From 5d91f9fe35774a556604a82eea145fd822e73ef7 Mon Sep 17 00:00:00 2001 From: Jing Zhao Date: Thu, 18 Aug 2016 14:55:26 -0700 Subject: [PATCH] HADOOP-13503. Improve SaslRpcClient failure logging. Contributed by Xiaobing Zhou. (cherry picked from commit 9fdd1ea72497f7a8aadbfedeba36688e0c16c52e) --- .../apache/hadoop/security/SaslRpcClient.java | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java index 7d3afa879f4..1bb81ac7f3d 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java @@ -303,13 +303,16 @@ String getServerPrincipal(SaslAuth authType) throws IOException { authType.getProtocol() + "/" + authType.getServerId(), KerberosPrincipal.KRB_NT_SRV_HST).getName(); - boolean isPrincipalValid = false; - // use the pattern if defined String serverKeyPattern = conf.get(serverKey + ".pattern"); if (serverKeyPattern != null && !serverKeyPattern.isEmpty()) { Pattern pattern = GlobPattern.compile(serverKeyPattern); - isPrincipalValid = pattern.matcher(serverPrincipal).matches(); + if (!pattern.matcher(serverPrincipal).matches()) { + throw new IllegalArgumentException(String.format( + "Server has invalid Kerberos principal: %s," + + " doesn't match the pattern: %s", + serverPrincipal, serverKeyPattern)); + } } else { // check that the server advertised principal matches our conf String confPrincipal = SecurityUtil.getServerPrincipal( @@ -328,11 +331,11 @@ String getServerPrincipal(SaslAuth authType) throws IOException { "Kerberos principal name does NOT have the expected hostname part: " + confPrincipal); } - isPrincipalValid = serverPrincipal.equals(confPrincipal); - } - if (!isPrincipalValid) { - throw new IllegalArgumentException( - "Server has invalid Kerberos principal: " + serverPrincipal); + if (!serverPrincipal.equals(confPrincipal)) { + throw new IllegalArgumentException(String.format( + "Server has invalid Kerberos principal: %s, expecting: %s", + serverPrincipal, confPrincipal)); + } } return serverPrincipal; }