[HIVE-17853] RetryingMetaStoreClient loses UGI impersonation-context when reconnecting after timeout

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.2.1, 2.4.0, 3.0.0
• Fix Version/s: 2.2.1, 2.4.0, 3.0.0
• Component/s: Metastore
• Target Version/s: 2.2.1, 2.4.0, 3.0.0
• Assignee: Chris Drome
• Reporter: Mithun Radhakrishnan
• Created: 19/Oct/17 22:15
• Updated: 22/May/18 23:16
• Resolved: 01/Dec/17 21:58

Description

The RetryingMetaStoreClient is used to automatically reconnect to the Hive metastore, after client timeout, transparently to the user.

In case of user impersonation (e.g. Oozie super-user oozie impersonating a Hadoop user mithun, to run a workflow), in case of timeout, we find that the reconnect causes the UGI.doAs() context to be lost. Any further metastore operations will be attempted as the login-user (oozie), as opposed to the effective user (mithun).

We should have a fix for this shortly.

Issue Links

• breaks: HIVE-18322 RetryingMetaStoreClient reconnect should not use ugi.doAs if not necessary
• relates to: HIVE-18199 Add unit-test for lost UGI doAs() context in RetryingMetaStoreClient