[
https://issues.apache.org/jira/browse/HDDS-16347?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dian-Xuan Yang reassigned HDDS-16347:
-------------------------------------
Assignee: Dian-Xuan Yang
> Stop expanding _HOST to the bind host in HTTP SPNEGO principals
> ---------------------------------------------------------------
>
> Key: HDDS-16347
> URL: https://issues.apache.org/jira/browse/HDDS-16347
> Project: Apache Ozone
> Issue Type: Task
> Reporter: Dian-Xuan Yang
> Assignee: Dian-Xuan Yang
> Priority: Major
>
> h3. Problem
> {{BaseHttpServer}} never calls {{HttpServer2.Builder.hostName()}}, so
> {{build()}} falls back to the host of the first endpoint:
> {code:java}
> if (hostName == null) {
> hostName = endpoints.get(0).getHost();
> }
> ...
> server.initSpnego(conf, hostName, usernameConfKey, keytabConfKey);
> {code}
> {{initSpnego}} hands that value to {{SecurityUtil.getServerPrincipal}}, which
> substitutes it for {{_HOST}}. The endpoint is built from the bind address,
> and in {{BaseHttpServer.getBindAddress}} a configured bind host takes
> precedence over the advertised address, so an operator who sets a bind host
> explicitly ends up with it in the Kerberos principal.
> This is not IPv6-specific. {{ozone.om.http-bind-host=0.0.0.0}} already
> produces {{HTTP/0.0.0.0@REALM}} today. It surfaced while reviewing
> HDDS-16307, which makes an IPv6 bind host usable for the first time and turns
> {{::}} into {{HTTP/[::]@REALM}}. No keytab matches either form.
> The OEP for HDDS-15763 states that wildcard addresses "must not be advertised
> as peer or client endpoints, Kerberos principals, or certificate identities".
> h3. Solution
> Resolve {{_HOST}} from an address that identifies the host, rather than from
> the listener's bind address. The candidates are the advertised HTTP address
> property, and the canonical local hostname when only a bind host is
> configured.
> h3. Open Questions
> # Should {{_HOST}} fall back to the canonical local hostname when the
> advertised address property is unset, or should a wildcard bind host with
> security enabled fail at startup with an explicit message?
> # Does the same substitution path affect any other Ozone component that
> builds a principal from a listener address?
> h3. Testing
> Verify the principal produced for a wildcard bind host, IPv4 and IPv6, and
> for an explicitly configured advertised address.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
