[HADOOP-12770] KMSClientProvider addDelegationTokens won't add if the credentials contain an expired one

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.8.0
• Component/s: security
• Assignee: Unassigned
• Reporter: Steve Loughran
• Created: 05/Feb/16 15:42
• Updated: 27/Feb/19 14:34

Description

KMSClientProvider addDelegationTokens adds delegation tokens —but skips that step if the provided credentials already have one for the service.

There is no check to see if the existing one is actually valid; if the credentials have an expired one, then you don't get a new token.

There is a workaround: caller has to filter token list and strip out expired tokens. But to do that, they need to know this issue exists.

Issue Links

• relates to: HADOOP-14556 S3A to support Delegation Tokens
• relates to: HADOOP-16068 ABFS Authentication and Delegation Token plugins to optionally be bound to specific URI of the store
• relates to: HADOOP-12649 Improve Kerberos diagnostics and failure handling