Uploaded image for project: 'Hadoop Common'
  1. Hadoop Common
  2. HADOOP-14445

Use DelegationTokenIssuer to create KMS delegation tokens that can authenticate to all KMS instances

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 2.8.0, 3.0.0-alpha1
    • Fix Version/s: 3.2.0, 3.0.4, 3.1.2
    • Component/s: kms
    • Labels:
      None
    • Environment:

      CDH5.7.4, Kerberized, SSL, KMS-HA, at rest encryption

    • Target Version/s:
    • Hadoop Flags:
      Reviewed
    • Release Note:
      Hide
      <!-- markdown -->

      This patch improves the KMS delegation token issuing and authentication logic, to enable tokens to authenticate with a set of KMS servers. The change is backport compatible, in that it keeps the existing authentication logic as a fall back.

      Historically, KMS delegation tokens have ip:port as service, making KMS clients only able to use the token to authenticate with the KMS server specified as ip:port, even though the token is shared among all KMS servers at server-side. After this patch, newly created tokens will have the KMS URL as service.

      A `DelegationTokenIssuer` interface is introduced for token creation.
      Show
      <!-- markdown --> This patch improves the KMS delegation token issuing and authentication logic, to enable tokens to authenticate with a set of KMS servers. The change is backport compatible, in that it keeps the existing authentication logic as a fall back. Historically, KMS delegation tokens have ip:port as service, making KMS clients only able to use the token to authenticate with the KMS server specified as ip:port, even though the token is shared among all KMS servers at server-side. After this patch, newly created tokens will have the KMS URL as service. A `DelegationTokenIssuer` interface is introduced for token creation.

      Description

      As discovered in HADOOP-14441, KMS HA using LoadBalancingKMSClientProvider do not share delegation tokens. (a client uses KMS address/port as the key for delegation token)

      DelegationTokenAuthenticatedURL#openConnection
      if (!creds.getAllTokens().isEmpty()) {
              InetSocketAddress serviceAddr = new InetSocketAddress(url.getHost(),
                  url.getPort());
              Text service = SecurityUtil.buildTokenService(serviceAddr);
              dToken = creds.getToken(service);
      

      But KMS doc states:

      Delegation Tokens

      Similar to HTTP authentication, KMS uses Hadoop Authentication for delegation tokens too.

      Under HA, A KMS instance must verify the delegation token given by another KMS instance, by checking the shared secret used to sign the delegation token. To do this, all KMS instances must be able to retrieve the shared secret from ZooKeeper.

      We should either update the KMS documentation, or fix this code to share delegation tokens.

        Attachments

        1. HADOOP-14445.002.patch
          38 kB
          Rushabh S Shah
        2. HADOOP-14445.003.patch
          52 kB
          Rushabh S Shah
        3. HADOOP-14445.004.patch
          71 kB
          Xiao Chen
        4. HADOOP-14445.05.patch
          73 kB
          Xiao Chen
        5. HADOOP-14445.06.patch
          72 kB
          Xiao Chen
        6. HADOOP-14445.07.patch
          71 kB
          Xiao Chen
        7. HADOOP-14445.08.patch
          81 kB
          Xiao Chen
        8. HADOOP-14445.09.patch
          81 kB
          Xiao Chen
        9. HADOOP-14445.10.patch
          78 kB
          Xiao Chen
        10. HADOOP-14445.11.patch
          78 kB
          Xiao Chen
        11. HADOOP-14445.12.patch
          84 kB
          Xiao Chen
        12. HADOOP-14445.13.patch
          84 kB
          Xiao Chen
        13. HADOOP-14445.14.patch
          64 kB
          Xiao Chen
        14. HADOOP-14445.15.patch
          64 kB
          Xiao Chen
        15. HADOOP-14445.16.patch
          64 kB
          Xiao Chen
        16. HADOOP-14445.17.patch
          87 kB
          Xiao Chen
        17. HADOOP-14445.18.patch
          87 kB
          Xiao Chen
        18. HADOOP-14445.19.patch
          87 kB
          Xiao Chen
        19. HADOOP-14445.20.patch
          87 kB
          Xiao Chen
        20. HADOOP-14445.addemdum.patch
          12 kB
          Xiao Chen
        21. HADOOP-14445.branch-2.000.precommit.patch
          0.4 kB
          Xiao Chen
        22. HADOOP-14445.branch-2.001.precommit.patch
          0.4 kB
          Xiao Chen
        23. HADOOP-14445.branch-2.01.patch
          82 kB
          Xiao Chen
        24. HADOOP-14445.branch-2.02.patch
          82 kB
          Xiao Chen
        25. HADOOP-14445.branch-2.03.patch
          83 kB
          Xiao Chen
        26. HADOOP-14445.branch-2.04.patch
          82 kB
          Xiao Chen
        27. HADOOP-14445.branch-2.05.patch
          82 kB
          Xiao Chen
        28. HADOOP-14445.branch-2.06.patch
          82 kB
          Xiao Chen
        29. HADOOP-14445.branch-2.8.003.patch
          82 kB
          Xiao Chen
        30. HADOOP-14445.branch-2.8.004.patch
          82 kB
          Xiao Chen
        31. HADOOP-14445.branch-2.8.005.patch
          82 kB
          Xiao Chen
        32. HADOOP-14445.branch-2.8.006.patch
          82 kB
          Xiao Chen
        33. HADOOP-14445.branch-2.8.revert.patch
          85 kB
          Xiao Chen
        34. HADOOP-14445.branch-3.0.001.patch
          88 kB
          Xiao Chen
        35. HADOOP-14445.compat.patch
          84 kB
          Daryn Sharp
        36. HADOOP-14445.revert.patch
          86 kB
          Xiao Chen
        37. HADOOP-14445-branch-2.8.002.patch
          38 kB
          Rushabh S Shah
        38. HADOOP-14445-branch-2.8.patch
          31 kB
          Rushabh S Shah

          Issue Links

            Activity

              People

              • Assignee:
                xiaochen Xiao Chen
                Reporter:
                jojochuang Wei-Chiu Chuang
              • Votes:
                2 Vote for this issue
                Watchers:
                17 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: