[HDFS-3608] fuse_dfs: detect changes in UID ticket cache

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.0.0-alpha
• Fix Version/s: 2.0.2-alpha
• Target Version/s: 2.0.2-alpha
• Hadoop Flags: Reviewed
• Assignee: Colin McCabe
• Reporter: Colin McCabe
• Created: 07/Jul/12 01:21
• Updated: 02/May/18 18:14
• Resolved: 20/Jul/12 19:18

Description

Currently in fuse_dfs, if one kinits as some principal "foo" and then does some operation on fuse_dfs, then kdestroy and kinit as some principal "bar", subsequent operations done via fuse_dfs will still use cached credentials for "foo". The reason for this is that fuse_dfs caches Filesystem instances using the UID of the user running the command as the key into the cache. This is a very uncommon scenario, since it's pretty uncommon for a single user to want to use credentials for several different principals on the same box.

However, we can use inotify to detect changes in the Kerberos ticket cache file and force the next operation to create a new FileSystem instance in that case. This will also require a reference counting mechanism in fuse_dfs so that we can free the FileSystem classes when they refer to previous Kerberos ticket caches.

Another mechanism is to run a stat periodically on the ticket cache file. This is a good fallback mechanism if inotify does not work on the file (for example, because it's on an NFS mount.)

Issue Links

• is related to: HDFS-3676 handleSaslConnection failure doesn't try to renew the correct UGI
• is related to: HDFS-13322 fuse dfs - uid persists when switching between ticket caches
• is related to: HDFS-13520 fuse_dfs to support keytab based login
• relates to: HDFS-3568 fuse_dfs: add support for security