-id: https://svn.apache.org/repos/asf/hadoop/common/trunk@1514448 13f79535-47bb-0310-9956-ffa450edef68
---
 hadoop-common-project/hadoop-common/CHANGES.txt                 | 2 ++
 .../src/main/java/org/apache/hadoop/security/SaslRpcServer.java | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt
index 3a5736a1f53..43a89d897dd 100644
--- a/hadoop-common-project/hadoop-common/CHANGES.txt
+++ b/hadoop-common-project/hadoop-common/CHANGES.txt
@@ -394,6 +394,8 @@ Release 2.1.1-beta - UNRELEASED
 
     HADOOP-9381. Document dfs cp -f option. (Keegan Witt, suresh via suresh)
 
+    HADOOP-9868. Server must not advertise kerberos realm. (daryn via kihwal)
+
 Release 2.1.0-beta - 2013-08-06
 
   INCOMPATIBLE CHANGES
diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcServer.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcServer.java
index fffedc1a11e..9408028ffa2 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcServer.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcServer.java
@@ -104,7 +104,7 @@ public SaslRpcServer(AuthMethod authMethod) throws IOException {
         if (LOG.isDebugEnabled())
           LOG.debug("Kerberos principal name is " + fullName);
         // don't use KerberosName because we don't want auth_to_local
-        String[] parts = fullName.split("[/@]", 2);
+        String[] parts = fullName.split("[/@]", 3);
         protocol = parts[0];
         // should verify service host is present here rather than in create()
         // but lazy tests are using a UGI that isn't a SPN...