[HADOOP-11482] Use correct UGI when KMSClientProvider is called by a proxy user

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.6.0
• Fix Version/s: 2.6.1, 2.7.0, 3.0.0-alpha1
• Labels: 2.6.1-candidate
• Assignee: Arun Suresh
• Reporter: Arun Suresh
• Created: 15/Jan/15 07:58
• Updated: 30/Aug/16 01:31
• Resolved: 23/Jan/15 20:11

Description

Long Living clients of HDFS (For eg. OOZIE) use cached DFSClients which in turn use a cached KMSClientProvider to talk to KMS.

Before an MR Job is run, the job client calls the DFClient.addDelegationTokens() method which calls addDelegationTokens() on the KMSClientProvider to get any delegation token associated to the user.

Unfortunately, this call uses a cached DelegationTokenAuthenticationURL.Token instance which can cause the SignerSecretProvider implementation of the AuthenticationFilter at the KMS Server end to fail validation. Which results in the MR job itself failing.