[ACCUMULO-4069] Services failing to renew Kerberos ticket

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 1.7.0
• Fix Version/s: 1.7.1, 1.8.0
• Component/s: gc, master, monitor, tserver
• Labels: kerberos
• Assignee: Josh Elser
• Reporter: Josh Elser
• Created: 03/Dec/15 01:08
• Updated: 03/Jun/16 18:12
• Resolved: 03/Dec/15 21:50

Description

Got a report from a user that Accumulo services were dying after a period of time that was suspiciously similar to the Kerberos ticket lifetime.

A Kerberos ticket lifetime is the amount of time that the ticket is valid (obtained from password or keytab). There is also a renewable lifetime associate with each ticket. Within the renewable lifetime duration, clients can "renew" their ticket for another "ticket lifetime" duration. For each, a lifetime of one day and a renewable lifetime of seven days: a ticket is valid for one day, but clients can renew that ticket up to 6 days after the original ticket expires.

I do recall seeing a line of code in our services that has a comment saying it should spawn a thread specifically for this purpose, but I don't ever recall seeing that thread in thread dumps. My hunch is that the thread just isn't getting launched and we're not doing renewals

Issue Links

• links to: GitHub Pull Request #57
• links to: PR

Sub-Tasks

• Backport server-side only portion of ACCUMULO-4069: Resolved