[HADOOP-6951] Distinct minicluster services (e.g. NN and JT) overwrite each other's service policies

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.22.0
• Component/s: security
• Hadoop Flags: Reviewed
• Assignee: Aaron Myers
• Reporter: Aaron Myers
• Created: 13/Sep/10 18:55
• Updated: 12/Dec/11 06:20
• Resolved: 30/Sep/10 00:14

Description

Because the protocol -> ACL mapping in ServiceAuthorizationManager is static, services which are run in the same JVM have the potential to clobber the other's service authorization ACLs whenever ServiceAuthorizationManager.refresh() is called. This causes authorization failures if one tries to launch a 2NN connected to a minicluster with hadoop.security.authorization enabled. Seems like each service should have its own instance of a ServiceAuthorizationManager, instead of using static methods.

Issue Links

• incorporates: HDFS-1399 Distinct minicluster services (e.g. NN and JT) overwrite each other's service policies
• incorporates: MAPREDUCE-2067 Distinct minicluster services (e.g. NN and JT) overwrite each other's service policies