diff --git a/BUILDING.txt b/BUILDING.txt index 06bef1fc33048..6e38ad374a174 100644 --- a/BUILDING.txt +++ b/BUILDING.txt @@ -4,7 +4,7 @@ Build instructions for Hadoop Requirements: * Unix System -* JDK 1.6+ +* JDK 1.7+ * Maven 3.0 or later * Findbugs 1.3.9 (if running findbugs) * ProtocolBuffer 2.5.0 @@ -204,15 +204,19 @@ Building on Windows Requirements: * Windows System -* JDK 1.6+ +* JDK 1.7+ * Maven 3.0 or later * Findbugs 1.3.9 (if running findbugs) * ProtocolBuffer 2.5.0 * CMake 2.6 or newer * Windows SDK or Visual Studio 2010 Professional -* Unix command-line tools from GnuWin32 or Cygwin: sh, mkdir, rm, cp, tar, gzip * zlib headers (if building native code bindings for zlib) * Internet connection for first build (to fetch all Maven and Hadoop dependencies) +* Unix command-line tools from GnuWin32: sh, mkdir, rm, cp, tar, gzip. These + tools must be present on your PATH. + +Unix command-line tools are also included with the Windows Git package which +can be downloaded from http://git-scm.com/download/win. If using Visual Studio, it must be Visual Studio 2010 Professional (not 2012). Do not use Visual Studio Express. It does not support compiling for 64-bit, @@ -221,6 +225,8 @@ download here: http://www.microsoft.com/en-us/download/details.aspx?id=8279 +Cygwin is neither required nor supported. + ---------------------------------------------------------------------------------- Building: diff --git a/dev-support/test-patch.sh b/dev-support/test-patch.sh index e6512abf81809..ece3ddf6f6703 100755 --- a/dev-support/test-patch.sh +++ b/dev-support/test-patch.sh @@ -857,74 +857,6 @@ findModules () { rm $TMP_MODULES echo $CHANGED_MODULES } -############################################################################### -### Run the test-contrib target -runContribTests () { - echo "" - echo "" - echo "======================================================================" - echo "======================================================================" - echo " Running contrib tests." - echo "======================================================================" - echo "======================================================================" - echo "" - echo "" - - if [[ `$GREP -c 'test-contrib' build.xml` == 0 ]] ; then - echo "No contrib tests in this project." - return 0 - fi - - ### Kill any rogue build processes from the last attempt - $PS auxwww | $GREP ${PROJECT_NAME}PatchProcess | $AWK '{print $2}' | /usr/bin/xargs -t -I {} /bin/kill -9 {} > /dev/null - - #echo "$ANT_HOME/bin/ant -Dversion="${VERSION}" $ECLIPSE_PROPERTY -DHadoopPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=no test-contrib" - #$ANT_HOME/bin/ant -Dversion="${VERSION}" $ECLIPSE_PROPERTY -DHadoopPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=no test-contrib - echo "NOP" - if [[ $? != 0 ]] ; then - JIRA_COMMENT="$JIRA_COMMENT - - {color:red}-1 contrib tests{color}. The patch failed contrib unit tests." - return 1 - fi - JIRA_COMMENT="$JIRA_COMMENT - - {color:green}+1 contrib tests{color}. The patch passed contrib unit tests." - return 0 -} - -############################################################################### -### Run the inject-system-faults target -checkInjectSystemFaults () { - echo "" - echo "" - echo "======================================================================" - echo "======================================================================" - echo " Checking the integrity of system test framework code." - echo "======================================================================" - echo "======================================================================" - echo "" - echo "" - - ### Kill any rogue build processes from the last attempt - $PS auxwww | $GREP ${PROJECT_NAME}PatchProcess | $AWK '{print $2}' | /usr/bin/xargs -t -I {} /bin/kill -9 {} > /dev/null - - #echo "$ANT_HOME/bin/ant -Dversion="${VERSION}" -DHadoopPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=no -Dcompile.c++=yes -Dforrest.home=$FORREST_HOME inject-system-faults" - #$ANT_HOME/bin/ant -Dversion="${VERSION}" -DHadoopPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=no -Dcompile.c++=yes -Dforrest.home=$FORREST_HOME inject-system-faults - echo "NOP" - return 0 - if [[ $? != 0 ]] ; then - JIRA_COMMENT="$JIRA_COMMENT - - {color:red}-1 system test framework{color}. The patch failed system test framework compile." - return 1 - fi - JIRA_COMMENT="$JIRA_COMMENT - - {color:green}+1 system test framework{color}. The patch passed system test framework compile." - return 0 -} - ############################################################################### ### Submit a comment to the defect's Jira submitJiraComment () { @@ -1059,10 +991,7 @@ checkReleaseAuditWarnings if [[ $JENKINS == "true" || $RUN_TESTS == "true" ]] ; then runTests (( RESULT = RESULT + $? )) - runContribTests - (( RESULT = RESULT + $? )) fi -checkInjectSystemFaults (( RESULT = RESULT + $? )) JIRA_COMMENT_FOOTER="Test results: $BUILD_URL/testReport/ $JIRA_COMMENT_FOOTER" diff --git a/hadoop-assemblies/pom.xml b/hadoop-assemblies/pom.xml index 66b6bdb16bd14..b53baccaad516 100644 --- a/hadoop-assemblies/pom.xml +++ b/hadoop-assemblies/pom.xml @@ -45,10 +45,10 @@ - [3.0.0,) + ${enforced.maven.version} - 1.6 + ${enforced.java.version} diff --git a/hadoop-client/pom.xml b/hadoop-client/pom.xml index 2b66790f62a5b..f8b6d97ca2efe 100644 --- a/hadoop-client/pom.xml +++ b/hadoop-client/pom.xml @@ -13,7 +13,7 @@ limitations under the License. See accompanying LICENSE file. --> + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> 4.0.0 org.apache.hadoop diff --git a/hadoop-common-project/hadoop-annotations/pom.xml b/hadoop-common-project/hadoop-annotations/pom.xml index 84a106e665325..c011b4581ea30 100644 --- a/hadoop-common-project/hadoop-annotations/pom.xml +++ b/hadoop-common-project/hadoop-annotations/pom.xml @@ -39,23 +39,6 @@ - - os.linux - - - !Mac - - - - - jdk.tools - jdk.tools - 1.6 - system - ${java.home}/../lib/tools.jar - - - jdk1.7 diff --git a/hadoop-common-project/hadoop-auth-examples/src/main/java/org/apache/hadoop/security/authentication/examples/WhoClient.java b/hadoop-common-project/hadoop-auth-examples/src/main/java/org/apache/hadoop/security/authentication/examples/WhoClient.java index 2299ae1fd8089..f5cff2b529a5f 100644 --- a/hadoop-common-project/hadoop-auth-examples/src/main/java/org/apache/hadoop/security/authentication/examples/WhoClient.java +++ b/hadoop-common-project/hadoop-auth-examples/src/main/java/org/apache/hadoop/security/authentication/examples/WhoClient.java @@ -19,6 +19,7 @@ import java.io.InputStreamReader; import java.net.HttpURLConnection; import java.net.URL; +import java.nio.charset.Charset; /** * Example that uses AuthenticatedURL. @@ -39,7 +40,9 @@ public static void main(String[] args) { System.out.println("Status code: " + conn.getResponseCode() + " " + conn.getResponseMessage()); System.out.println(); if (conn.getResponseCode() == HttpURLConnection.HTTP_OK) { - BufferedReader reader = new BufferedReader(new InputStreamReader(conn.getInputStream())); + BufferedReader reader = new BufferedReader( + new InputStreamReader( + conn.getInputStream(), Charset.forName("UTF-8"))); String line = reader.readLine(); while (line != null) { System.out.println(line); diff --git a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/AuthenticatedURL.java b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/AuthenticatedURL.java index 61c3c6d5f53c3..c50a5164a5780 100644 --- a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/AuthenticatedURL.java +++ b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/AuthenticatedURL.java @@ -24,19 +24,18 @@ /** * The {@link AuthenticatedURL} class enables the use of the JDK {@link URL} class * against HTTP endpoints protected with the {@link AuthenticationFilter}. - *

+ *

* The authentication mechanisms supported by default are Hadoop Simple authentication * (also known as pseudo authentication) and Kerberos SPNEGO authentication. - *

+ *

* Additional authentication mechanisms can be supported via {@link Authenticator} implementations. - *

+ *

* The default {@link Authenticator} is the {@link KerberosAuthenticator} class which supports * automatic fallback from Kerberos SPNEGO to Hadoop Simple authentication. - *

+ *

* AuthenticatedURL instances are not thread-safe. - *

+ *

* The usage pattern of the {@link AuthenticatedURL} is: - *

* 

  *
  * // establishing an initial connection
@@ -240,7 +239,7 @@ public static void injectToken(HttpURLConnection conn, Token token) {
 
   /**
    * Helper method that extracts an authentication token received from a connection.
-   * 

+   * 

    * This method is used by {@link Authenticator} implementations.
    *
    * @param conn connection to extract the authentication token from.
diff --git a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/Authenticator.java b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/Authenticator.java
index e7bae4a891593..6828970fdbb59 100644
--- a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/Authenticator.java
+++ b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/Authenticator.java
@@ -19,7 +19,7 @@
 
 /**
  * Interface for client authentication mechanisms.
- * 

+ * 

  * Implementations are use-once instances, they don't need to be thread safe.
  */
 public interface Authenticator {
diff --git a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/KerberosAuthenticator.java b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/KerberosAuthenticator.java
index e4ebf1b0d9ae5..323b019eb827b 100644
--- a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/KerberosAuthenticator.java
+++ b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/KerberosAuthenticator.java
@@ -23,6 +23,8 @@
 import org.slf4j.LoggerFactory;
 
 import javax.security.auth.Subject;
+import javax.security.auth.kerberos.KerberosKey;
+import javax.security.auth.kerberos.KerberosTicket;
 import javax.security.auth.login.AppConfigurationEntry;
 import javax.security.auth.login.Configuration;
 import javax.security.auth.login.LoginContext;
@@ -41,9 +43,9 @@
 
 /**
  * The {@link KerberosAuthenticator} implements the Kerberos SPNEGO authentication sequence.
- * 

+ * 

  * It uses the default principal for the Kerberos cache (normally set via kinit).
- * 

+ * 

  * It falls back to the {@link PseudoAuthenticator} if the HTTP endpoint does not trigger an SPNEGO authentication
  * sequence.
  */
@@ -160,9 +162,9 @@ public void setConnectionConfigurator(ConnectionConfigurator configurator) {
 
   /**
    * Performs SPNEGO authentication against the specified URL.
-   * 

+   * 

    * If a token is given it does a NOP and returns the given token.
-   * 

+   * 

    * If no token is given, it will perform the SPNEGO authentication sequence using an
    * HTTP OPTIONS request.
    *
@@ -209,7 +211,7 @@ public void authenticate(URL url, AuthenticatedURL.Token token)
 
   /**
    * If the specified URL does not support SPNEGO authentication, a fallback {@link Authenticator} will be used.
-   * 

+   * 

    * This implementation returns a {@link PseudoAuthenticator}.
    *
    * @return the fallback {@link Authenticator}.
@@ -247,7 +249,9 @@ private void doSpnegoSequence(AuthenticatedURL.Token token) throws IOException,
     try {
       AccessControlContext context = AccessController.getContext();
       Subject subject = Subject.getSubject(context);
-      if (subject == null) {
+      if (subject == null
+          || (subject.getPrivateCredentials(KerberosKey.class).isEmpty()
+              && subject.getPrivateCredentials(KerberosTicket.class).isEmpty())) {
         LOG.debug("No subject in context, logging in");
         subject = new Subject();
         LoginContext login = new LoginContext("", subject,
diff --git a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/PseudoAuthenticator.java b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/PseudoAuthenticator.java
index f534be9b20bc0..46d94b88dec67 100644
--- a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/PseudoAuthenticator.java
+++ b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/PseudoAuthenticator.java
@@ -20,7 +20,7 @@
 /**
  * The {@link PseudoAuthenticator} implementation provides an authentication equivalent to Hadoop's
  * Simple authentication, it trusts the value of the 'user.name' Java System property.
- * 

+ * 

  * The 'user.name' value is propagated using an additional query string parameter {@link #USER_NAME} ('user.name').
  */
 public class PseudoAuthenticator implements Authenticator {
@@ -47,13 +47,13 @@ public void setConnectionConfigurator(ConnectionConfigurator configurator) {
 
   /**
    * Performs simple authentication against the specified URL.
-   * 

+   * 

    * If a token is given it does a NOP and returns the given token.
-   * 

+   * 

    * If no token is given, it will perform an HTTP OPTIONS request injecting an additional
    * parameter {@link #USER_NAME} in the query string with the value returned by the {@link #getUserName()}
    * method.
-   * 

+   * 

    * If the response is successful it will update the authentication token.
    *
    * @param url the URl to authenticate against.
@@ -79,7 +79,7 @@ public void authenticate(URL url, AuthenticatedURL.Token token) throws IOExcepti
 
   /**
    * Returns the current user name.
-   * 

+   * 

    * This implementation returns the value of the Java system property 'user.name'
    *
    * @return the current user name.
diff --git a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AltKerberosAuthenticationHandler.java b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AltKerberosAuthenticationHandler.java
index e786e37df8ed7..987330fa0e5be 100644
--- a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AltKerberosAuthenticationHandler.java
+++ b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AltKerberosAuthenticationHandler.java
@@ -28,7 +28,6 @@
  * to allow a developer to implement their own custom authentication for browser
  * access.  The alternateAuthenticate method will be called whenever a request
  * comes from a browser.
- * 

  */
 public abstract class AltKerberosAuthenticationHandler
                         extends KerberosAuthenticationHandler {
@@ -52,7 +51,6 @@ public abstract class AltKerberosAuthenticationHandler
   /**
    * Returns the authentication type of the authentication handler,
    * 'alt-kerberos'.
-   * 

    *
    * @return the authentication type of the authentication handler,
    * 'alt-kerberos'.
@@ -80,7 +78,6 @@ public void init(Properties config) throws ServletException {
    * completed successfully (in the case of Java access) and only after the
    * custom authentication implemented by the subclass in alternateAuthenticate
    * has completed successfully (in the case of browser access).
-   * 

    *
    * @param request the HTTP client request.
    * @param response the HTTP client response.
@@ -109,7 +106,7 @@ public AuthenticationToken authenticate(HttpServletRequest request,
    * refers to a browser.  If its not a browser, then Kerberos authentication
    * will be used; if it is a browser, alternateAuthenticate from the subclass
    * will be used.
-   * 

+   * 

    * A User-Agent String is considered to be a browser if it does not contain
    * any of the values from alt-kerberos.non-browser.user-agents; the default
    * behavior is to consider everything a browser unless it contains one of:
diff --git a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java
index 0ac352ba2d116..e891ed2623dd5 100644
--- a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java
+++ b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java
@@ -44,18 +44,20 @@
 import java.util.*;
 
 /**
- * The {@link AuthenticationFilter} enables protecting web application resources with different (pluggable)
+ * 
The {@link AuthenticationFilter} enables protecting web application
+ * resources with different (pluggable)
  * authentication mechanisms and signer secret providers.
- * 

+ * 

+ * 

  * Out of the box it provides 2 authentication mechanisms: Pseudo and Kerberos SPNEGO.
- * 

+ * 

  * Additional authentication mechanisms are supported via the {@link AuthenticationHandler} interface.
- * 

+ * 

  * This filter delegates to the configured authentication handler for authentication and once it obtains an
  * {@link AuthenticationToken} from it, sets a signed HTTP cookie with the token. For client requests
  * that provide the signed HTTP cookie, it verifies the validity of the cookie, extracts the user information
  * and lets the request proceed to the target resource.
- * 

+ * 

  * The supported configuration properties are:
  * 
    
  * 
  • config.prefix: indicates the prefix to be used by all other configuration properties, the default value
@@ -73,18 +75,19 @@
  * 
  • [#PREFIX#.]cookie.domain: domain to use for the HTTP cookie that stores the authentication token.
    • 
  * 
  • [#PREFIX#.]cookie.path: path to use for the HTTP cookie that stores the authentication token.
    • 
  * 

- * 

+ * 

  * The rest of the configuration properties are specific to the {@link AuthenticationHandler} implementation and the
  * {@link AuthenticationFilter} will take all the properties that start with the prefix #PREFIX#, it will remove
  * the prefix from it and it will pass them to the the authentication handler for initialization. Properties that do
  * not start with the prefix will not be passed to the authentication handler initialization.
- * 

+ * 

+ * 

  * Out of the box it provides 3 signer secret provider implementations:
  * "string", "random", and "zookeeper"
- * 

+ * 

  * Additional signer secret providers are supported via the
  * {@link SignerSecretProvider} class.
- * 

+ * 

  * For the HTTP cookies mentioned above, the SignerSecretProvider is used to
  * determine the secret to use for signing the cookies. Different
  * implementations can have different behaviors.  The "string" implementation
@@ -94,7 +97,7 @@
  * [#PREFIX#.]token.validity mentioned above.  The "zookeeper" implementation
  * is like the "random" one, except that it synchronizes the random secret
  * and rollovers between multiple servers; it's meant for HA services.
- * 

+ * 

  * The relevant configuration properties are:
  * 
    
  * 
  • signer.secret.provider: indicates the name of the SignerSecretProvider
@@ -108,10 +111,10 @@
  * implementations are specified, this value is used as the rollover
  * interval.
    • 
  * 

- * 

+ * 

  * The "zookeeper" implementation has additional configuration properties that
  * must be specified; see {@link ZKSignerSecretProvider} for details.
- * 

+ * 

  * For subclasses of AuthenticationFilter that want additional control over the
  * SignerSecretProvider, they can use the following attribute set in the
  * ServletContext:
@@ -190,10 +193,9 @@ public class AuthenticationFilter implements Filter {
   private String cookiePath;
 
   /**
-   * Initializes the authentication filter and signer secret provider.
-   * 

-   * It instantiates and initializes the specified {@link AuthenticationHandler}.
-   * 

+   * 
Initializes the authentication filter and signer secret provider.

+   * It instantiates and initializes the specified {@link
+   * AuthenticationHandler}.
    *
    * @param filterConfig filter configuration.
    *
@@ -375,7 +377,7 @@ protected String getCookiePath() {
 
   /**
    * Destroys the filter.
-   * 

+   * 

    * It invokes the {@link AuthenticationHandler#destroy()} method to release any resources it may hold.
    */
   @Override
@@ -393,7 +395,7 @@ public void destroy() {
    * Returns the filtered configuration (only properties starting with the specified prefix). The property keys
    * are also trimmed from the prefix. The returned {@link Properties} object is used to initialized the
    * {@link AuthenticationHandler}.
-   * 

+   * 

    * This method can be overriden by subclasses to obtain the configuration from other configuration source than
    * the web.xml file.
    *
@@ -419,7 +421,7 @@ protected Properties getConfiguration(String configPrefix, FilterConfig filterCo
 
   /**
    * Returns the full URL of the request including the query string.
-   * 

+   * 

    * Used as a convenience method for logging purposes.
    *
    * @param request the request object.
@@ -436,11 +438,11 @@ protected String getRequestURL(HttpServletRequest request) {
 
   /**
    * Returns the {@link AuthenticationToken} for the request.
-   * 

+   * 

    * It looks at the received HTTP cookies and extracts the value of the {@link AuthenticatedURL#AUTH_COOKIE}
    * if present. It verifies the signature and if correct it creates the {@link AuthenticationToken} and returns
    * it.
-   * 

+   * 

    * If this method returns null the filter will invoke the configured {@link AuthenticationHandler}
    * to perform user authentication.
    *
@@ -597,7 +599,7 @@ protected void doFilter(FilterChain filterChain, HttpServletRequest request,
    *
    * @param token authentication token for the cookie.
    * @param expires UNIX timestamp that indicates the expire date of the
-   *                cookie. It has no effect if its value < 0.
+   *                cookie. It has no effect if its value < 0.
    *
    * XXX the following code duplicate some logic in Jetty / Servlet API,
    * because of the fact that Hadoop is stuck at servlet 2.5 and jetty 6
diff --git a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationHandler.java b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationHandler.java
index 04984be5a7d58..797e95a689dd5 100644
--- a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationHandler.java
+++ b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationHandler.java
@@ -24,9 +24,7 @@
 
 /**
  * Interface for server authentication mechanisms.
- * 

  * The {@link AuthenticationFilter} manages the lifecycle of the authentication handler.
- * 

  * Implementations must be thread-safe as one instance is initialized and used for all requests.
  */
 public interface AuthenticationHandler {
@@ -35,7 +33,6 @@ public interface AuthenticationHandler {
 
   /**
    * Returns the authentication type of the authentication handler.
-   * 

    * This should be a name that uniquely identifies the authentication type.
    * For example 'simple' or 'kerberos'.
    *
@@ -45,7 +42,7 @@ public interface AuthenticationHandler {
 
   /**
    * Initializes the authentication handler instance.
-   * 

+   * 

    * This method is invoked by the {@link AuthenticationFilter#init} method.
    *
    * @param config configuration properties to initialize the handler.
@@ -56,21 +53,21 @@ public interface AuthenticationHandler {
 
   /**
    * Destroys the authentication handler instance.
-   * 

+   * 

    * This method is invoked by the {@link AuthenticationFilter#destroy} method.
    */
   public void destroy();
 
   /**
    * Performs an authentication management operation.
-   * 

+   * 

    * This is useful for handling operations like get/renew/cancel
    * delegation tokens which are being handled as operations of the
    * service end-point.
-   * 

+   * 

    * If the method returns TRUE the request will continue normal
    * processing, this means the method has not produced any HTTP response.
-   * 

+   * 

    * If the method returns FALSE the request will end, this means 
    * the method has produced the corresponding HTTP response.
    *
@@ -91,17 +88,17 @@ public boolean managementOperation(AuthenticationToken token,
 
   /**
    * Performs an authentication step for the given HTTP client request.
-   * 

+   * 

    * This method is invoked by the {@link AuthenticationFilter} only if the HTTP client request is
    * not yet authenticated.
-   * 

+   * 

    * Depending upon the authentication mechanism being implemented, a particular HTTP client may
    * end up making a sequence of invocations before authentication is successfully established (this is
    * the case of Kerberos SPNEGO).
-   * 

+   * 

    * This method must return an {@link AuthenticationToken} only if the the HTTP client request has
    * been successfully and fully authenticated.
-   * 

+   * 

    * If the HTTP client request has not been completely authenticated, this method must take over
    * the corresponding HTTP response and it must return null.
    *
diff --git a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationToken.java b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationToken.java
index ff68847c8a0bc..bb3e71da61c32 100644
--- a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationToken.java
+++ b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationToken.java
@@ -29,7 +29,7 @@
  * The {@link AuthenticationToken} contains information about an authenticated
  * HTTP client and doubles as the {@link Principal} to be returned by
  * authenticated {@link HttpServletRequest}s
- * 

+ * 

  * The token can be serialized/deserialized to and from a string as it is sent
  * and received in HTTP client responses and requests as a HTTP cookie (this is
  * done by the {@link AuthenticationFilter}).
@@ -170,7 +170,7 @@ public boolean isExpired() {
 
   /**
    * Returns the string representation of the token.
-   * 

+   * 

    * This string representation is parseable by the {@link #parse} method.
    *
    * @return the string representation of the token.
diff --git a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/KerberosAuthenticationHandler.java b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/KerberosAuthenticationHandler.java
index 92bc57c413b45..846541b162b5f 100644
--- a/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/KerberosAuthenticationHandler.java
+++ b/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/KerberosAuthenticationHandler.java
@@ -51,7 +51,7 @@
 
 /**
  * The {@link KerberosAuthenticationHandler} implements the Kerberos SPNEGO authentication mechanism for HTTP.
- * 

+ * 

  * The supported configuration properties are:
  *