smengcl commented on code in PR #569:
URL: https://github.com/apache/ozone-site/pull/569#discussion_r4255813497
##########
docs/05-administrator-guide/02-configuration/03-security/03-https.md:
##########
@@ -29,6 +29,33 @@ However, they can be configured to require Kerberos
authentication using HTTP SP
After that, individual component needs to configure properly to completely
enable SPNEGO or SIMPLE authentication.
+## Resolving `_HOST` in the Kerberos principal
+
+`HTTP/_HOST@REALM` in `*.http.auth.kerberos.principal` is expanded at startup.
The
+hostname must match your **keytab** and the **host in the browser URL**.
+
+Ozone takes `_HOST` from the **advertised** web address
(`ozone.<service>.http-address`
+or `https-address`), **not** from `*-http-bind-host`. Bind host only chooses
where
+the process listens (`0.0.0.0`, `::`, a NIC IP, and so on).
+
+| Property (OM example) | Example | Used for `_HOST` |
+|-----------------------|---------|------------------|
+| `ozone.om.http-address` | `om1.example.com:9874` | Yes |
+| `ozone.om.http-bind-host` | `0.0.0.0` or `::` | No |
Review Comment:
Please document which address wins. With `HTTP_AND_HTTPS`, different HTTP
and HTTPS hostnames still produce one principal: the first configured hostname
that is not an IP literal, checking HTTP before HTTPS. With `HTTPS_ONLY`, the
HTTP address is ignored.
```diff
| `ozone.om.http-bind-host` | `0.0.0.0` or `::` | No |
+
+Ozone checks enabled schemes, HTTP before HTTPS, and uses the first
configured
+hostname that is not an IP literal for all listeners.
```
##########
docs/05-administrator-guide/02-configuration/03-security/03-https.md:
##########
@@ -29,6 +29,33 @@ However, they can be configured to require Kerberos
authentication using HTTP SP
After that, individual component needs to configure properly to completely
enable SPNEGO or SIMPLE authentication.
+## Resolving `_HOST` in the Kerberos principal
+
+`HTTP/_HOST@REALM` in `*.http.auth.kerberos.principal` is expanded at startup.
The
+hostname must match your **keytab** and the **host in the browser URL**.
+
+Ozone takes `_HOST` from the **advertised** web address
(`ozone.<service>.http-address`
+or `https-address`), **not** from `*-http-bind-host`. Bind host only chooses
where
+the process listens (`0.0.0.0`, `::`, a NIC IP, and so on).
Review Comment:
Please mention the Datanode exception to `ozone.<service>`. Its server reads
`hdds.datanode.http-address` and `hdds.datanode.https-address`; following the
pattern above would create ignored settings.
```diff
the process listens (`0.0.0.0`, `::`, a NIC IP, and so on).
+
+For Datanode, the address keys are `hdds.datanode.http-address` and
+`hdds.datanode.https-address`.
```
##########
docs/05-administrator-guide/02-configuration/03-security/03-https.md:
##########
@@ -29,6 +29,33 @@ However, they can be configured to require Kerberos
authentication using HTTP SP
After that, individual component needs to configure properly to completely
enable SPNEGO or SIMPLE authentication.
+## Resolving `_HOST` in the Kerberos principal
+
+`HTTP/_HOST@REALM` in `*.http.auth.kerberos.principal` is expanded at startup.
The
+hostname must match your **keytab** and the **host in the browser URL**.
+
+Ozone takes `_HOST` from the **advertised** web address
(`ozone.<service>.http-address`
+or `https-address`), **not** from `*-http-bind-host`. Bind host only chooses
where
+the process listens (`0.0.0.0`, `::`, a NIC IP, and so on).
+
+| Property (OM example) | Example | Used for `_HOST` |
+|-----------------------|---------|------------------|
+| `ozone.om.http-address` | `om1.example.com:9874` | Yes |
+| `ozone.om.http-bind-host` | `0.0.0.0` or `::` | No |
+
+If `*-address` uses a wildcard host (`0.0.0.0` or `[::]`), Ozone uses this
machine's
+**canonical hostname** (same idea as default Hadoop installs).
Review Comment:
The fallback applies to all IP literals, including concrete addresses such
as `192.0.2.1` and `[2001:db8::1]`. It also happens only after checking all
enabled schemes; a wildcard HTTP address followed by a named HTTPS address uses
that HTTPS hostname.
```diff
-If `*-address` uses a wildcard host (`0.0.0.0` or `[::]`), Ozone uses this
machine's
-**canonical hostname** (same idea as default Hadoop installs).
+If no enabled `*-address` supplies a hostname (the settings are unset or
+contain IP literals, including `0.0.0.0`, `[::]`, and concrete IP
addresses),
+Ozone uses this machine's **canonical hostname**.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
