[HADOOP-13251] Authenticate with Kerberos credentials when renewing KMS delegation token

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.8.0
• Fix Version/s: 2.8.0, 3.0.0-alpha1
• Component/s: kms
• Target Version/s: 2.8.0
• Assignee: Xiao Chen
• Reporter: Xiao Chen
• Created: 09/Jun/16 06:32
• Updated: 30/Aug/16 01:13
• Resolved: 28/Jun/16 01:31

Description

Turns out KMS delegation token renewal feature (HADOOP-13155) does not work well with client side impersonation.
In a MR example, an end user (UGI:user) gets all kinds of DTs (with renewer=yarn), and pass them to Yarn. Yarn's resource manager (UGI:yarn) then renews these DTs as long as the MR jobs are running. But currently, the token is used at the kms server side to decide the renewer, in which case is always the token's owner. This ends up rejecting the renew request due to renewer mismatch.

Issue Links

• Blocked: YETUS-420 Hadoop post commit failure due to Docker unable to build image
• Blocked: HADOOP-13228 Add delegation token to the connection in DelegationTokenAuthenticator
• depends upon: HADOOP-13155 Implement TokenRenewer to renew and cancel delegation tokens in KMS