Skip to content

HDDS-15044. Exercise ozone debug kerberos commands #10085

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
navinko wants to merge 2 commits into
base: master
Choose a base branch
from
+62 −0
Open

HDDS-15044. Exercise ozone debug kerberos commands #10085

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b6e818c
HDDS-15044. Exercise ozone debug kerberos commands
navinko Apr 17, 2026
6c27e85
Merge branch 'apache:master' into HDDS-15044
navinko Apr 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions hadoop-ozone/dist/src/main/compose/ozonesecure-ha/test-debug-tools.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,4 +46,6 @@ execute_robot_test ${OM} debug/auditparser.robot

execute_robot_test ${SCM} kinit.robot

execute_robot_test ${SCM} debug/ozone-debug-kerberos.robot

source "$COMPOSE_DIR/../common/replicas-test.sh"
60 changes: 60 additions & 0 deletions hadoop-ozone/dist/src/main/smoketest/debug/ozone-debug-kerberos.robot
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

*** Settings ***
Documentation Test ozone debug kerberos commands
Library OperatingSystem
Resource ../commonlib.robot
Test Timeout 5 minutes

*** Test Cases ***
Diagnose Kerberos
[Documentation] Exercises the ozone debug kerberos diagnose command.
${output} = Execute ozone debug kerberos diagnose
Should Contain ${output} == Ozone Kerberos Diagnostics ==
Should Contain ${output} [PASS] Kerberos Configuration
Should Contain ${output} [PASS] Kerberos kinit Command
Should Contain ${output} [PASS] Auth-to-Local Mapping
Should Contain ${output} == Diagnostic Summary ==

Translate Principal
[Documentation] Exercises the ozone debug kerberos translate-principal command for single principals.
[Template] Verify Principal Translation
# PRINCIPAL # EXPECTED_SHORT_NAME
om/om@EXAMPLE.COM om
scm/scm@EXAMPLE.COM scm
dn/dn@EXAMPLE.COM dn

Translate Multiple Principals At Once
[Documentation] Exercises translation of multiple principals passed in a single command.
${output} = Execute ozone debug kerberos translate-principal testuser/om@EXAMPLE.COM om/om@EXAMPLE.COM
Should Contain ${output} [PASS] testuser/om@EXAMPLE.COM
Should Contain ${output} [PASS] om/om@EXAMPLE.COM
Should Contain ${output} PASS : 2

Translate Invalid Principal
[Documentation] Ensures the command correctly flags principals that have no mapping rules and returns exit code 1.
${rc} ${output} = Run And Return Rc And Output ozone debug kerberos translate-principal om/om@cloudera.com
Should Be Equal As Integers ${rc} 1
Should Contain ${output} [FAIL] om/om@cloudera.com
Should Contain ${output} No rules applied to


*** Keywords ***
Verify Principal Translation
Comment on lines +54 to +56
Copy link
Copy Markdown
Contributor

@Gargi-jais11 Gargi-jais11 Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please move Keywords section before test cases after line 21.

[Arguments] ${principal} ${expected_short}
${output} = Execute ozone debug kerberos translate-principal ${principal}
Should Contain ${output} ${expected_short}
Should Contain ${output} PASS : 1
Comment on lines +56 to +60
Copy link
Copy Markdown
Contributor

@sreejasahithi sreejasahithi Apr 20, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Verify Principal Translation
[Arguments] ${principal} ${expected_short}
${output} = Execute ozone debug kerberos translate-principal ${principal}
Should Contain ${output} ${expected_short}
Should Contain ${output} PASS : 1
Verify Principal Translation
[Arguments] ${principal} ${expected_short}
${output} = Execute ozone debug kerberos translate-principal ${principal}
Should Contain ${output} Local user = ${expected_short}
Should Contain ${output} PASS : 1

Currently assertion on short name is ineffective
Should Contain ${output} ${expected_short}
This check does not verify the translation result. The command always prints the full principal name in the output, so om, scm, and dn will always be found as substrings of the principal name itself regardless of what Local user = actually resolved to.
By changing this as shown above,
it pins the assertion to the actual translation result line (Principal = om/om@EXAMPLE.COM to Local user = om), so it only passes when the mapping produced the correct short name.

Copy link
Copy Markdown
Contributor

@Gargi-jais11 Gargi-jais11 Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1, I agree with @sreejasahithi