Uploaded image for project: 'Hadoop Common'
  1. Hadoop Common
  2. HADOOP-8088

User-group mapping cache incorrectly does negative caching on transient failures

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 0.20.205.0, 1.0.0, 1.1.0, 0.23.1, 0.24.0
    • Fix Version/s: 0.23.3, 2.0.2-alpha
    • Component/s: security
    • Labels:
      None

      Description

      We've seen a case where some getGroups() calls fail when the ldap server or the network is having transient failures. Looking at the code, the shell-based and the JNI-based implementations swallow exceptions and return an empty or partial list. The caller, Groups#getGroups() adds this likely empty list into the mapping cache for the user. This will function as negative caching until the cache expires. I don't think we want negative caching here, but even if we do, it should be intelligent enough to distinguish transient failures from ENOENT. The log message in the jni-based impl also needs an improvement. It should print what exception it encountered instead of just saying one happened.

        Attachments

        1. hadoop-8088-branch-1.patch
          5 kB
          Kihwal Lee
        2. hadoop-8088-branch-1.patch
          9 kB
          Kihwal Lee
        3. hadoop-8088-trunk.patch
          5 kB
          Kihwal Lee
        4. hadoop-8088-trunk.patch
          9 kB
          Kihwal Lee
        5. hadoop-8088-trunk.patch
          9 kB
          Kihwal Lee

          Issue Links

            Activity

              People

              • Assignee:
                kihwal Kihwal Lee
                Reporter:
                kihwal Kihwal Lee
              • Votes:
                0 Vote for this issue
                Watchers:
                10 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: