[HADOOP-11692] Improve authentication failure WARN message to avoid user confusion

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.8.0, 3.0.0-alpha1
• Component/s: ipc
• Labels: supportability
• Hadoop Flags: Reviewed
• Assignee: Yongjun Zhang
• Reporter: Yongjun Zhang
• Created: 27/Feb/15 18:42
• Updated: 30/Aug/16 01:30
• Resolved: 09/Mar/15 19:51

Description

Lots of the following messages appeared in NN log:

2014-12-10 12:18:15,728 WARN SecurityLogger.org.apache.hadoop.ipc.Server: Auth failed for <ipAddress>:39838:null (DIGEST-MD5: IO error acquiring password)
2014-12-10 12:18:15,728 INFO org.apache.hadoop.ipc.Server: Socket Reader #1 for port 8020: readAndProcess from client <ipAddress> threw exception [org.apache.hadoop.ipc.StandbyException: Operation category READ is not supported in state standby]
......
SecurityLogger.org.apache.hadoop.ipc.Server: Auth failed for <ipAddress>:39843:null (DIGEST-MD5: IO error acquiring password)
2014-12-10 12:18:15,790 INFO org.apache.hadoop.ipc.Server: Socket Reader #1 for port 8020: readAndProcess from client <ipAddress> threw exception [org.apache.hadoop.ipc.StandbyException: Operation category READ is not supported in state standby]

The real reason of failure is the second message about StandbyException,
However, the first message is confusing because it talks about "DIGEST-MD5: IO error acquiring password".

Filing this jira to modify the first message to have more comprehensive information that can be obtained from getCauseForInvalidToken(e).

       try {
          saslResponse = processSaslMessage(saslMessage);
        } catch (IOException e) {
          rpcMetrics.incrAuthenticationFailures();
          // attempting user could be null
          AUDITLOG.warn(AUTH_FAILED_FOR + this.toString() + ":"
              + attemptingUser + " (" + e.getLocalizedMessage() + ")");
          throw (IOException) getCauseForInvalidToken(e);
        }

Issue Links

• depends upon: HDFS-5322 HDFS delegation token not found in cache errors seen on secure HA clusters