[HADOOP-15212] Add independent secret manager method for logging expired tokens

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.6
• Fix Version/s: 3.1.0, 2.10.0, 2.9.1, 3.0.1, 2.8.4, 2.7.6
• Component/s: security
• Target Version/s: 2.8.4, 2.7.6
• Hadoop Flags: Reviewed
• Assignee: Daryn Sharp
• Reporter: Daryn Sharp
• Created: 06/Feb/18 17:45
• Updated: 06/Feb/18 21:53
• Resolved: 06/Feb/18 21:45

Description

AbstractDelegationTokenSecretManager#removeExpiredToken has two phases. First phase synchronizes to collect expired tokens. Second phase loops over the collected tokens to log them while not holding the monitor.

HDFS-13112 needs to acquire the namesystem lock during the second logging phase, which requires splitting the method apart to allow a method override.

Issue Links

• is required by: HDFS-13112 Token expiration edits may cause log corruption or deadlock