[HADOOP-9747] Reduce unnecessary UGI synchronization

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 0.23.0, 2.0.0-alpha, 3.0.0-alpha1
• Fix Version/s: 3.1.0, 3.0.3
• Component/s: security
• Target Version/s: 3.2.0
• Assignee: Daryn Sharp
• Reporter: Daryn Sharp
• Created: 18/Jul/13 17:37
• Updated: 21/Nov/19 17:46
• Resolved: 02/Jul/18 16:34

Description

Jstacks of heavily loaded NNs show up to dozens of threads blocking in the UGI.

Issue Links

• causes: HDFS-14668 Support Fuse with Users from multiple Security Realms
• is related to: HADOOP-14699 Impersonation errors with UGI after second principal relogin
• relates to: HDFS-12533 NNThroughputBenchmark threads get stuck on UGI.getCurrentUser()
• requires: YARN-7048 Fix tests faking kerberos to explicitly set ugi auth type
• supercedes: HADOOP-13805 UGI.getCurrentUser() fails if user does not have a keytab associated
• supercedes: HADOOP-15401 ConcurrentModificationException on Subject.getPrivateCredentials in UGI constructor

Sub-Tasks

• Reduce blocking on UGI.ensureInitialized: Closed
• Remove synchronization for UGI.getCurrentUser: Resolved
• UGI login user keytab and principal should not be static: Resolved
• Avoid Krb5LoginModule.logout issue: Resolved