[HADOOP-15808] Harden Token service loader use

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.9.1, 3.1.2
• Fix Version/s: 3.3.0, 3.1.2, 3.2.1
• Component/s: security
• Assignee: Steve Loughran
• Reporter: Steve Loughran
• Created: 01/Oct/18 18:14
• Updated: 18/Nov/21 15:39
• Resolved: 11/Dec/18 17:43

Description

The Hadoop token service loading (identifiers, renewers...) works provided there's no problems loading any registered implementation. If there's a classloading or classcasting problem, the exception raised will stop all token support working; possibly the application not starting.

This matters for S3A/HADOOP-14556 as things may not load if aws-sdk isn't on the classpath. It probably lurks in the wasb/abfs support too, but things have worked there because the installations with DT support there have always had correctly set up classpaths.

Fix: do what we did for the FS service loader. Catch failures to instantiate a service provider impl and skip it

Issue Links

• is depended upon by: HADOOP-14556 S3A to support Delegation Tokens
• is superceded by: HADOOP-16079 Token.toString faulting if any token listed can't load.
• relates to: HDFS-13951 HDFS DelegationTokenFetcher can't print non-HDFS tokens in a tokenfile