[
https://issues.apache.org/jira/browse/DRILL-6283?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16408733#comment-16408733
]
ASF GitHub Bot commented on DRILL-6283:
---------------------------------------
GitHub user sohami opened a pull request:
https://github.com/apache/drill/pull/1180
DRILL-6283: WebServer stores SPNEGO client principal without taking a…
…ny conversion rule
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/sohami/drill DRILL-6283
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/drill/pull/1180.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #1180
----
commit d80633021d8d81d786921051b92eda63476375de
Author: Sorabh Hamirwasia <shamirwasia@...>
Date: 2018-03-21T22:53:25Z
DRILL-6283: WebServer stores SPNEGO client principal without taking any
conversion rule
----
> WebServer stores SPNEGO client principal without taking any conversion rule
> ---------------------------------------------------------------------------
>
> Key: DRILL-6283
> URL: https://issues.apache.org/jira/browse/DRILL-6283
> Project: Apache Drill
> Issue Type: Bug
> Components: Web Server
> Affects Versions: 1.13.0
> Reporter: Sorabh Hamirwasia
> Assignee: Sorabh Hamirwasia
> Priority: Major
> Fix For: 1.14.0
>
>
> Drill's WebServer uses the exact client principal ([email protected]) as the
> stored username, it doesn't provide any configuration to specify rules which
> can be used to extract desired username from client's principal.
> For example: default rule provided by HadoopKerberosName extracts only the
> primary part (user1) in client principal.
> Also while checking if authenticated client principal has admin privileges or
> not it uses realm (e.g. QA.LAB) information to verify against configured
> admin user/group list. To make it consistent with JDBC/ODBC kerberos path, it
> should use the shortName in client principal to determine admin privileges.
> Basically server side should store the shortName from client principal
> extracted based on configured rule and use that to determine the admin
> privileges too.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
