[
https://issues.apache.org/jira/browse/HBASE-25051?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17806305#comment-17806305
]
Duo Zhang commented on HBASE-25051:
-----------------------------------
https://github.com/Apache9/hbase/commit/d59aeba39f9b4ae43ba5d28ac68d153108bf1c5a
I've basically implemented the above approach, but I need to figure out the
correct way to write the test, as I'm not very familiar with token based
authentication...
> DIGEST based auth broken for rpc based ConnectionRegistry
> ---------------------------------------------------------
>
> Key: HBASE-25051
> URL: https://issues.apache.org/jira/browse/HBASE-25051
> Project: HBase
> Issue Type: Sub-task
> Components: Client, security
> Affects Versions: 3.0.0-alpha-1, 2.3.0, 1.7.0
> Reporter: Bharath Vissapragada
> Assignee: Duo Zhang
> Priority: Minor
>
> DIGEST-MD5 based sasl auth depends on cluster-ID to obtain tokens. With
> master registry, we have a circular dependency here because master registry
> needs an rpcClient to talk to masters (and to get cluster ID) and rpc-Client
> needs a clusterId if DIGEST based auth is configured. Earlier, there was a ZK
> client that has its own authentication mechanism to fetch the cluster ID.
> HBASE-23330, I think doesn't fully fix the problem. It depends on an active
> connection to fetch delegation tokens for the MR job and that inherently
> assumes that the active connection does not use a DIGEST auth.
> It is not clear to me how common it is to use DIGEST based auth in
> connections.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
