[
https://issues.apache.org/jira/browse/KNOX-2672?focusedWorklogId=658269&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-658269
]
ASF GitHub Bot logged work on KNOX-2672:
----------------------------------------
Author: ASF GitHub Bot
Created on: 30/Sep/21 11:32
Start Date: 30/Sep/21 11:32
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request #503:
URL: https://github.com/apache/knox/pull/503
## What changes were proposed in this pull request?
The `HadoopAuthFilter` is now able to lookup aliases in the `__gateway`
credential store too.
## How was this patch tested?
Added a new unit test and ran them all.
Additionally, I executed manual testing:
1. saved an alias on the gateway level called `kerberos.keytab` pointing to
a non-existing keytab path
```
$ bin/knoxcli.sh create-alias kerberos.keytab --value /tmp/knox.keytab
kerberos.keytab has been successfully created .
$ bin/knoxcli.sh list-alias
Listing aliases for: __gateway
kerberos.keytab
knox.token.hash.key
2 items.
```
2. created a new provider/descriptor pair:
```
$ cat conf/shared-providers/kerberos-providers.json
{
"providers": [
{
"role": "authentication",
"name": "HadoopAuth",
"enabled": "true",
"params": {
"config.prefix": "hadoop.auth.config",
"hadoop.auth.config.type": "kerberos",
"hadoop.auth.config.signature.secret":
"${ALIAS=AUTH_CONFIG_SIGNATURE_SECRET}",
"hadoop.auth.config.simple.anonymous.allowed": "false",
"hadoop.auth.config.token.validity": "1800",
"hadoop.auth.config.cookie.path": "/",
"hadoop.auth.config.kerberos.principal": "knox",
"hadoop.auth.config.kerberos.keytab": "${ALIAS=kerberos.keytab}",
"hadoop.auth.config.kerberos.name.rules": "DEFAULT"
}
},
{
"role": "identity-assertion",
"name": "HadoopGroupProvider",
"enabled": "true",
"params": {
"CENTRAL_GROUP_CONFIG_PREFIX": "gateway.group.config."
}
}
]
}
$ cat conf/descriptors/myKerberosBasedTopology.json
{
"provider-config-ref": "kerberos-providers",
"services": [
{
"name": "KNOXTOKEN",
"params": {
"knox.token.ttl": "36000"
}
}
]
}
```
3. Issued a `curl` command to get a Knox token using my newly created
`myKerberosBasedTopology`:
```
$ curl -s -u: -k
"https://localhost:8443/gateway/myKerberosBasedTopology/knoxtoken/api/v1/token";
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>Error 500 javax.servlet.ServletException:
javax.servlet.ServletException: javax.servlet.ServletException:
javax.servlet.ServletException: Keytab does not exist: /tmp/knox.keytab</title>
</head>
<body><h2>HTTP ERROR 500 javax.servlet.ServletException:
javax.servlet.ServletException: javax.servlet.ServletException:
javax.servlet.ServletException: Keytab does not exist: /tmp/knox.keytab</h2>
<table>
<tr><th>URI:</th><td>/gateway/myKerberosBasedTopology/knoxtoken/api/v1/token</td></tr>
<tr><th>STATUS:</th><td>500</td></tr>
<tr><th>MESSAGE:</th><td>javax.servlet.ServletException:
javax.servlet.ServletException: javax.servlet.ServletException:
javax.servlet.ServletException: Keytab does not exist:
/tmp/knox.keytab</td></tr>
<tr><th>SERVLET:</th><td>myKerberosBasedTopology-knox-gateway-servlet</td></tr>
<tr><th>CAUSED BY:</th><td>javax.servlet.ServletException:
javax.servlet.ServletException: javax.servlet.ServletException:
javax.servlet.ServletException: Keytab does not exist:
/tmp/knox.keytab</td></tr>
<tr><th>CAUSED BY:</th><td>javax.servlet.ServletException:
javax.servlet.ServletException: javax.servlet.ServletException: Keytab does not
exist: /tmp/knox.keytab</td></tr>
<tr><th>CAUSED BY:</th><td>javax.servlet.ServletException:
javax.servlet.ServletException: Keytab does not exist:
/tmp/knox.keytab</td></tr>
<tr><th>CAUSED BY:</th><td>javax.servlet.ServletException: Keytab does not
exist: /tmp/knox.keytab</td></tr>
</table>
</body>
</html>
```
As you can see, the alias was resolved properly to `/tmp/knox.keytab`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
Issue Time Tracking
-------------------
Worklog Id: (was: 658269)
Remaining Estimate: 0h
Time Spent: 10m
> Handle gateway-level aliases in Hadoop authentication filter
> ------------------------------------------------------------
>
> Key: KNOX-2672
> URL: https://issues.apache.org/jira/browse/KNOX-2672
> Project: Apache Knox
> Issue Type: Improvement
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The current {{HadoopAuthFilter}} implementation is [capable of handling
> aliases on topology
> level|https://github.com/apache/knox/blob/v1.5.0/gateway-provider-security-hadoopauth/src/main/java/org/apache/knox/gateway/hadoopauth/filter/HadoopAuthFilter.java#L267-L275]:
> {noformat}
> if (value.startsWith("${ALIAS=") && value.endsWith("}")) {
> String alias = value.substring("${ALIAS=".length(), value.length()
> - 1);
> try {
> value = String.valueOf(
> aliasService.getPasswordFromAliasForCluster(clusterName,
> alias));
> } catch (AliasServiceException e) {
> throw new ServletException("Unable to retrieve alias for config:
> " + name, e);
> }
> }
> {noformat}
> However, this solution is not too flexible: imagine you create a shared
> provider configuration with the {{HadoopAuth}} provider where you want to use
> an alias (e.g the keytab file location in Cloudera Manager isn't static, it's
> relative to the Knox process's directory). At the provider creation time, you
> don't know the descriptors (topologies) that may reference your newly created
> shared provider configuration. Thus, you cannot create the desired aliases in
> advance using the Knox CLI. what you can do is to create an alias on the
> gateway-level which the HadoopAuth filter should be able to lookup.
> The suggested solution is to extend the above logic as follows: if the
> topology-level alias is not found, try to get the value from the
> gateway-level.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
