[HADOOP-8088] User-group mapping cache incorrectly does negative caching on transient failures

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.20.205.0, 1.0.0, 1.1.0, 0.23.1, 0.24.0
• Fix Version/s: 0.23.3, 2.0.2-alpha
• Component/s: security
• Assignee: Kihwal Lee
• Reporter: Kihwal Lee
• Created: 17/Feb/12 22:12
• Updated: 16/Oct/13 17:11
• Resolved: 04/Apr/12 16:27

Description

We've seen a case where some getGroups() calls fail when the ldap server or the network is having transient failures. Looking at the code, the shell-based and the JNI-based implementations swallow exceptions and return an empty or partial list. The caller, Groups#getGroups() adds this likely empty list into the mapping cache for the user. This will function as negative caching until the cache expires. I don't think we want negative caching here, but even if we do, it should be intelligent enough to distinguish transient failures from ENOENT. The log message in the jni-based impl also needs an improvement. It should print what exception it encountered instead of just saying one happened.

Issue Links

• is related to: HADOOP-10755 Support negative caching of user-group mapping