[HDFS-6666] Abort NameNode and DataNode startup if security is enabled but block access token is not enabled.

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.7.1
• Fix Version/s: 2.8.0, 3.0.0-alpha1
• Component/s: datanode, namenode, security
• Target Version/s: 2.8.0
• Hadoop Flags: Reviewed

Release Note

NameNode and DataNode now abort during startup if attempting to run in secure mode, but block access tokens are not enabled by setting configuration property dfs.block.access.token.enable to true in hdfs-site.xml. Previously, this case logged a warning, because this would be an insecure configuration.

• Assignee: Vijay Bhat
• Reporter: Chris Nauroth
• Created: 10/Jul/14 23:21
• Updated: 30/Aug/16 01:41
• Resolved: 14/Apr/15 17:09

Description

Currently, if security is enabled by setting hadoop.security.authentication to kerberos, but HDFS block access tokens are disabled by setting dfs.block.access.token.enable to false (which is the default), then the NameNode logs an error and proceeds, and the DataNode proceeds without even logging an error. This jira proposes that this it's invalid to turn on security but not turn on block access tokens, and that it would be better to fail fast and abort the daemons during startup if this happens.

Issue Links

• relates to: HDFS-8148 NPE thrown at Namenode startup,.
• relates to: HDFS-4278 Log an ERROR when DFS_BLOCK_ACCESS_TOKEN_ENABLE config is disabled but security is turned on.