[HIVE-16708] Exception while renewing a Delegation Token

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.3.2
• Fix Version/s: 2.4.0, 3.0.0
• Assignee: Vihang Karajgaonkar
• Reporter: Manikumar
• Created: 18/May/17 11:26
• Updated: 22/May/18 23:58
• Resolved: 29/Nov/17 22:08

Description

I am adding support to Storm Hive Bolt to access Hive meta-store using delegation tokens. I am able to create and cancel delegation tokens using HCatClient. I am getting below exception while renewing a delegation token.

Exception:
org.apache.hive.hcatalog.common.HCatException: org.apache.hive.hcatalog.common.HCatException : 9001 : Exception occurred while processing HCat request : MetaException while renewing delegation token.. Cause : MetaException(message:hive/[e-mail] tries to renew a token with renewer hive)
at org.apache.hive.hcatalog.api.HCatClientHMSImpl.renewDelegationToken(HCatClientHMSImpl.java:643) ~[hive-webhcat-java-client-0.14.0.jar:0.14.0]

Hadoop's AbstractDelegationTokenIdentifier sets the renewer to Kerberos short name but HCatCleint.renewDelegationToken uses the fullName. This causes the renewal to fail.

Relevant parts of code: https://github.com/apache/hive/blob/master/shims/common/src/main/java/org/apache/hadoop/hive/thrift/DelegationTokenSecretManager.java#L96

https://github.com/apache/hadoop/blob/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenIdentifier.java#L105

Let me know If I am missing something.

Issue Links

• relates to: HADOOP-15068 cancelToken and renewToken should use shortUserName consistently