apache / apache/pulsar

java.lang.IllegalArgumentException: Malformed Kerberos name: broker/http://xxx@KRB5.COM

Open
#12,868 3 comments 0 reactions 0 assignees View on GitHub
lifecycle/stale type/bug
Dominant language
Java
Stars
15.3k
Forks
3.8k
Avg merge
1d 14h
Merged PRs (30d)
160

Description

**Describe the bug**
1. The version of puslar cluster is 2.7.0.
2. Cluster uses kerberos for authentication.
3. When use tools pulsar-admin to list topics under public/default, pulsar-admin shows the following exceptions:
```shell
org.apache.pulsar.client.impl.auth.PulsarSaslClient - Using JAAS/SASL/GSSAPI auth to connect to server Principal broker/host12,
null
Reason: java.util.concurrent.TimeoutException
```
and the broker shows the following exceptions:
```shell
Caused by: java.lang.IllegalArgumentException: Malformed Kerberos name: broker/http://host14:8080/admin/v2/non-persistent/public/default/0x00000000_0x10000000@KRB5.COM
at org.apache.pulsar.common.sasl.KerberosName.(KerberosName.java:127) ~[org.apache.pulsar-pulsar-common-2.7.0.jar:2.7.0]
at org.apache.pulsar.client.impl.auth.PulsarSaslClient.(PulsarSaslClient.java:70) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.7.0.jar:2.7.0]
at org.apache.pulsar.client.impl.auth.AuthenticationSasl.getAuthData(AuthenticationSasl.java:100) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.7.0.jar:2.7.0]
at org.apache.pulsar.client.impl.auth.AuthenticationSasl.newRequestHeader(AuthenticationSasl.java:227) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.7.0.jar:2.7.0]
at org.apache.pulsar.client.impl.auth.AuthenticationSasl.newRequestBuilder(AuthenticationSasl.java:198) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.7.0.jar:2.7.0]
at org.apache.pulsar.client.impl.auth.AuthenticationSasl.authenticationStage(AuthenticationSasl.java:307) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.7.0.jar:2.7.0]
at org.apache.pulsar.client.impl.auth.AuthenticationSasl$1.completed(AuthenticationSasl.java:313) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.7.0.jar:2.7.0]
at org.apache.pulsar.client.impl.auth.AuthenticationSasl$1.completed(AuthenticationSasl.java:308) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.7.0.jar:2.7.0]
at org.glassfish.jersey.client.JerseyInvocation$1.completed(JerseyInvocation.java:814) ~[org.glassfish.jersey.core-jersey-client-2.31.jar:?]
at org.glassfish.jersey.client.ClientRuntime.processResponse(ClientRuntime.java:229) ~[org.glassfish.jersey.core-jersey-client-2.31.jar:?]
at org.glassfish.jersey.client.ClientRuntime.access$200(ClientRuntime.java:62) ~[org.glassfish.jersey.core-jersey-client-2.31.jar:?]
at org.glassfish.jersey.client.ClientRuntime$2.lambda$response$0(ClientRuntime.java:173) ~[org.glassfish.jersey.core-jersey-client-2.31.jar:?]
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248) ~[org.glassfish.jersey.core-jersey-common-2.31.jar:?]
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244) ~[org.glassfish.jersey.core-jersey-common-2.31.jar:?]
at org.glassfish.jersey.internal.Errors.process(Errors.java:292) ~[org.glassfish.jersey.core-jersey-common-2.31.jar:?]
at org.glassfish.jersey.internal.Errors.process(Errors.java:274) ~[org.glassfish.jersey.core-jersey-common-2.31.jar:?]
```

**To Reproduce**
The bug happens occasionally.

**Expect Behavior**
Kerberos client should use principal serverType/hostname@ream to connect the kdc server, in this case, it should be something like broker/host14@KRB5.COM instead of broker/http://host14:8080/admin/v2/non-persistent/public/default/0x00000000_0x10000000@KRB5.COM.

**Possiable Reason**
When following the exception chain, I find the code below that in the file pulsar-client-auth-sasl\src\main\java\org\apache\pulsar\client\impl\auth\AuthenticationSasl.java,
![image](https://user-images.githubusercontent.com/18342885/142379239-3455f7bb-e16f-4eab-b070-ff2c4deb6777.png)

Maybe we should use `target.getUri().getHost()` instead of `target.getUri().toString()`.
![image](https://user-images.githubusercontent.com/18342885/142380410-c993c6e5-c6df-4d42-9d82-3f5471db5ed7.png)

Contributor guide

Open the contributing guide

Research direction

Start in pulsar-client-auth-sasl/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationSasl.java, following the stack trace into org.apache.pulsar.common.sasl.KerberosName. Reproduce the intermittent failure by using pulsar-admin to list topics with Kerberos enabled, then verify whether the authentication target uses its host rather than the full URI. Done means the client forms a principal like broker/host14@KRB5.COM and no longer produces the malformed-name exception.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.