[HADOOP-13548] Remove recursive dependencies of credential providers in LdapGroupsMapping

• Type: Bug
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.6.0
• Component/s: security
• Assignee: Unassigned
• Reporter: Wei-Chiu Chuang
• Created: 25/Aug/16 15:51
• Updated: 02/Oct/19 17:14

Description

HADOOP-11934 discovered an infinite loop of dependencies in the use of credential provider in LdapGroupsMapping. It added a new localjceks:// URI to workaround the problem. The assumption is that the groups mapping is used only in NameNode and that using a local credential file is not a problem.

However, there are cases where Hadoop clients, such as Sqoop, may use hdfs:// based credential provider and use LdapGroupsMapping at the same time. We should use HADOOP-12846 to exclude hdfs:// URI credential providers.

Issue Links

• relates to: HADOOP-10905 LdapGroupsMapping Should use configuration.getPassword for SSL and LDAP Passwords
• relates to: HADOOP-12846 Credential Provider Recursive Dependencies
• relates to: HADOOP-12851 S3AFileSystem Uptake of ProviderUtils.excludeIncompatibleCredentialProviders
• relates to: HADOOP-13353 LdapGroupsMapping getPassward shouldn't return null when IOException throws
• relates to: HADOOP-11934 Use of JavaKeyStoreProvider in LdapGroupsMapping causes infinite loop