[SLIDER-990] The isFromKeytab check is not always valid

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: Slider 0.81
• Component/s: security
• Assignee: Unassigned
• Reporter: Billie Rinaldi
• Created: 17/Nov/15 22:00
• Updated: 03/Dec/15 15:45
• Resolved: 03/Dec/15 15:45

Description

In SliderAppMaster, we use loginUserFromKeytab and then verify that the resulting user isFromKeytab. I'm getting a failure on the isFromKeytab check. I believe that the fix for HADOOP-10786 was included in the version of Hadoop I was using. You can see the contradictory log statements below.

2015-11-11 00:54:08,881 [main] INFO security.SecurityConfiguration - No host keytab file path specified. Will attempt to retrieve keytab file accumulo.headless.keytab as a local resource for the container
2015-11-11 00:54:08,881 [main] INFO appmaster.SliderAppMaster - Logging in as accumulo-test1 with keytab keytabs/accumulo.headless.keytab
2015-11-11 00:54:08,947 [main] INFO security.UserGroupInformation - Login successful for user accumulo-test1 using keytab file /hadoop/yarn/local/usercache/accumulo/appcache/application_1447164964705_0014/container_e02_1447164964705_0014_01_000001/keytabs/accumulo.headless.keytab
2015-11-11 00:54:08,947 [main] ERROR main.ServiceLauncher - User is not based on a keytab in a secure deployment.
2015-11-11 00:54:08,948 [main] INFO util.ExitUtil - Exiting with status 70

Issue Links

• duplicates: SLIDER-1010 SliderAM rejecting launch in a secure cluster —claims user not on a keytab