Apache
/
hadoop
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

HADOOP-6932. Namenode start (init) fails because of invalid kerberos key, even when security set to simple 

git-svn-id: https://svn.apache.org/repos/asf/hadoop/common/trunk@991030 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Boris Shkolnik 2010-08-30 23:42:17 +00:00
parent a89fb4dcdc
commit 4f79b07e17
3 changed files with 37 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES.txt
View File

@ -220,6 +220,9 @@ Trunk (unreleased changes)
HADOOP-6833. IPC leaks call parameters when exceptions thrown.
(Todd Lipcon via Eli Collins)
HADOOP-6932. Namenode start (init) fails because of invalid kerberos
key, even when security set to "simple" (boryas)
Release 0.21.0 - Unreleased
INCOMPATIBLE CHANGES

16
src/java/org/apache/hadoop/security/SecurityUtil.java
View File

@ -174,7 +174,7 @@ public class SecurityUtil {
}
/**
* If a keytab has been provided, login as that user. Substitute $host in
* Login as a principal specified in config. Substitute $host in
* user's Kerberos principal name with a dynamically looked-up fully-qualified
* domain name of the current host.
*
@ -192,8 +192,9 @@ public class SecurityUtil {
}
/**
* If a keytab has been provided, login as that user. Substitute $host in
* user's Kerberos principal name with hostname.
* Login as a principal specified in config. Substitute $host in user's Kerberos principal
* name with hostname. If non-secure mode - return. If no keytab available -
* bail out with an exception
*
* @param conf
* conf to use
@ -208,10 +209,15 @@ public class SecurityUtil {
public static void login(final Configuration conf,
final String keytabFileKey, final String userNameKey, String hostname)
throws IOException {
String keytabFilename = conf.get(keytabFileKey);
if (keytabFilename == null)
if(! UserGroupInformation.isSecurityEnabled())
return;
String keytabFilename = conf.get(keytabFileKey);
if (keytabFilename == null || keytabFilename.length() == 0) {
throw new IOException("Running in secure mode, but config doesn't have a keytab");
}
String principalConfig = conf.get(userNameKey, System
.getProperty("user.name"));
String principalName = SecurityUtil.getServerPrincipal(principalConfig,

24
src/test/core/org/apache/hadoop/security/TestSecurityUtil.java
View File

@ -16,12 +16,15 @@
*/
package org.apache.hadoop.security;
import static org.junit.Assert.*;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertTrue;
import java.io.IOException;
import javax.security.auth.kerberos.KerberosPrincipal;
import org.apache.hadoop.conf.Configuration;
import org.junit.Assert;
import org.junit.Test;
public class TestSecurityUtil {
@ -70,4 +73,23 @@ public class TestSecurityUtil {
verify(shouldNotReplace, hostname, shouldNotReplace);
verify(shouldNotReplace, shouldNotReplace, shouldNotReplace);
}
@Test
public void testStartsWithIncorrectSettings() throws IOException {
Configuration conf = new Configuration();
conf.set(
org.apache.hadoop.fs.CommonConfigurationKeys.HADOOP_SECURITY_AUTHENTICATION,
"kerberos");
String keyTabKey="key";
conf.set(keyTabKey, "");
UserGroupInformation.setConfiguration(conf);
boolean gotException = false;
try {
SecurityUtil.login(conf, keyTabKey, "", "");
} catch (IOException e) {
// expected
gotException=true;
}
assertTrue("Exception for empty keytabfile name was expected", gotException);
}
}