[HADOOP-12954] Add a way to change hadoop.security.token.service.use_ip

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.6.0
• Fix Version/s: 2.9.0, 3.0.0-alpha1
• Component/s: security
• Target Version/s: 2.9.0
• Hadoop Flags: Reviewed
• Assignee: Robert Kanter
• Reporter: Robert Kanter
• Created: 22/Mar/16 23:08
• Updated: 27/May/17 21:45
• Resolved: 28/Mar/16 17:39

Description

Currently, hadoop.security.token.service.use_ip is set on JVM startup via:

  static {
    Configuration conf = new Configuration();
    boolean useIp = conf.getBoolean(
        CommonConfigurationKeys.HADOOP_SECURITY_TOKEN_SERVICE_USE_IP,
        CommonConfigurationKeys.HADOOP_SECURITY_TOKEN_SERVICE_USE_IP_DEFAULT);
    setTokenServiceUseIp(useIp);
  }

This is a problem for clients, such as Oozie, who don't add *-site.xml files to their classpath. Oozie normally creates a JobClient and passes a Configuration to it with the proper configs we need. However, because hadoop.security.token.service.use_ip is specified in a static block like this, and there's no API to change it, Oozie has no way to set it to the non-default value.

I propose we add a setConfiguration method which takes a Configuration and rereads hadoop.security.token.service.use_ip. There's a few other properties that are also loaded statically on startup that can be reloaded here as well.

Issue Links

• is depended upon by: OOZIE-2490 Oozie can't set hadoop.security.token.service.use_ip
• is duplicated by: HADOOP-13173 SecurityUtil.buildtokenService broke token authentication in multi-home network env
• is related to: MAPREDUCE-6565 Configuration to use host name in delegation token service is not read from job.xml during MapReduce job execution.
• relates to: HADOOP-14463 Port HADOOP-12954 to branch-2.8, branch-2.7