[
https://issues.apache.org/jira/browse/HADOOP-10895?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14194956#comment-14194956
]
Yongjun Zhang commented on HADOOP-10895:
----------------------------------------
Thanks [~tucu00],
Rev3's AuthenticatedURL code is already very much like what you said:
{code}
/*
* whether it's allowed to let DEFAULT_AUTHENTICATOR to fallback to
PseudoAuthenticator
*/
private static boolean allowDefaultAuthToFallbackToPseudo = false;
/**
* Set to allow/disallow the DEFAULT_AUTHENTICATOR to fallback to
* PseudoAuthenticator. Notice that by default, the DEFAULT_AUTHENTICATOR
* disallow the fallback.
*/
public static void setAllowDefaultAuthToFallbackToPseudo(
final boolean allowFallback) {
allowDefaultAuthToFallbackToPseudo = allowFallback;
}
public AuthenticatedURL(Authenticator authenticator,
ConnectionConfigurator connConfigurator) {
try {
if (authenticator != null) {
this.authenticator = authenticator;
} else {
// use default authenticator
this.authenticator = DEFAULT_AUTHENTICATOR.newInstance();
this.authenticator.setAllowFallbackToPseudoAuthenticator(
<=== configure the authenticator
allowDefaultAuthToFallbackToPseudo);
}
} catch (Exception ex) {
throw new RuntimeException(ex);
}
...
{code}
except it calls {{DEFAULT_AUTHENTICATOR.newInstance()}} to create an
authenticator instance. So what you were suggesting is to replace this line
with a {{getAuthenticator()}} call, that retrieves the static instance from the
corresponding authenticator class (Per your earlier suggestion, each
authenticator class is going to have a static instance member).
Is my understanding correct? If so, a little change on top of rev3 would
address your suggestions...
Thanks.
> HTTP KerberosAuthenticator fallback should have a flag to disable it
> --------------------------------------------------------------------
>
> Key: HADOOP-10895
> URL: https://issues.apache.org/jira/browse/HADOOP-10895
> Project: Hadoop Common
> Issue Type: Bug
> Components: security
> Affects Versions: 2.4.1
> Reporter: Alejandro Abdelnur
> Assignee: Yongjun Zhang
> Priority: Blocker
> Attachments: HADOOP-10895.001.patch, HADOOP-10895.002.patch,
> HADOOP-10895.003.patch, HADOOP-10895.004.patch
>
>
> Per review feedback in HADOOP-10771, {{KerberosAuthenticator}} and the
> delegation token version coming in with HADOOP-10771 should have a flag to
> disable fallback to pseudo, similarly to the one that was introduced in
> Hadoop RPC client with HADOOP-9698.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
