Copilot commented on code in PR #11495: URL: https://github.com/apache/ozone/pull/11495#discussion_r4250757180
########## hadoop-hdds/docs/content/security/SecuringOzoneHTTP.md: ########## @@ -54,6 +54,33 @@ ozone.http.filter.initializers | org.apache.hadoop.security.AuthenticationFilter After that, individual component needs to configure properly to completely enable SPNEGO or SIMPLE authentication. +### Resolving `_HOST` in the Kerberos principal + +`HTTP/_HOST@REALM` in `*.http.auth.kerberos.principal` is expanded at startup. The +hostname must match your **keytab** and the **host in the browser URL**. + +Ozone takes `_HOST` from the **advertised** web address (`ozone.<service>.http-address` +or `https-address`), **not** from `*-http-bind-host`. Bind host only chooses where +the process listens (`0.0.0.0`, `::`, a NIC IP, and so on). + +| Property (OM example) | Example | Used for `_HOST` | +|-----------------------|---------|------------------| +| `ozone.om.http-address` | `om1.example.com:9874` | Yes | +| `ozone.om.http-bind-host` | `0.0.0.0` or `::` | No | Review Comment: This table is not valid Markdown table syntax due to the double leading `||` on each line. Most Markdown renderers will not recognize it as a table. Use a single leading `|` per row (and keep the separator row aligned) so the docs site renders it correctly. ########## hadoop-hdds/docs/content/security/SecuringOzoneHTTP.md: ########## @@ -54,6 +54,33 @@ ozone.http.filter.initializers | org.apache.hadoop.security.AuthenticationFilter After that, individual component needs to configure properly to completely enable SPNEGO or SIMPLE authentication. +### Resolving `_HOST` in the Kerberos principal + +`HTTP/_HOST@REALM` in `*.http.auth.kerberos.principal` is expanded at startup. The +hostname must match your **keytab** and the **host in the browser URL**. + +Ozone takes `_HOST` from the **advertised** web address (`ozone.<service>.http-address` +or `https-address`), **not** from `*-http-bind-host`. Bind host only chooses where Review Comment: The second property reference `https-address` is ambiguous without the `ozone.<service>.` prefix (unlike `ozone.<service>.http-address` on the previous line). To avoid operator confusion, spell it out consistently as `ozone.<service>.https-address`. ########## hadoop-hdds/docs/content/security/SecuringOzoneHTTP.md: ########## @@ -54,6 +54,33 @@ ozone.http.filter.initializers | org.apache.hadoop.security.AuthenticationFilter After that, individual component needs to configure properly to completely enable SPNEGO or SIMPLE authentication. +### Resolving `_HOST` in the Kerberos principal + +`HTTP/_HOST@REALM` in `*.http.auth.kerberos.principal` is expanded at startup. The +hostname must match your **keytab** and the **host in the browser URL**. + +Ozone takes `_HOST` from the **advertised** web address (`ozone.<service>.http-address` +or `https-address`), **not** from `*-http-bind-host`. Bind host only chooses where +the process listens (`0.0.0.0`, `::`, a NIC IP, and so on). + +| Property (OM example) | Example | Used for `_HOST` | +|-----------------------|---------|------------------| +| `ozone.om.http-address` | `om1.example.com:9874` | Yes | +| `ozone.om.http-bind-host` | `0.0.0.0` or `::` | No | + +If `*-address` uses a wildcard host (`0.0.0.0` or `[::]`), Ozone uses this machine's +**canonical hostname** (same idea as default Hadoop installs). + +**Recommended:** set `*-address` to the FQDN in the keytab; keep `*-bind-host` on +`0.0.0.0` or `::` if needed; open the UI with that FQDN. For **IPv6 bind `::`**, still +set a non-wildcard FQDN in `*-address`. S3 web admin (and Kerberos `/secret/*` when +enabled) follows `ozone.s3g.webadmin.http-address` / `https-address` the same way. + +**SPNEGO fails:** check `klist -k -t <keytab>` against `*-address` and the browser URL Review Comment: In Markdown/HTML rendering, `<keytab>` may be treated as an HTML tag and disappear from the rendered output. Replace it with a non-angle-bracket placeholder (e.g., a path like `/path/to/keytab`) or escape the angle brackets so operators see the intended command. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
