[HADOOP-12787] KMS SPNEGO sequence does not work with WEBHDFS

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.6.3
• Fix Version/s: 2.8.0, 3.0.0-alpha1
• Component/s: kms, security
• Hadoop Flags: Reviewed
• Assignee: Xiaoyu Yao
• Reporter: Xiaoyu Yao
• Created: 09/Feb/16 20:00
• Updated: 04/Jan/17 21:54
• Resolved: 17/Feb/16 16:48

Description

This was a follow up of my comments for HADOOP-10698.

It blocks a delegation token based user (MR) using WEBHDFS to access KMS server for encrypted files. This might work in many cases before as JDK 7 has been aggressively do SPENGO implicitly. However, this is not the case in JDK 8 as we have seen many failures when using WEBHDFS with KMS and HDFS encryption zone.

Issue Links

• is related to: HADOOP-10453 Do not use AuthenticatedURL in hadoop core
• is related to: HADOOP-10850 KerberosAuthenticator should not do the SPNEGO handshake