[YARN-2449] Timelineserver returns invalid Delegation token in secure kerberos enabled cluster when hadoop.http.filter.initializers are not set

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.6.0
• Fix Version/s: 2.6.0
• Component/s: timelineserver

Environment

Deploy security enabled cluster is ATS also enabled and running, but no hadoop.http.filter.initializers set in core-site.xml

• Hadoop Flags: Reviewed
• Assignee: Varun Vasudev
• Reporter: Karam Singh
• Created: 25/Aug/14 08:03
• Updated: 01/Dec/14 03:09
• Resolved: 29/Aug/14 16:47

Description

Timelineserver returns invalid Delegation token in secure kerberos enabled cluster when hadoop.http.filter.initializers are not set
Looks in it is regression from YARN-2397
After YARN-2397. when no hadoop.http.filter.initializers is set

Now when try fetch DELEGATION token from timelineserver, it returns invalid token
Tried to fetch timeline delegation by using curl commands :

1. curl -i -k -s -b 'timeline-cookie.txt' 'http://atshost:8188/ws/v1/timeline?op=GETDELEGATIONTOKEN&renewer=hrt_qa'
Or
2. curl -i -k -s --negotiate -u : 'http://atshost:8188/ws/v1/timeline?op=GETDELEGATIONTOKEN&renewer=test_user'

Return response is for both queries:

{"About":"Timeline API"}

Whereas before YARN-2397 or if you set hadoop.http.filter.initializers = TimelineAuthenticationFilterInitializer or AuthenticationFilterInitializer
First query returns DT and Second used to fail