[HADOOP-13627] Have an explicit KerberosAuthException for UGI to throw, text from public constants

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.3
• Fix Version/s: 2.9.0, 3.0.0-alpha2
• Component/s: security
• Labels: supportability
• Target Version/s: 2.9.0
• Hadoop Flags: Reviewed
• Assignee: Xiao Chen
• Reporter: Steve Loughran
• Created: 20/Sep/16 15:19
• Updated: 14/Nov/16 05:09
• Resolved: 07/Oct/16 20:47

Description

UGI creates simple IOEs on failure, making it impossible to catch them, ignore them, have smart retry logic around them, etc.

1. Have an explicit exception like KerberosAuthException extends IOException to raise instead. We can't use AuthenticationException as that doesn't extend IOE.
2. move UGI, SecurityUtil and things related off simple IOEs and into the new one
3. review exceptions raised and consider if they can provide more information
4. for the strings that get created, put them as public static constants, so that tests can look for them explicitly —tests that don't break if the text is changed.
5. maybe, getUGIFromTicketCache to throw this rather than an RTE if no login principals were found (it throws IOEs on login failures, after all)
6. keep KDiag in sync with this

Issue Links

• is depended upon by: HADOOP-13604 Abort retry loop when RPC has an unrecoverable Auth error
• relates to: HADOOP-12834 Credentials to include text of inner IOE when rethrowing wrapped