[HIVE-17609] Tool to manipulate delegation tokens

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.0, 3.0.0
• Fix Version/s: 2.2.1, 2.4.0, 3.0.0
• Component/s: Metastore, Security
• Labels: TODOC2.2 TODOC2.4
• Assignee: Mithun Radhakrishnan
• Reporter: Mithun Radhakrishnan
• Created: 26/Sep/17 20:24
• Updated: 22/May/18 23:15
• Resolved: 09/Oct/17 20:33

Description

This was precipitated by OOZIE-2797. We had a case in production where the number of active metastore delegation tokens outstripped the ZooKeeper jute.maxBuffer size. Delegation tokens could neither be fetched, nor be cancelled.

The root-cause turned out to be a miscommunication, causing delegation tokens fetched by Oozie not to be cancelled automatically from HCat. This was sorted out as part of OOZIE-2797.

The issue exposed how poor the log-messages were, in the code pertaining to token fetch/cancellation. We also found need for a tool to query/list/purge delegation tokens that might have expired already. This patch introduces such a tool, and improves the log-messages.

Issue Links

• is related to: OOZIE-2797 Add a framework for cancellation of Delegation Tokens in Oozie AM