[HADOOP-13526] Add detailed logging in KMS for the authentication failure of proxy user

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 2.9.0, 3.0.0-alpha1
• Component/s: kms

Environment

RHEL

• Hadoop Flags: Reviewed
• Assignee: Suraj Acharya
• Reporter: Suraj Acharya
• Created: 20/Aug/16 23:43
• Updated: 23/Aug/16 03:23
• Resolved: 23/Aug/16 01:11

Description

Problem :
User A was not able to write a file to HDFS Encryption Zone. It was resolved by adding proxy user A in kms-site.xml
However, the logs showed :

2016-08-10 19:32:08,954 DEBUG org.apache.hadoop.security.authentication.server.AuthenticationFilter: Request https://vm.example.com:16000/kms/v1/keyversion/aMxsSSKmMEzINTIrKURpFJgHnZxiOvsT9L1nMpbUoGu/_eek?eek_op=decrypt&doAs=userb&user.name=usera user [usera] authenticated

Possible Solution :
So the message which says the user was successfully authenticated comes from AuthenticationFilter.java. However, when the filter on DelegationTokenAuthenticationFilter is called it hits an exception there and there is no log message there. This leads to the confusion that we have had a success while the exception happens in the next class.