HalimKim commented on PR #5606: URL: https://github.com/apache/hbase/pull/5606#issuecomment-6434491160
Hi, I'd like to revive this one. The reason it stalled (the test needed Hadoop >= 3.4.0 for HADOOP-18666) no longer applies: branch-2.6 ships hadoop-auth 3.4.3 (checked in the hbase-2.6.6-hadoop3-bin tarball), and KerberosAuthenticationHandler there already handles kerberos.endpoint.whitelist. The only missing piece is on the HBase side: HttpServer#initSpnego passes a fixed set of params to the filter, so the whitelist never reaches the handler, and the metrics servlets are registered as privileged so an anonymous request is rejected by AdminAuthorizedFilter anyway. This PR covers both. The use case is the usual one: Prometheus cannot do SPNEGO, and today the only options are leaving the UI unauthenticated or putting a Kerberos-aware proxy in front of Prometheus. Could the FIXME lines in testEndpointWhitelist be enabled now and the PR rebased on master/branch-2.6? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
