[HADOOP-11176] KMSClientProvider authentication fails when both currentUgi and loginUgi are a proxied user

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.6.0
• Labels: encryption
• Target Version/s: 2.6.0
• Hadoop Flags: Reviewed
• Assignee: Arun Suresh
• Reporter: Arun Suresh
• Created: 08/Oct/14 16:01
• Updated: 01/Dec/14 03:09
• Resolved: 14/Oct/14 01:15

Description

In a secure environment, with kerberos, when the KMSClientProvider instance is created in the context of a proxied user, The initial SPNEGO handshake is made with the currentUser (the proxied user) as the Principal.. this will fail, since the proxied user is not logged in.
The handshake must be done using the real user.