[HADOOP-12050] Enable MaxInactiveInterval for hadoop http auth token

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.1
• Fix Version/s: 2.8.0, 3.0.0-alpha1
• Component/s: security
• Assignee: Huizhi Lu
• Reporter: Benoy Antony
• Created: 01/Jun/15 23:11
• Updated: 12/May/16 18:27
• Resolved: 18/Aug/15 20:56

Description

During http authentication, a cookie which contains the authentication token is dropped. The expiry time of the authentication token can be configured via hadoop.http.authentication.token.validity. The default value is 10 hours.

For clusters which require enhanced security, it is desirable to have a configurable MaxInActiveInterval for the authentication token. If there is no activity during MaxInActiveInterval, the authentication token will be invalidated.

The MaxInActiveInterval will be less than hadoop.http.authentication.token.validity. The default value will be 30 minutes.

Issue Links

• breaks: HADOOP-12587 Hadoop AuthToken refuses to work without a maxinactive attribute in issued token