private String doKerberosAuth ( HttpServletRequest request ) throws HttpAuthenticationException { // Try authenticating with the http/_HOST principal if ( httpUGI != null ) { try { return httpUGI . doAs ( new HttpKerberosServerAction ( request , httpUGI ) ) ; } catch ( Exception e ) { LOG . info ( "Failed to authenticate with http/_HOST kerberos principal, " + "trying with hive/_HOST kerberos principal" ) ; } } // Now try with hive/_HOST principal try { return serviceUGI . doAs ( new HttpKerberosServerAction ( request , serviceUGI ) ) ; } catch ( Exception e ) { LOG . error ( "Failed to authenticate with hive/_HOST kerberos principal" ) ; throw new HttpAuthenticationException ( e ) ; } }
Do the GSS - API kerberos authentication . We already have a logged in subject in the form of serviceUGI which GSS - API will extract information from . In case of a SPNego request we use the httpUGI for the authenticating service tickets .