[KUDU-2319] Follower masters cannot accept authn tokens for verification

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.3.0, 1.3.1, 1.4.0, 1.5.0, 1.4.1, 1.6.0, 1.7.0
• Fix Version/s: 1.7.0
• Component/s: master, security
• Target Version/s: 1.7.0
• Code Review: http://gerrit.cloudera.org:8080/9373
• Assignee: Alexey Serbin
• Reporter: Alexey Serbin
• Created: 21/Feb/18 01:52
• Updated: 02/Mar/18 20:26
• Resolved: 02/Mar/18 20:26

Description

In case of multi-master setup, the follower masters which haven't been leaders yet, cannot accept authn tokens for verification because they don't have public parts of TSKs in their TokenVerifier.

A small integration test posted as a WIP patch illustrates that:

  http://gerrit.cloudera.org:8080/9373

Issue Links

• is related to: KUDU-2265 A non-leader master uses self-signed server TLS cert if it hasn't ever run as a leader