Uploaded image for project: 'Hadoop YARN'
  1. Hadoop YARN
  2. YARN-2449

Timelineserver returns invalid Delegation token in secure kerberos enabled cluster when hadoop.http.filter.initializers are not set

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: 2.6.0
    • Fix Version/s: 2.6.0
    • Component/s: timelineserver
    • Labels:
      None
    • Environment:

      Deploy security enabled cluster is ATS also enabled and running, but no hadoop.http.filter.initializers set in core-site.xml

    • Hadoop Flags:
      Reviewed

      Description

      Timelineserver returns invalid Delegation token in secure kerberos enabled cluster when hadoop.http.filter.initializers are not set
      Looks in it is regression from YARN-2397
      After YARN-2397. when no hadoop.http.filter.initializers is set

      Now when try fetch DELEGATION token from timelineserver, it returns invalid token
      Tried to fetch timeline delegation by using curl commands :

      1. curl -i -k -s -b 'timeline-cookie.txt' 'http://atshost:8188/ws/v1/timeline?op=GETDELEGATIONTOKEN&renewer=hrt_qa'
      Or
      2. curl -i -k -s --negotiate -u : 'http://atshost:8188/ws/v1/timeline?op=GETDELEGATIONTOKEN&renewer=test_user'
      

      Return response is for both queries:

      {"About":"Timeline API"}
      

      Whereas before YARN-2397 or if you set hadoop.http.filter.initializers = TimelineAuthenticationFilterInitializer or AuthenticationFilterInitializer
      First query returns DT and Second used to fail

        Attachments

        1. apache-yarn-2449.1.patch
          6 kB
          Varun Vasudev
        2. apache-yarn-2449.0.patch
          5 kB
          Varun Vasudev

          Activity

            People

            • Assignee:
              vvasudev Varun Vasudev
              Reporter:
              karams Karam Singh
            • Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: