LuciferYang opened a new issue, #12106:
URL: https://github.com/apache/gravitino/issues/12106
### What would you like to be improved?
`KerberosUtils.KerberosConfiguration` hardcodes `options.put("debug",
"true")` in the `Krb5LoginModule` JAAS options
(`common/src/main/java/org/apache/gravitino/auth/KerberosUtils.java`). The
login module therefore prints Kerberos authentication detail (principal, keytab
path, `useKeyTab`, etc.) to stdout on every login.
The one production path that uses this class is `clients/client-java`'s
`KerberosTokenProvider`, so a Kerberos-authenticating Java client emits this
debug output unconditionally — log noise and a minor information leak. (The
server and the Hive/Hadoop/Iceberg/Paimon catalogs use their own Kerberos login
helpers, which do not hardcode debug.)
### How should we improve?
Gate the login-module debug flag on the standard JDK Kerberos debug switch
`-Dsun.security.krb5.debug=true`, so it stays off by default in normal client
use but turns on when someone is already debugging Kerberos (which existing
Kerberos integration tests already enable via that property).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
