[YARN-2232] ClientRMService doesn't allow delegation token owner to cancel their own token in secure mode

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.5.0
• Target Version/s: 2.5.0
• Hadoop Flags: Reviewed
• Assignee: Varun Vasudev
• Reporter: Varun Vasudev
• Created: 30/Jun/14 11:51
• Updated: 15/Aug/14 05:44
• Resolved: 02/Jul/14 21:37

Description

The ClientRMSerivce doesn't allow delegation token owners to cancel their own tokens. The root cause is this piece of code from the cancelDelegationToken function -

String user = getRenewerForToken(token);
...

private String getRenewerForToken(Token<RMDelegationTokenIdentifier> token) throws IOException {
  UserGroupInformation user = UserGroupInformation.getCurrentUser();
  UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
  // we can always renew our own tokens
  return loginUser.getUserName().equals(user.getUserName())
      ? token.decodeIdentifier().getRenewer().toString()
      : user.getShortUserName();
}

It ends up passing the user short name to the cancelToken function whereas AbstractDelegationTokenSecretManager::cancelToken expects the full user name. This bug occurs in secure mode and is not an issue with simple auth.

Issue Links

• blocks: YARN-2233 Implement web services to create, renew and cancel delegation tokens