[HDFS-12300] Audit-log delegation token related operations

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.22.0
• Fix Version/s: 3.0.0-beta1
• Component/s: namenode
• Target Version/s: 3.0.0-beta1
• Hadoop Flags: Reviewed

Release Note

<!-- markdown -->

NameNode now audit-logs `getDelegationToken`, `renewDelegationToken`, `cancelDelegationToken`.

• Assignee: Xiao Chen
• Reporter: Xiao Chen
• Created: 14/Aug/17 22:40
• Updated: 06/Dec/19 23:46
• Resolved: 04/Sep/17 03:26

Description

When inspecting the code, I found that the following methods in FSNamesystem are not audit logged:

• getDelegationToken
• renewDelegationToken
• cancelDelegationToken

The audit log itself does have a logTokenTrackingId field to additionally log some details when a token is used for authentication.

After emailing the community, we should add that.

Issue Links

• depends upon: HDFS-9732 Improve DelegationTokenIdentifier.toString() for better logging
• relates to: HDFS-15005 Backport HDFS-12300 to branch-2