Apache
/
hadoop
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

HADOOP-6932. Namenode start (init) fails because of invalid kerberos key, even when security set to simple 

git-svn-id: https://svn.apache.org/repos/asf/hadoop/common/trunk@991030 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Boris Shkolnik 2010-08-30 23:42:17 +00:00
parent a89fb4dcdc
commit 4f79b07e17
3 changed files with 37 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES.txt
View File

@ -220,6 +220,9 @@ Trunk (unreleased changes)
HADOOP-6833. IPC leaks call parameters when exceptions thrown. HADOOP-6833. IPC leaks call parameters when exceptions thrown.
(Todd Lipcon via Eli Collins) (Todd Lipcon via Eli Collins)
HADOOP-6932. Namenode start (init) fails because of invalid kerberos
key, even when security set to "simple" (boryas)
Release 0.21.0 - Unreleased Release 0.21.0 - Unreleased
INCOMPATIBLE CHANGES INCOMPATIBLE CHANGES

16
src/java/org/apache/hadoop/security/SecurityUtil.java
View File

@ -174,7 +174,7 @@ static String getLocalHostName() throws UnknownHostException {
} }
/** /**
* If a keytab has been provided, login as that user. Substitute $host in * Login as a principal specified in config. Substitute $host in
* user's Kerberos principal name with a dynamically looked-up fully-qualified * user's Kerberos principal name with a dynamically looked-up fully-qualified
* domain name of the current host. * domain name of the current host.
* *
@ -192,8 +192,9 @@ public static void login(final Configuration conf,
} }
/** /**
* If a keytab has been provided, login as that user. Substitute $host in * Login as a principal specified in config. Substitute $host in user's Kerberos principal
* user's Kerberos principal name with hostname. * name with hostname. If non-secure mode - return. If no keytab available -
* bail out with an exception
* *
* @param conf * @param conf
* conf to use * conf to use
@ -208,9 +209,14 @@ public static void login(final Configuration conf,
public static void login(final Configuration conf, public static void login(final Configuration conf,
final String keytabFileKey, final String userNameKey, String hostname) final String keytabFileKey, final String userNameKey, String hostname)
throws IOException { throws IOException {
String keytabFilename = conf.get(keytabFileKey);
if (keytabFilename == null) if(! UserGroupInformation.isSecurityEnabled())
return; return;
String keytabFilename = conf.get(keytabFileKey);
if (keytabFilename == null || keytabFilename.length() == 0) {
throw new IOException("Running in secure mode, but config doesn't have a keytab");
}
String principalConfig = conf.get(userNameKey, System String principalConfig = conf.get(userNameKey, System
.getProperty("user.name")); .getProperty("user.name"));

24
src/test/core/org/apache/hadoop/security/TestSecurityUtil.java
View File

@ -16,12 +16,15 @@
*/ */
package org.apache.hadoop.security; package org.apache.hadoop.security;
import static org.junit.Assert.*; import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertTrue;
import java.io.IOException; import java.io.IOException;
import javax.security.auth.kerberos.KerberosPrincipal; import javax.security.auth.kerberos.KerberosPrincipal;
import org.apache.hadoop.conf.Configuration;
import org.junit.Assert;
import org.junit.Test; import org.junit.Test;
public class TestSecurityUtil { public class TestSecurityUtil {
@ -70,4 +73,23 @@ public void testGetServerPrincipal() throws IOException {
verify(shouldNotReplace, hostname, shouldNotReplace); verify(shouldNotReplace, hostname, shouldNotReplace);
verify(shouldNotReplace, shouldNotReplace, shouldNotReplace); verify(shouldNotReplace, shouldNotReplace, shouldNotReplace);
} }
@Test
public void testStartsWithIncorrectSettings() throws IOException {
Configuration conf = new Configuration();
conf.set(
org.apache.hadoop.fs.CommonConfigurationKeys.HADOOP_SECURITY_AUTHENTICATION,
"kerberos");
String keyTabKey="key";
conf.set(keyTabKey, "");
UserGroupInformation.setConfiguration(conf);
boolean gotException = false;
try {
SecurityUtil.login(conf, keyTabKey, "", "");
} catch (IOException e) {
// expected
gotException=true;
}
assertTrue("Exception for empty keytabfile name was expected", gotException);
}
} }