[HADOOP-13805] UGI.getCurrentUser() fails if user does not have a keytab associated - ASF JIRA

Log work

Agile Board

Rank to Top

Rank to Bottom

Attach files

Attach Screenshot

Bulk Copy Attachments

Bulk Move Attachments

Voters

Watch issue

Watchers

Create sub-task

Convert to sub-task

Move

Link

Clone

Labels

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: Bug
Status: Resolved
Priority: Major
Resolution: Fixed
Affects Version/s: 2.8.0, 2.9.0, 3.0.0-alpha2
Fix Version/s: 3.0.0-alpha4
Component/s: security
Labels:
None

Target Version/s:

2.8.0, 2.7.4, 3.0.0-alpha4
Hadoop Flags:

Incompatible change, Reviewed
Release Note:

Hide
Due to a remaining issue after ~~HADOOP-13558~~, an UGI may still try to renew the TGT even though the UGI is created from an existing Subject. The renewal would fail because of non-existing keytab.

Fixing the issue means different behavior which is incompatible, however, configuration property "hadoop.treat.subject.external" is introduced to enable the fix (disabled by default). The behavior is the same as before when the fix is not enabled.

Show
Due to a remaining issue after HADOOP-13558 , an UGI may still try to renew the TGT even though the UGI is created from an existing Subject. The renewal would fail because of non-existing keytab. Fixing the issue means different behavior which is incompatible, however, configuration property "hadoop.treat.subject.external" is introduced to enable the fix (disabled by default). The behavior is the same as before when the fix is not enabled.

Description

~~HADOOP-13558~~ intention was to avoid UGI from trying to renew the TGT when the UGI is created from an existing Subject as in that case the keytab is not 'own' by UGI but by the creator of the Subject.

In ~~HADOOP-13558~~ we introduced a new private UGI constructor UserGroupInformation(Subject subject, final boolean externalKeyTab) and we use with TRUE only when doing a UGI.loginUserFromSubject().

The problem is, when we call UGI.getCurrentUser(), and UGI was created via a Subject (via the UGI.loginUserFromSubject() method), we call new UserGroupInformation(subject) which will delegate to UserGroupInformation(Subject subject, final boolean externalKeyTab) and that will use externalKeyTab == FALSE.

Then the UGI returned by UGI.getCurrentUser() will attempt to login using a non-existing keytab if the TGT expired.

This problem is experienced in KMSClientProvider when used by the HDFS filesystem client accessing an an encryption zone.