HADOOP-18573. Improve error reporting on non-standard kerberos names #5221

steveloughran · 2022-12-14T12:22:01Z

The kerberos RPC does not declare any restriction on characters used in kerberos names, though implementations MAY be more restrictive.

If the kerberos controller supports use non-conventional principal names and the kerberos admin chooses to use them this can confuse some of the parsing.

The obvious solution is for the enterprise admins to "not do that" as a lot of things break, bits of hadoop included.

Harden the hadoop code slightly so at least we fail more gracefully, so people can then get in touch with their sysadmin and tell them to stop it.

How was this patch tested?

For code changes:

Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?

The kerberos RPC does not declare any restriction on characters used in kerberos names, though implementations MAY be more restrictive. If the kerberos controller supports use non-conventional principal names *and the kerberos admin chooses to use them* this can confuse some of the parsing. The obvious solution is for the enterprise admins to "not do that" as a lot of things break, bits of hadoop included. Harden the hadoop code slightly so at least we fail more gracefully, so people can then get in touch with their sysadmin and tell them to stop it. Change-Id: If7f2e799b18260ece3b787871269bea9f9f92ca6

hadoop-yetus · 2022-12-14T15:52:21Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 46s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 1s		codespell was not available.
+0 🆗	detsecrets	0m 1s		detect-secrets was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+1 💚	mvninstall	39m 13s		trunk passed
+1 💚	compile	23m 4s		trunk passed with JDK Ubuntu-11.0.17+8-post-Ubuntu-1ubuntu220.04
+1 💚	compile	20m 27s		trunk passed with JDK Private Build-1.8.0_352-8u352-ga-1~20.04-b08
+1 💚	checkstyle	1m 14s		trunk passed
+1 💚	mvnsite	1m 40s		trunk passed
-1 ❌	javadoc	1m 16s	/branch-javadoc-hadoop-common-project_hadoop-common-jdkUbuntu-11.0.17+8-post-Ubuntu-1ubuntu220.04.txt	hadoop-common in trunk failed with JDK Ubuntu-11.0.17+8-post-Ubuntu-1ubuntu220.04.
+1 💚	javadoc	0m 52s		trunk passed with JDK Private Build-1.8.0_352-8u352-ga-1~20.04-b08
+1 💚	spotbugs	2m 43s		trunk passed
+1 💚	shadedclient	22m 8s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+1 💚	mvninstall	0m 59s		the patch passed
+1 💚	compile	22m 27s		the patch passed with JDK Ubuntu-11.0.17+8-post-Ubuntu-1ubuntu220.04
+1 💚	javac	22m 27s		the patch passed
+1 💚	compile	21m 0s		the patch passed with JDK Private Build-1.8.0_352-8u352-ga-1~20.04-b08
+1 💚	javac	21m 0s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	checkstyle	1m 4s		the patch passed
+1 💚	mvnsite	1m 45s		the patch passed
-1 ❌	javadoc	0m 59s	/patch-javadoc-hadoop-common-project_hadoop-common-jdkUbuntu-11.0.17+8-post-Ubuntu-1ubuntu220.04.txt	hadoop-common in the patch failed with JDK Ubuntu-11.0.17+8-post-Ubuntu-1ubuntu220.04.
+1 💚	javadoc	0m 46s		the patch passed with JDK Private Build-1.8.0_352-8u352-ga-1~20.04-b08
+1 💚	spotbugs	2m 53s		the patch passed
+1 💚	shadedclient	23m 25s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	unit	19m 27s		hadoop-common in the patch passed.
+1 💚	asflicense	0m 55s		The patch does not generate ASF License warnings.
		209m 0s

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5221/1/artifact/out/Dockerfile
GITHUB PR	#5221
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell detsecrets
uname	Linux 200e354b0654 4.15.0-200-generic #211-Ubuntu SMP Thu Nov 24 18:16:04 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `e4379b6`
Default Java	Private Build-1.8.0_352-8u352-ga-1~20.04-b08
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.17+8-post-Ubuntu-1ubuntu220.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_352-8u352-ga-1~20.04-b08
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5221/1/testReport/
Max. process+thread count	1255 (vs. ulimit of 5500)
modules	C: hadoop-common-project/hadoop-common U: hadoop-common-project/hadoop-common
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5221/1/console
versions	git=2.25.1 maven=3.6.3 spotbugs=4.2.2
Powered by	Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

steveloughran · 2022-12-14T15:59:01Z

@cnauroth @jojochuang can i get a review of this? thanks

cnauroth

+1

Thank you for the patch, @steveloughran .

…5221) The kerberos RPC does not declare any restriction on characters used in kerberos names, though implementations MAY be more restrictive. If the kerberos controller supports use non-conventional principal names *and the kerberos admin chooses to use them* this can confuse some of the parsing. The obvious solution is for the enterprise admins to "not do that" as a lot of things break, bits of hadoop included. Harden the hadoop code slightly so at least we fail more gracefully, so people can then get in touch with their sysadmin and tell them to stop it.

brahmareddybattula · 2022-12-17T06:59:39Z

@steveloughran can we cherry-pick to branch-3.2 also.

steveloughran · 2022-12-17T12:23:48Z

sure

…pache#5221) The kerberos RPC does not declare any restriction on characters used in kerberos names, though implementations MAY be more restrictive. If the kerberos controller supports use non-conventional principal names *and the kerberos admin chooses to use them* this can confuse some of the parsing. The obvious solution is for the enterprise admins to "not do that" as a lot of things break, bits of hadoop included. Harden the hadoop code slightly so at least we fail more gracefully, so people can then get in touch with their sysadmin and tell them to stop it.

steveloughran assigned steveloughran, QwertyManiac, cnauroth and jojochuang and unassigned steveloughran and QwertyManiac Dec 14, 2022

cnauroth approved these changes Dec 14, 2022

View reviewed changes

steveloughran merged commit f7b1bb4 into apache:trunk Dec 15, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

HADOOP-18573. Improve error reporting on non-standard kerberos names #5221

HADOOP-18573. Improve error reporting on non-standard kerberos names #5221

steveloughran commented Dec 14, 2022

hadoop-yetus commented Dec 14, 2022

steveloughran commented Dec 14, 2022

cnauroth left a comment

brahmareddybattula commented Dec 17, 2022

steveloughran commented Dec 17, 2022

HADOOP-18573. Improve error reporting on non-standard kerberos names #5221

HADOOP-18573. Improve error reporting on non-standard kerberos names #5221

Conversation

steveloughran commented Dec 14, 2022

How was this patch tested?

For code changes:

hadoop-yetus commented Dec 14, 2022

steveloughran commented Dec 14, 2022

cnauroth left a comment

Choose a reason for hiding this comment

brahmareddybattula commented Dec 17, 2022

steveloughran commented Dec 17, 2022