Uploaded image for project: 'Hadoop Common'
  1. Hadoop Common
  2. HADOOP-18666

A whitelist of endpoints to skip Kerberos authentication doesn't work for ResourceManager and Job History Server

    XMLWordPrintableJSON

Details

    • Reviewed

    Description

      Thanks to HADOOP-16527, we can add a whitelist of endpoints to skip Kerberos authentication such as /isActive, /jmx, /prom.
      However, I found that ResourceManager and Job History Server doesn't repect hadoop.http.authentication.kerberos.endpoint.whitelist.

      To workaround this issue for ResourceManager, set yarn.resourcemanager.webapp.delegation-token-auth-filter.enabled=true in yarn-site.xml.
      However, there is no workaround for Job History Server.

      This bug is caused by HttpServer2#initSpnego call without proper configurations which starts with "hadoop.http.authentication.".

      I will make a PR soon.

      Attachments

        Issue Links

          Activity

            People

              eub YUBI LEE
              eub YUBI LEE
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: