HDDS-3280. Ozone BaseHTTPServer should honor ozone.security.enabled c…

hadoop-hdds/common/src/main/java/org/apache/hadoop/ozone/OzoneConfigKeys.java

@@ -347,6 +347,10 @@ public final class OzoneConfigKeys {
       "ozone.security.enabled";
   public static final boolean OZONE_SECURITY_ENABLED_DEFAULT = false;
 
+  public static final String OZONE_HTTP_SECURITY_ENABLED_KEY =
+      "ozone.security.http.kerberos.enabled";
+  public static final boolean OZONE_HTTP_SECURITY_ENABLED_DEFAULT = false;
+
   public static final String OZONE_CONTAINER_COPY_WORKDIR =
       "hdds.datanode.replication.work.dir";
 

hadoop-hdds/common/src/main/java/org/apache/hadoop/ozone/OzoneSecurityUtil.java

@@ -18,6 +18,8 @@
 
 package org.apache.hadoop.ozone;
 
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_HTTP_SECURITY_ENABLED_DEFAULT;
+import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_HTTP_SECURITY_ENABLED_KEY;
 import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_DEFAULT;
 import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_SECURITY_ENABLED_KEY;
 
@@ -61,6 +63,12 @@ public static boolean isSecurityEnabled(Configuration conf) {
         OZONE_SECURITY_ENABLED_DEFAULT);
   }
 
+  public static boolean isHttpSecurityEnabled(Configuration conf) {
+    return isSecurityEnabled(conf) &&
+        conf.getBoolean(OZONE_HTTP_SECURITY_ENABLED_KEY,
+        OZONE_HTTP_SECURITY_ENABLED_DEFAULT);
+  }
+
   /**
    * Returns Keys status.
    *

hadoop-hdds/common/src/main/resources/ozone-default.xml

@@ -1497,11 +1497,21 @@
   <property>
     <name>ozone.security.enabled</name>
     <value>false</value>
-    <tag> OZONE, SECURITY</tag>
+    <tag>OZONE, SECURITY</tag>
     <description>True if security is enabled for ozone. When this property is
      true, hadoop.security.authentication should be Kerberos.
     </description>
   </property>
+  <property>
+    <name>ozone.security.http.kerberos.enabled</name>
+    <value>false</value>
+    <tag>OZONE, SECURITY</tag>
+    <description>True if Kerberos authentication for Ozone HTTP web consoles
+      is enabled using the SPNEGO protocol. When this property is
+      true, hadoop.security.authentication should be Kerberos and
+      ozone.security.enabled should be set to true.
+    </description>
+  </property>
 
   <property>
     <name>ozone.client.checksum.type</name>

hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/server/http/BaseHttpServer.java

@@ -31,6 +31,7 @@
 import org.apache.hadoop.metrics2.lib.DefaultMetricsSystem;
 import org.apache.hadoop.net.NetUtils;
 import org.apache.hadoop.ozone.OzoneConfigKeys;
+import org.apache.hadoop.ozone.OzoneSecurityUtil;
 import org.apache.hadoop.security.SecurityUtil;
 import org.apache.hadoop.security.UserGroupInformation;
 import org.apache.hadoop.security.authorize.AccessControlList;
@@ -134,8 +135,6 @@ public BaseHttpServer(Configuration conf, String name) throws IOException {
     }
   }
 
-
-
   /**
    * Return a HttpServer.Builder that the OzoneManager/SCM/Datanode/S3Gateway/
    * Recon to initialize their HTTP / HTTPS server.
@@ -145,16 +144,18 @@ public static HttpServer2.Builder newHttpServer2BuilderForOzone(
       final InetSocketAddress httpsAddr, String name, String spnegoUserNameKey,
       String spnegoKeytabFileKey) throws IOException {
     HttpConfig.Policy policy = getHttpPolicy(conf);
+    boolean isSecurityEnabled = UserGroupInformation.isSecurityEnabled() &&
+        OzoneSecurityUtil.isHttpSecurityEnabled(conf);
 
     HttpServer2.Builder builder = new HttpServer2.Builder().setName(name)
         .setConf(conf).setACL(new AccessControlList(conf.get(
             OZONE_ADMINISTRATORS, " ")))
-        .setSecurityEnabled(UserGroupInformation.isSecurityEnabled())
+        .setSecurityEnabled(isSecurityEnabled)
         .setUsernameConfKey(spnegoUserNameKey)
         .setKeytabConfKey(spnegoKeytabFileKey);
 
     // initialize the webserver for uploading/downloading files.
-    if (UserGroupInformation.isSecurityEnabled()) {
+    if (isSecurityEnabled) {
       LOG.info("Starting web server as: "
           + SecurityUtil.getServerPrincipal(conf.get(spnegoUserNameKey),
           httpAddr.getHostName()));