HBASE-29557 Decouple dependency on Hadoop AuthenticationFilter classes

[NihalJain]

Summary of changes for this PoC (Up to date as of 30th Oct 2025 with 4 commits)

• Commit 1: Make initial commit by copying hadoop trunk’s module hadoop-common-project/hadoop-auth into a new module hbase-auth-filters.

  • NOTE: This commit has no manual changes and is a true copy of commit #f3cd00d.
  • Purpose is to establish a local, reviewable baseline identical to Hadoop’s auth module for HBase-specific adjustments in next few commits.

• Commit 2: Prune unnecessary pieces and wire the new module to HBase.

  • Drop unnecessary code/resources from copied code.
  • Adjust packages/imports to align with HBase usage.
  • Add dependencies to hbase-rest and hbase-http for hbase-auth-filters.
  • Temporarily drop tests in hbase-auth-filters to unblock initial review and avoid spending effort, if this PoC is declined.
  • Build note: Verified local build with mvn test -pl hbase-rest,hbase-http,hbase-auth-filters.

• Commit 3: Address Error Prone to fix compilation issue.

• Commit 4: Proactive Jakarta readiness to handle potential Hadoop migration; add reference script.

  • Copy more files from hadoop, needed to isolate javax.servlet vs. jakarta.servlet differences, keeping only required methods.
  • Files identified based on our organisations' (private) Hadoop with Jetty 12 / EE 10 efforts' code change.
  • Add check_hadoop_jakarta_impact.sh for reviewers' context (to be removed in follow-up commit).
  • Build note: Verified local build with mvn test -Dtest=TestFsDelegationToken -pl hbase-server; mvn test -pl hbase-http,hbase-auth-filters,hbase-rest,hbase-thrift.

---

Next steps (dependent on reviewer acceptance of this huge copy of hadoop-auth code for our decoupling initiative)

If PoC is acceptable:

• Validate in real deployments with and without LDAP for the UI.
• Decide on Curator usage strategy (defer or encapsulate); track with a follow-up task?
• Clean up the new module’s POM (dependencies, plugins).
• Restore and adapt relevant tests to the HBase test framework.
• Fix imports and formatting to match our conventions.
• We could potentially refactor/move all servlet filter related classes lying around the code base into this new module as follow up task!

If PoC is not acceptable:

• Consider shading to avoid bulk copying. Refer HBASE-29563

CC: @Apache9, @stoty, @apurtell, @ndimiduk

[NihalJain]

Build code locally and ran following tests:

mvn test -pl hbase-rest,hbase-http,hbase-auth-filters

Waiting for build result to see if all works fine.

Also, if the amount of new code being copied looks acceptable, can work on following efforts to get this in:

• Test on a real setup with/without ldap for ui
• Figure out how we deal with Curator usage. Relax for now, do as another task?
• Clean pom.xml for the new module
• Add back tests/classes, whichever are relevant and fix them as per hbase test framework
• Fix imports
• Reformat code
• etc

[Apache-HBase]

:broken_heart: -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 :ok:	reexec	0m 13s		Docker mode activated.
			_ Prechecks _
+1 :green_heart:	dupname	0m 1s		No case conflicting files found.
+0 :ok:	codespell	0m 0s		codespell was not available.
+0 :ok:	detsecrets	0m 0s		detect-secrets was not available.
+1 :green_heart:	@author	0m 0s		The patch does not contain any @author tags.
+1 :green_heart:	hbaseanti	0m 0s		Patch does not have any anti-patterns.
			_ master Compile Tests _
+0 :ok:	mvndep	0m 28s		Maven dependency ordering for branch
+1 :green_heart:	mvninstall	5m 18s		master passed
+1 :green_heart:	compile	14m 14s		master passed
+1 :green_heart:	checkstyle	2m 46s		master passed
+1 :green_heart:	spotbugs	13m 47s		master passed
+1 :green_heart:	spotless	1m 8s		branch has no errors when running spotless:check.
-0 :warning:	patch	1m 31s		Used diff version of patch file. Binary files and potentially other changes not applied. Please rebase and squash commits if necessary.
			_ Patch Compile Tests _
+0 :ok:	mvndep	0m 15s		Maven dependency ordering for patch
+1 :green_heart:	mvninstall	4m 50s		the patch passed
-1 :x:	compile	1m 47s	/patch-compile-root.txt	root in the patch failed.
-0 :warning:	javac	1m 47s	/patch-compile-root.txt	root in the patch failed.
-0 :warning:	blanks	0m 0s	/blanks-eol.txt	The patch has 7 line(s) that end in blanks. Use git apply --whitespace=fix <<patch_file>>. Refer https://git-scm.com/docs/git-apply
-0 :warning:	checkstyle	2m 47s	/results-checkstyle-root.txt	root: The patch generated 187 new + 1 unchanged - 0 fixed = 188 total (was 1)
+1 :green_heart:	xmllint	0m 0s		No new issues.
+1 :green_heart:	spotbugs	15m 13s		the patch passed
+1 :green_heart:	hadoopcheck	14m 35s		Patch does not cause any errors with Hadoop 3.3.6 3.4.1.
-1 :x:	spotless	0m 11s		patch has 33 errors when running spotless:check, run spotless:apply to fix.
			_ Other Tests _
+1 :green_heart:	asflicense	0m 50s		The patch does not generate ASF License warnings.
		88m 9s

Subsystem	Report/Notes
Docker	ClientAPI=1.48 ServerAPI=1.48 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7422/1/artifact/yetus-general-check/output/Dockerfile
GITHUB PR	https://github.com/apache/hbase/pull/7422
Optional Tests	dupname asflicense javac codespell detsecrets xmllint hadoopcheck spotless compile spotbugs checkstyle hbaseanti
uname	Linux 67f250b5cf0c 6.8.0-1024-aws #26~22.04.1-Ubuntu SMP Wed Feb 19 06:54:57 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / 40ffe3a8f1c7c8bd40b3a79f451fc25102ef5910
Default Java	Eclipse Adoptium-17.0.11+9
spotless	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7422/1/artifact/yetus-general-check/output/patch-spotless.txt
Max. process+thread count	161 (vs. ulimit of 30000)
modules	C: hbase-auth-filters . hbase-http hbase-rest U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7422/1/console
versions	git=2.34.1 maven=3.9.8 spotbugs=4.7.3 xmllint=20913
Powered by	Apache Yetus 0.15.0 https://yetus.apache.org

This message was automatically generated.

[Apache-HBase]

:broken_heart: -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 :ok:	reexec	0m 14s		Docker mode activated.
			_ Prechecks _
+1 :green_heart:	dupname	0m 0s		No case conflicting files found.
+0 :ok:	codespell	0m 0s		codespell was not available.
+0 :ok:	detsecrets	0m 0s		detect-secrets was not available.
+1 :green_heart:	@author	0m 0s		The patch does not contain any @author tags.
+1 :green_heart:	hbaseanti	0m 0s		Patch does not have any anti-patterns.
			_ master Compile Tests _
+0 :ok:	mvndep	0m 33s		Maven dependency ordering for branch
+1 :green_heart:	mvninstall	5m 54s		master passed
+1 :green_heart:	compile	18m 50s		master passed
+1 :green_heart:	checkstyle	2m 47s		master passed
+1 :green_heart:	spotbugs	13m 49s		master passed
+1 :green_heart:	spotless	1m 6s		branch has no errors when running spotless:check.
-0 :warning:	patch	1m 29s		Used diff version of patch file. Binary files and potentially other changes not applied. Please rebase and squash commits if necessary.
			_ Patch Compile Tests _
+0 :ok:	mvndep	0m 16s		Maven dependency ordering for patch
+1 :green_heart:	mvninstall	4m 43s		the patch passed
+1 :green_heart:	compile	14m 2s		the patch passed
-0 :warning:	javac	14m 2s	/results-compile-javac-root.txt	root generated 73 new + 1896 unchanged - 0 fixed = 1969 total (was 1896)
-0 :warning:	blanks	0m 0s	/blanks-eol.txt	The patch has 7 line(s) that end in blanks. Use git apply --whitespace=fix <<patch_file>>. Refer https://git-scm.com/docs/git-apply
-0 :warning:	checkstyle	2m 47s	/results-checkstyle-root.txt	root: The patch generated 188 new + 1 unchanged - 0 fixed = 189 total (was 1)
+1 :green_heart:	xmllint	0m 1s		No new issues.
+1 :green_heart:	spotbugs	15m 11s		the patch passed
+1 :green_heart:	hadoopcheck	14m 50s		Patch does not cause any errors with Hadoop 3.3.6 3.4.1.
-1 :x:	spotless	0m 10s		patch has 33 errors when running spotless:check, run spotless:apply to fix.
			_ Other Tests _
+1 :green_heart:	asflicense	0m 43s		The patch does not generate ASF License warnings.
		105m 33s

Subsystem	Report/Notes
Docker	ClientAPI=1.48 ServerAPI=1.48 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7422/2/artifact/yetus-general-check/output/Dockerfile
GITHUB PR	https://github.com/apache/hbase/pull/7422
Optional Tests	dupname asflicense javac codespell detsecrets xmllint hadoopcheck spotless compile spotbugs checkstyle hbaseanti
uname	Linux dfcd4d802870 6.8.0-1024-aws #26~22.04.1-Ubuntu SMP Wed Feb 19 06:54:57 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / e90af6b6230f8c1bec469c567d981c88bf219840
Default Java	Eclipse Adoptium-17.0.11+9
spotless	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7422/2/artifact/yetus-general-check/output/patch-spotless.txt
Max. process+thread count	163 (vs. ulimit of 30000)
modules	C: hbase-auth-filters . hbase-http hbase-rest U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7422/2/console
versions	git=2.34.1 maven=3.9.8 spotbugs=4.7.3 xmllint=20913
Powered by	Apache Yetus 0.15.0 https://yetus.apache.org

This message was automatically generated.

[NihalJain]

Added a new commit handling few more cases based on following analysis as per an internal change having hadoop with jetty12 with EE10: Also ran following tests to verify no regression in UTs:

mvn test -Dtest=TestFsDelegationToken -pl hbase-server -o
mvn test -pl hbase-http,hbase-auth-filters,hbase-rest,hbase-thrift -o

[NihalJain]

Could you please review this PR and share your feedback? Please read the commit description for full context. In particular, do we agree that the code copy is acceptable?

[Apache-HBase]

:broken_heart: -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 :ok:	reexec	0m 17s		Docker mode activated.
			_ Prechecks _
+1 :green_heart:	dupname	0m 0s		No case conflicting files found.
+0 :ok:	codespell	0m 0s		codespell was not available.
+0 :ok:	detsecrets	0m 0s		detect-secrets was not available.
+0 :ok:	shelldocs	0m 0s		Shelldocs was not available.
+1 :green_heart:	@author	0m 0s		The patch does not contain any @author tags.
+1 :green_heart:	hbaseanti	0m 0s		Patch does not have any anti-patterns.
			_ master Compile Tests _
+0 :ok:	mvndep	0m 26s		Maven dependency ordering for branch
+1 :green_heart:	mvninstall	8m 28s		master passed
+1 :green_heart:	compile	25m 25s		master passed
+1 :green_heart:	checkstyle	4m 46s		master passed
+1 :green_heart:	spotbugs	24m 3s		master passed
+1 :green_heart:	spotless	1m 49s		branch has no errors when running spotless:check.
-0 :warning:	patch	2m 37s		Used diff version of patch file. Binary files and potentially other changes not applied. Please rebase and squash commits if necessary.
			_ Patch Compile Tests _
+0 :ok:	mvndep	0m 35s		Maven dependency ordering for patch
+1 :green_heart:	mvninstall	7m 25s		the patch passed
+1 :green_heart:	compile	27m 6s		the patch passed
-0 :warning:	javac	27m 6s	/results-compile-javac-root.txt	root generated 73 new + 1896 unchanged - 0 fixed = 1969 total (was 1896)
-0 :warning:	blanks	0m 0s	/blanks-eol.txt	The patch has 9 line(s) that end in blanks. Use git apply --whitespace=fix <<patch_file>>. Refer https://git-scm.com/docs/git-apply
-0 :warning:	checkstyle	4m 55s	/results-checkstyle-root.txt	root: The patch generated 202 new + 1 unchanged - 0 fixed = 203 total (was 1)
-0 :warning:	shellcheck	0m 1s	/results-shellcheck.txt	The patch generated 2 new + 0 unchanged - 0 fixed = 2 total (was 0)
+1 :green_heart:	xmllint	0m 1s		No new issues.
+1 :green_heart:	spotbugs	25m 47s		the patch passed
+1 :green_heart:	hadoopcheck	19m 44s		Patch does not cause any errors with Hadoop 3.3.6 3.4.1.
-1 :x:	spotless	0m 13s		patch has 33 errors when running spotless:check, run spotless:apply to fix.
			_ Other Tests _
-1 :x:	asflicense	1m 5s	/results-asflicense.txt	The patch generated 1 ASF License warnings.
		165m 47s

Subsystem	Report/Notes
Docker	ClientAPI=1.48 ServerAPI=1.48 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7422/3/artifact/yetus-general-check/output/Dockerfile
GITHUB PR	https://github.com/apache/hbase/pull/7422
Optional Tests	dupname asflicense codespell detsecrets shellcheck shelldocs spotless javac xmllint hadoopcheck compile spotbugs checkstyle hbaseanti
uname	Linux d08061d94c6f 6.8.0-1024-aws #26~22.04.1-Ubuntu SMP Wed Feb 19 06:54:57 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / c0bb774039082f1e9d62b02320a5b828b216cb3e
Default Java	Eclipse Adoptium-17.0.11+9
spotless	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7422/3/artifact/yetus-general-check/output/patch-spotless.txt
Max. process+thread count	162 (vs. ulimit of 30000)
modules	C: hbase-auth-filters hbase-http hbase-mapreduce hbase-rest . U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7422/3/console
versions	git=2.34.1 maven=3.9.8 spotbugs=4.7.3 shellcheck=0.8.0 xmllint=20913
Powered by	Apache Yetus 0.15.0 https://yetus.apache.org

This message was automatically generated.

[Apache-HBase]

:broken_heart: -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 :ok:	reexec	0m 15s		Docker mode activated.
			_ Prechecks _
+1 :green_heart:	dupname	0m 0s		No case conflicting files found.
+0 :ok:	codespell	0m 0s		codespell was not available.
+0 :ok:	detsecrets	0m 0s		detect-secrets was not available.
+0 :ok:	shelldocs	0m 0s		Shelldocs was not available.
+1 :green_heart:	@author	0m 0s		The patch does not contain any @author tags.
+1 :green_heart:	hbaseanti	0m 0s		Patch does not have any anti-patterns.
			_ master Compile Tests _
+0 :ok:	mvndep	0m 26s		Maven dependency ordering for branch
+1 :green_heart:	mvninstall	5m 58s		master passed
+1 :green_heart:	compile	17m 1s		master passed
+1 :green_heart:	checkstyle	2m 51s		master passed
+1 :green_heart:	spotbugs	14m 56s		master passed
+1 :green_heart:	spotless	1m 10s		branch has no errors when running spotless:check.
-0 :warning:	patch	1m 41s		Used diff version of patch file. Binary files and potentially other changes not applied. Please rebase and squash commits if necessary.
			_ Patch Compile Tests _
+0 :ok:	mvndep	0m 19s		Maven dependency ordering for patch
+1 :green_heart:	mvninstall	4m 52s		the patch passed
+1 :green_heart:	compile	14m 28s		the patch passed
-0 :warning:	javac	14m 28s	/results-compile-javac-root.txt	root generated 73 new + 1896 unchanged - 0 fixed = 1969 total (was 1896)
-0 :warning:	blanks	0m 0s	/blanks-eol.txt	The patch has 9 line(s) that end in blanks. Use git apply --whitespace=fix <<patch_file>>. Refer https://git-scm.com/docs/git-apply
-0 :warning:	checkstyle	2m 43s	/results-checkstyle-root.txt	root: The patch generated 202 new + 1 unchanged - 0 fixed = 203 total (was 1)
-0 :warning:	shellcheck	0m 1s	/results-shellcheck.txt	The patch generated 2 new + 0 unchanged - 0 fixed = 2 total (was 0)
+1 :green_heart:	xmllint	0m 1s		No new issues.
+1 :green_heart:	spotbugs	16m 14s		the patch passed
+1 :green_heart:	hadoopcheck	14m 33s		Patch does not cause any errors with Hadoop 3.3.6 3.4.1.
-1 :x:	spotless	0m 10s		patch has 33 errors when running spotless:check, run spotless:apply to fix.
			_ Other Tests _
-1 :x:	asflicense	0m 55s	/results-asflicense.txt	The patch generated 1 ASF License warnings.
		106m 58s

Subsystem	Report/Notes
Docker	ClientAPI=1.48 ServerAPI=1.48 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7422/4/artifact/yetus-general-check/output/Dockerfile
GITHUB PR	https://github.com/apache/hbase/pull/7422
Optional Tests	dupname asflicense codespell detsecrets shellcheck shelldocs spotless javac xmllint hadoopcheck compile spotbugs checkstyle hbaseanti
uname	Linux b4cbf7fb45e7 6.8.0-1024-aws #26~22.04.1-Ubuntu SMP Wed Feb 19 06:54:57 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / 0a2cbfa9ee32242150d3525dceb8a011ae7d2002
Default Java	Eclipse Adoptium-17.0.11+9
spotless	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7422/4/artifact/yetus-general-check/output/patch-spotless.txt
Max. process+thread count	162 (vs. ulimit of 30000)
modules	C: hbase-auth-filters hbase-http hbase-mapreduce hbase-rest . U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7422/4/console
versions	git=2.34.1 maven=3.9.8 spotbugs=4.7.3 shellcheck=0.8.0 xmllint=20913
Powered by	Apache Yetus 0.15.0 https://yetus.apache.org

This message was automatically generated.

[stoty]

I think that the (mostly) copied new files should have a boilerplate comment explaining where they were copied from.

[stoty]

Otherwise it looks fine to me.

[NihalJain]

Thank you Istvan for you quick review. Let me update the PR based on your feedback. We have run one round of sanity tests with these changes in our internal fork, thanks to @xavifeds8. All seems good.