Hadoop Common
  1. Hadoop Common
  2. HADOOP-7982

UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: 1.0.0, 0.23.0
    • Fix Version/s: 1.1.0, 0.23.1, 0.24.0
    • Component/s: security
    • Labels:
      None
    • Hadoop Flags:
      Reviewed
    • Target Version/s:

      Description

      In a few hard-to-reproduce situations, we've seen a problem where the UGI login call causes a failure to login exception with the following cause:

      Caused by: javax.security.auth.login.LoginException: unable to find
      LoginModule class: org.apache.hadoop.security.UserGroupInformation
      $HadoopLoginModule

      After a bunch of debugging, I determined that this happens when the login occurs in a thread whose Context ClassLoader has been set to null.

      1. hdfs_threaded_test.c
        2 kB
        Todd Lipcon
      2. hadoop-7982-branch-1.txt
        1 kB
        Todd Lipcon
      3. hadoop-7982.txt
        1 kB
        Todd Lipcon

        Issue Links

          Activity

          Hide
          Todd Lipcon added a comment -

          Here's a test case which shows the issue. We tracked it down to a JNI issue – if when using libhdfs, the thread that started the JVM isn't the same thread that first uses libhdfs, it will fail with the error described in the JIRA. The fix as committed solves the problem.

          Show
          Todd Lipcon added a comment - Here's a test case which shows the issue. We tracked it down to a JNI issue – if when using libhdfs, the thread that started the JVM isn't the same thread that first uses libhdfs, it will fail with the error described in the JIRA. The fix as committed solves the problem.
          Hide
          Hudson added a comment -

          Integrated in Hadoop-Mapreduce-trunk #964 (See https://builds.apache.org/job/Hadoop-Mapreduce-trunk/964/)
          HADOOP-7982. UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon.

          todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233751
          Files :

          • /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt
          • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Show
          Hudson added a comment - Integrated in Hadoop-Mapreduce-trunk #964 (See https://builds.apache.org/job/Hadoop-Mapreduce-trunk/964/ ) HADOOP-7982 . UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon. todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233751 Files : /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Hide
          Hudson added a comment -

          Integrated in Hadoop-Mapreduce-0.23-Build #166 (See https://builds.apache.org/job/Hadoop-Mapreduce-0.23-Build/166/)
          HADOOP-7982. UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon.

          todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233750
          Files :

          • /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/CHANGES.txt
          • /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Show
          Hudson added a comment - Integrated in Hadoop-Mapreduce-0.23-Build #166 (See https://builds.apache.org/job/Hadoop-Mapreduce-0.23-Build/166/ ) HADOOP-7982 . UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon. todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233750 Files : /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/CHANGES.txt /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Hide
          Hudson added a comment -

          Integrated in Hadoop-Hdfs-0.23-Build #144 (See https://builds.apache.org/job/Hadoop-Hdfs-0.23-Build/144/)
          HADOOP-7982. UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon.

          todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233750
          Files :

          • /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/CHANGES.txt
          • /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Show
          Hudson added a comment - Integrated in Hadoop-Hdfs-0.23-Build #144 (See https://builds.apache.org/job/Hadoop-Hdfs-0.23-Build/144/ ) HADOOP-7982 . UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon. todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233750 Files : /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/CHANGES.txt /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Hide
          Hudson added a comment -

          Integrated in Hadoop-Hdfs-trunk #931 (See https://builds.apache.org/job/Hadoop-Hdfs-trunk/931/)
          HADOOP-7982. UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon.

          todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233751
          Files :

          • /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt
          • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Show
          Hudson added a comment - Integrated in Hadoop-Hdfs-trunk #931 (See https://builds.apache.org/job/Hadoop-Hdfs-trunk/931/ ) HADOOP-7982 . UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon. todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233751 Files : /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Hide
          Hudson added a comment -

          Integrated in Hadoop-Mapreduce-trunk-Commit #1577 (See https://builds.apache.org/job/Hadoop-Mapreduce-trunk-Commit/1577/)
          HADOOP-7982. UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon.

          todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233751
          Files :

          • /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt
          • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Show
          Hudson added a comment - Integrated in Hadoop-Mapreduce-trunk-Commit #1577 (See https://builds.apache.org/job/Hadoop-Mapreduce-trunk-Commit/1577/ ) HADOOP-7982 . UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon. todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233751 Files : /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Hide
          Hudson added a comment -

          Integrated in Hadoop-Mapreduce-0.23-Commit #404 (See https://builds.apache.org/job/Hadoop-Mapreduce-0.23-Commit/404/)
          HADOOP-7982. UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon.

          todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233750
          Files :

          • /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/CHANGES.txt
          • /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Show
          Hudson added a comment - Integrated in Hadoop-Mapreduce-0.23-Commit #404 (See https://builds.apache.org/job/Hadoop-Mapreduce-0.23-Commit/404/ ) HADOOP-7982 . UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon. todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233750 Files : /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/CHANGES.txt /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Hide
          Hudson added a comment -

          Integrated in Hadoop-Hdfs-trunk-Commit #1632 (See https://builds.apache.org/job/Hadoop-Hdfs-trunk-Commit/1632/)
          HADOOP-7982. UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon.

          todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233751
          Files :

          • /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt
          • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Show
          Hudson added a comment - Integrated in Hadoop-Hdfs-trunk-Commit #1632 (See https://builds.apache.org/job/Hadoop-Hdfs-trunk-Commit/1632/ ) HADOOP-7982 . UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon. todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233751 Files : /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Hide
          Hudson added a comment -

          Integrated in Hadoop-Common-trunk-Commit #1559 (See https://builds.apache.org/job/Hadoop-Common-trunk-Commit/1559/)
          HADOOP-7982. UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon.

          todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233751
          Files :

          • /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt
          • /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Show
          Hudson added a comment - Integrated in Hadoop-Common-trunk-Commit #1559 (See https://builds.apache.org/job/Hadoop-Common-trunk-Commit/1559/ ) HADOOP-7982 . UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon. todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233751 Files : /hadoop/common/trunk/hadoop-common-project/hadoop-common/CHANGES.txt /hadoop/common/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Hide
          Hudson added a comment -

          Integrated in Hadoop-Common-0.23-Commit #391 (See https://builds.apache.org/job/Hadoop-Common-0.23-Commit/391/)
          HADOOP-7982. UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon.

          todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233750
          Files :

          • /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/CHANGES.txt
          • /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Show
          Hudson added a comment - Integrated in Hadoop-Common-0.23-Commit #391 (See https://builds.apache.org/job/Hadoop-Common-0.23-Commit/391/ ) HADOOP-7982 . UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon. todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233750 Files : /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/CHANGES.txt /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Hide
          Hudson added a comment -

          Integrated in Hadoop-Hdfs-0.23-Commit #381 (See https://builds.apache.org/job/Hadoop-Hdfs-0.23-Commit/381/)
          HADOOP-7982. UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon.

          todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233750
          Files :

          • /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/CHANGES.txt
          • /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Show
          Hudson added a comment - Integrated in Hadoop-Hdfs-0.23-Commit #381 (See https://builds.apache.org/job/Hadoop-Hdfs-0.23-Commit/381/ ) HADOOP-7982 . UserGroupInformation fails to login if thread's context classloader can't load HadoopLoginModule. Contributed by Todd Lipcon. todd : http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1233750 Files : /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/CHANGES.txt /hadoop/common/branches/branch-0.23/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java
          Hide
          Todd Lipcon added a comment -

          Committed to trunk, 23, and branch-1. Thanks for the review.

          Show
          Todd Lipcon added a comment - Committed to trunk, 23, and branch-1. Thanks for the review.
          Hide
          Eli Collins added a comment -

          +1 to the trunk patch. javadoc warnings are unrelated.

          Show
          Eli Collins added a comment - +1 to the trunk patch. javadoc warnings are unrelated.
          Hide
          Hadoop QA added a comment -

          -1 overall. Here are the results of testing the latest attachment
          http://issues.apache.org/jira/secure/attachment/12511188/hadoop-7982.txt
          against trunk revision .

          +1 @author. The patch does not contain any @author tags.

          -1 tests included. The patch doesn't appear to include any new or modified tests.
          Please justify why no new tests are needed for this patch.
          Also please list what manual steps were performed to verify this patch.

          -1 javadoc. The javadoc tool appears to have generated 7 warning messages.

          +1 javac. The applied patch does not increase the total number of javac compiler warnings.

          +1 eclipse:eclipse. The patch built with eclipse:eclipse.

          +1 findbugs. The patch does not introduce any new Findbugs (version 1.3.9) warnings.

          +1 release audit. The applied patch does not increase the total number of release audit warnings.

          +1 core tests. The patch passed unit tests in .

          +1 contrib tests. The patch passed contrib unit tests.

          Test results: https://builds.apache.org/job/PreCommit-HADOOP-Build/518//testReport/
          Console output: https://builds.apache.org/job/PreCommit-HADOOP-Build/518//console

          This message is automatically generated.

          Show
          Hadoop QA added a comment - -1 overall. Here are the results of testing the latest attachment http://issues.apache.org/jira/secure/attachment/12511188/hadoop-7982.txt against trunk revision . +1 @author. The patch does not contain any @author tags. -1 tests included. The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch. -1 javadoc. The javadoc tool appears to have generated 7 warning messages. +1 javac. The applied patch does not increase the total number of javac compiler warnings. +1 eclipse:eclipse. The patch built with eclipse:eclipse. +1 findbugs. The patch does not introduce any new Findbugs (version 1.3.9) warnings. +1 release audit. The applied patch does not increase the total number of release audit warnings. +1 core tests. The patch passed unit tests in . +1 contrib tests. The patch passed contrib unit tests. Test results: https://builds.apache.org/job/PreCommit-HADOOP-Build/518//testReport/ Console output: https://builds.apache.org/job/PreCommit-HADOOP-Build/518//console This message is automatically generated.
          Hide
          Todd Lipcon added a comment -

          trunk patch (exactly the same code, just rebased to the right spot)

          Show
          Todd Lipcon added a comment - trunk patch (exactly the same code, just rebased to the right spot)
          Hide
          Eli Collins added a comment -

          +1 to the branch-1 patch

          Show
          Eli Collins added a comment - +1 to the branch-1 patch
          Hide
          Todd Lipcon added a comment -

          Here's a branch-1 patch which fixes the issue. Unfortunately I was unable to write a test case for it, since the login functionality uses a lot of static state, etc.

          Show
          Todd Lipcon added a comment - Here's a branch-1 patch which fixes the issue. Unfortunately I was unable to write a test case for it, since the login functionality uses a lot of static state, etc.
          Hide
          Todd Lipcon added a comment -

          In particular, I think Hive might have a bug which sets a thread's ContextClassLoader to null. In the JAAS LoginContext constructor, it saves off the thread's Context ClassLoader into a member variable, and then uses that CL when loading the HadoopLoginModule class. In the case that its a null CL, it fails because HadoopLoginModule isn't on the bootstrap classpath.

          A workaround which fixes it is to temporarily change the thread's CCL to match the UGI class's ClassLoader, then flip it back. I don't know quite enough about correct/conventional classloader usage to know if this is the right fix or a hack.

          Show
          Todd Lipcon added a comment - In particular, I think Hive might have a bug which sets a thread's ContextClassLoader to null. In the JAAS LoginContext constructor, it saves off the thread's Context ClassLoader into a member variable, and then uses that CL when loading the HadoopLoginModule class. In the case that its a null CL, it fails because HadoopLoginModule isn't on the bootstrap classpath. A workaround which fixes it is to temporarily change the thread's CCL to match the UGI class's ClassLoader, then flip it back. I don't know quite enough about correct/conventional classloader usage to know if this is the right fix or a hack.

            People

            • Assignee:
              Todd Lipcon
              Reporter:
              Todd Lipcon
            • Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development