[HDFS-13951] HDFS DelegationTokenFetcher can't print non-HDFS tokens in a tokenfile

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.2.0
• Fix Version/s: 3.3.0
• Component/s: tools
• Target Version/s: 3.3.0
• Assignee: Steve Loughran
• Reporter: Steve Loughran
• Created: 02/Oct/18 14:50
• Updated: 12/Nov/18 10:49
• Resolved: 11/Oct/18 19:10

Description

the fetchdt command can fetch tokens for filesystems other than hdfs (s3a, abfs, etc), but it can't print them, as it assumes all tokens in the file are subclasses of org.apache.hadoop.hdfs.security.token.delegation.DelegationTokenIdentifier & uses this fact in its decoding. It deserializes the token byte array without checking kind and so ends up with invalid data.

Fix: ask the tokens to decode themselves; only call toStableString() if an HDFS token.

Issue Links

• is part of: HADOOP-14556 S3A to support Delegation Tokens
• is related to: HDFS-14060 HDFS fetchdt command to return error codes on success/failure
• is related to: HADOOP-15808 Harden Token service loader use