[ZOOKEEPER-1181] Fix problems with Kerberos TGT renewal

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.0
• Fix Version/s: 3.4.0, 3.5.0
• Component/s: java client, server
• Labels: kerberos security
• Hadoop Flags: Reviewed

Release Note

-Fixes two findbugs warnings related to holding a lock while sleeping.
-Addresses Camille's point: merge two almost-identical retry methods into a single retry method.

• Assignee: Eugene Joseph Koontz
• Reporter: Eugene Joseph Koontz
• Created: 13/Sep/11 23:38
• Updated: 02/May/13 02:29
• Resolved: 24/Oct/11 06:47

Description

Currently, in Zookeeper trunk, there are two problems with Kerberos TGT renewal:

1. TGTs obtained from a keytab are not refreshed periodically. They should be, just as those from ticket cache are refreshed.

2. Ticket renewal should be retried if it fails. Ticket renewal might fail if two or more separate processes (different JVMs) running as the same user try to renew Kerberos credentials at the same time.

Issue Links

• depends upon: ZOOKEEPER-938 Support Kerberos authentication of clients.
• is related to: ZOOKEEPER-1205 Add a unit test for Kerberos Ticket-Granting Ticket (TGT) renewal