Skip to content

[SPARK-29957][TEST] Reset MiniKDC's default enctypes to fit jdk8/jdk11 #26594

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
AngersZhuuuu wants to merge 14 commits into from
Closed

[SPARK-29957][TEST] Reset MiniKDC's default enctypes to fit jdk8/jdk11 #26594

Changes from 1 commit
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
e9ef3ba
Update pom.xml
AngersZhuuuu Nov 19, 2019
3ec2891
miniKdc -> minikdc
AngersZhuuuu Nov 24, 2019
2e282f2
Update KafkaTestUtils.scala
AngersZhuuuu Nov 24, 2019
a224fad
Update KafkaTestUtils.scala
AngersZhuuuu Nov 24, 2019
3456ff9
Follow comment
AngersZhuuuu Nov 26, 2019
dfdf589
Merge branch 'master' into minikdc-3.2.0
AngersZhuuuu Nov 26, 2019
7ab6192
Update KafkaTestUtils.scala
AngersZhuuuu Nov 28, 2019
476d60e
Update KafkaTestUtils.scala
AngersZhuuuu Nov 29, 2019
b782e99
Update KafkaTestUtils.scala
AngersZhuuuu Dec 4, 2019
10a0006
Update KafkaTestUtils.scala
AngersZhuuuu Dec 4, 2019
03f7fb1
Update KafkaTestUtils.scala
AngersZhuuuu Dec 4, 2019
e252dd0
Update KafkaTestUtils.scala
AngersZhuuuu Dec 5, 2019
4facbee
Update KafkaTestUtils.scala
AngersZhuuuu Dec 6, 2019
223533f
Update KafkaTestUtils.scala
AngersZhuuuu Dec 6, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
miniKdc -> minikdc
  • Loading branch information
@AngersZhuuuu
AngersZhuuuu committed Nov 24, 2019
commit 3ec289102c412c16a0f429caf27b2607e8540ac6
4 changes: 2 additions & 2 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@
<slf4j.version>1.7.16</slf4j.version>
<log4j.version>1.2.17</log4j.version>
<hadoop.version>2.7.4</hadoop.version>
<miniKdc.version>3.2.0</miniKdc.version>
<minikdc.version>3.2.0</minikdc.version>
<protobuf.version>2.5.0</protobuf.version>
<yarn.version>${hadoop.version}</yarn.version>
<zookeeper.version>3.4.14</zookeeper.version>
Expand Down Expand Up @@ -1025,7 +1025,7 @@
<dependency>
<groupId>org.apache.hadoop</groupId>
<artifactId>hadoop-minikdc</artifactId>
<version>${miniKdc.version}</version>
<version>${minikdc.version}</version>
Copy link
Member

@srowen srowen Nov 24, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we can mix and match Hadoop versions this way. I think generally speaking Hadoop 3.x is what we'd tell people to use for JDK 11 compatibility. But if the other change to refreshKrb5Config is needed and compatible, we can make that change.

Copy link
Member

@wangyum wangyum Nov 26, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes. Agree with @srowen.
Could we fix this issue by changing the default_tkt_enctypes and default_tgs_enctypes:
https://www.oracle.com/technetwork/java/javase/11-relnote-issues-5012449.html#JDK-8014628

Copy link
Member

@wangyum wangyum Nov 26, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please also see https://issues.apache.org/jira/browse/KAFKA-7338

Copy link
Contributor Author

@AngersZhuuuu AngersZhuuuu Nov 26, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@srowen @wangyum @dongjoon-hyun
I checked the kerberos code that when client call a request KrbTgsReq/KrbTktReq , it will first check if there are config default_tkt_enctypes and default_tgs_enctypesin krb5.conf, if not, then use jdk buildin enctypes.
And i have checked the build in ecntypes:

jdk8
  static {
    DEBUG = Krb5.DEBUG;
    initStatic();
    BUILTIN_ETYPES = new int[]{18, 17, 16, 23, 1, 3};
    BUILTIN_ETYPES_NOAES256 = new int[]{17, 16, 23, 1, 3};
  }

jdk11
 static {
    DEBUG = Krb5.DEBUG;
    initStatic();
    BUILTIN_ETYPES = new int[]{18, 17, 20, 19, 16, 23, 1, 3};
    BUILTIN_ETYPES_NOAES256 = new int[]{17, 19, 16, 23, 1, 3};
  }

In server side , they both use aes128-cts-hmac-sha1-96 as first choice.
But MiniKdc don't have API for us to config these. So rewrite and refresh it.

<scope>test</scope>
<exclusions>
<exclusion>
Expand Down