[HDFS-10296] FileContext.getDelegationTokens() fails to obtain KMS delegation token

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.6.0
• Component/s: encryption

Environment

CDH 5.6 with a Java KMS

• Assignee: Unassigned
• Reporter: Andreas Neumann
• Created: 15/Apr/16 00:03
• Updated: 21/Sep/16 06:24

Description

This little program demonstrates the problem: With FileSystem, we can get both the HDFS and the kms-dt token, whereas with FileContext, we can only obtain the HDFS delegation token.

public class SimpleTest {

  public static void main(String[] args) throws IOException {
    YarnConfiguration hConf = new YarnConfiguration();
    String renewer = "renewer";

    FileContext fc = FileContext.getFileContext(hConf);
    List<Token<?>> tokens = fc.getDelegationTokens(new Path("/"), renewer);
    for (Token<?> token : tokens) {
      System.out.println("Token from FC: " + token);
    }

    FileSystem fs = FileSystem.get(hConf);
    for (Token<?> token : fs.addDelegationTokens(renewer, new Credentials())) {
      System.out.println("Token from FS: " + token);
    }
  }
}

Sample output (host/user name x'ed out):

Token from FC: Kind: HDFS_DELEGATION_TOKEN, Service: ha-hdfs:xxx, Ident: (HDFS_DELEGATION_TOKEN token 49 for xxx)
Token from FS: Kind: HDFS_DELEGATION_TOKEN, Service: ha-hdfs:xxx, Ident: (HDFS_DELEGATION_TOKEN token 50 for xxx)
Token from FS: Kind: kms-dt, Service: xx.xx.xx.xx:16000, Ident: 00 04 63 64 61 70 07 72 65 6e 65 77 65 72 00 8a 01 54 16 96 c2 95 8a 01 54 3a a3 46 95 0e 02

Apparently FileContext does not return the KMS token.

Issue Links

• relates to: TWILL-194 KMS delegation token is not included if the FileContextLocationFactory is ued