hadoop-common-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Yongjun Zhang (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (HADOOP-10895) HTTP KerberosAuthenticator fallback should have a flag to disable it
Date Mon, 03 Nov 2014 19:30:35 GMT

    [ https://issues.apache.org/jira/browse/HADOOP-10895?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14194956#comment-14194956
] 

Yongjun Zhang commented on HADOOP-10895:
----------------------------------------

Thanks [~tucu00], 

Rev3's AuthenticatedURL code is already very much like what you said:
{code}
  /*
   *  whether it's allowed to let DEFAULT_AUTHENTICATOR to fallback to PseudoAuthenticator
   */
  private static boolean allowDefaultAuthToFallbackToPseudo = false;
  
  /**
   * Set to allow/disallow the DEFAULT_AUTHENTICATOR to fallback to
   * PseudoAuthenticator. Notice that by default, the DEFAULT_AUTHENTICATOR
   * disallow the fallback.
   */
  public static void setAllowDefaultAuthToFallbackToPseudo(
      final boolean allowFallback) {
    allowDefaultAuthToFallbackToPseudo = allowFallback;
  }

  public AuthenticatedURL(Authenticator authenticator,
                          ConnectionConfigurator connConfigurator) {
    try {
      if (authenticator != null) {
        this.authenticator = authenticator;
      } else {
        // use default authenticator
        this.authenticator = DEFAULT_AUTHENTICATOR.newInstance();   
        this.authenticator.setAllowFallbackToPseudoAuthenticator(              <=== configure
the authenticator
            allowDefaultAuthToFallbackToPseudo);
      }
    } catch (Exception ex) {
      throw new RuntimeException(ex);
    }
    ...
{code}
except it calls {{DEFAULT_AUTHENTICATOR.newInstance()}} to create an authenticator instance.
So what you were suggesting is to replace this line with a {{getAuthenticator()}} call, that
retrieves the static instance from the corresponding authenticator class (Per your earlier
suggestion, each authenticator class is going to have a static instance member).  

Is my understanding correct? If so, a little change on top of rev3 would address your suggestions...

Thanks.


> HTTP KerberosAuthenticator fallback should have a flag to disable it
> --------------------------------------------------------------------
>
>                 Key: HADOOP-10895
>                 URL: https://issues.apache.org/jira/browse/HADOOP-10895
>             Project: Hadoop Common
>          Issue Type: Bug
>          Components: security
>    Affects Versions: 2.4.1
>            Reporter: Alejandro Abdelnur
>            Assignee: Yongjun Zhang
>            Priority: Blocker
>         Attachments: HADOOP-10895.001.patch, HADOOP-10895.002.patch, HADOOP-10895.003.patch,
HADOOP-10895.004.patch
>
>
> Per review feedback in HADOOP-10771, {{KerberosAuthenticator}} and the delegation token
version coming in with HADOOP-10771 should have a flag to disable fallback to pseudo, similarly
to the one that was introduced in Hadoop RPC client with HADOOP-9698.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message