[HADOOP-10786] Fix UGI#reloginFromKeytab on Java 8

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.6.0
• Fix Version/s: 2.6.1, 2.7.0, 3.0.0-alpha1
• Component/s: security
• Labels: 2.6.1-candidate
• Hadoop Flags: Reviewed
• Assignee: Stephen Chu Assign to me
• Reporter: Tobi Vollebregt
• Created: 05/Jul/14 05:02
• Updated: 12/Jan/21 11:21
• Resolved: 10/Nov/14 01:49

Description

Krb5LoginModule changed subtly in java 8: in particular, if useKeyTab and storeKey are specified, then only a KeyTab object is added to the Subject's private credentials, whereas in java <= 7 both a KeyTab and some number of KerberosKey objects were added.

The UGI constructor checks whether or not a keytab was used to login by looking if there are any KerberosKey objects in the Subject's private credentials. If there are, then isKeyTab is set to true, and otherwise it's set to false.

Thus, in java 8 isKeyTab is always false given the current UGI implementation, which makes UGI#reloginFromKeytab fail silently.

Attached patch will check for a KeyTab object on the Subject, instead of a KerberosKey object. This fixes relogins from kerberos keytabs on Oracle java 8, and works on Oracle java 7 as well.

Issue Links

• depends upon: HADOOP-10963 Move compile-time dependency to JDK7
• is related to: SLIDER-1010 SliderAM rejecting launch in a secure cluster —claims user not on a keytab
• relates to: HADOOP-11287 Simplify UGI#reloginFromKeytab for Java 7+
• relates to: HADOOP-11090 [Umbrella] Support Java 8 in Hadoop
• relates to: HBASE-7608 Considering Java 8