[
https://issues.apache.org/jira/browse/HADOOP-13988?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15834756#comment-15834756
]
Greg Senia commented on HADOOP-13988:
-------------------------------------
[~xyao] and [~lmccay] here is log output from 02.patch
2017-01-23 10:29:17,424 DEBUG security.UserGroupInformation
(UserGroupInformation.java:doAs(1744)) - PrivilegedActionException as:knox
(auth:TOKEN)
cause:org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.ipc.StandbyException):
Operation category READ is not supported in state standby
2017-01-23 10:29:17,424 DEBUG security.UserGroupInformation
(UserGroupInformation.java:doAs(1744)) - PrivilegedActionException as:knox
(auth:TOKEN)
cause:org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.ipc.StandbyException):
Operation category READ is not supported in state standby
2017-01-23 10:29:17,426 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logPrivilegedAction(1767)) - PrivilegedAction
as:knox (auth:TOKEN)
from:org.apache.hadoop.ipc.Client$Connection.setupIOstreams(Client.java:758)
2017-01-23 10:29:17,426 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logPrivilegedAction(1767)) - PrivilegedAction
as:knox (auth:TOKEN)
from:org.apache.hadoop.ipc.Client$Connection.setupIOstreams(Client.java:758)
2017-01-23 10:29:17,437 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logAllUserInfo(1774)) - UGI: gss2002 (auth:PROXY)
via knox (auth:TOKEN)
2017-01-23 10:29:17,437 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logAllUserInfo(1774)) - UGI: gss2002 (auth:PROXY)
via knox (auth:TOKEN)
2017-01-23 10:29:17,437 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logAllUserInfo(1776)) - +RealUGI: knox (auth:TOKEN)
2017-01-23 10:29:17,437 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logAllUserInfo(1776)) - +RealUGI: knox (auth:TOKEN)
2017-01-23 10:29:17,437 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logAllUserInfo(1778)) - +LoginUGI:
dn/[email protected] (auth:KERBEROS)
2017-01-23 10:29:17,437 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logAllUserInfo(1778)) - +LoginUGI:
dn/[email protected] (auth:KERBEROS)
2017-01-23 10:29:17,438 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logAllUserInfo(1780)) - +UGI token:Kind:
HDFS_DELEGATION_TOKEN, Service: ha-hdfs:tech, Ident: (HDFS_DELEGATION_TOKEN
token 14676 for gss2002)
2017-01-23 10:29:17,438 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logAllUserInfo(1780)) - +UGI token:Kind:
HDFS_DELEGATION_TOKEN, Service: ha-hdfs:tech, Ident: (HDFS_DELEGATION_TOKEN
token 14676 for gss2002)
2017-01-23 10:29:17,438 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logAllUserInfo(1780)) - +UGI token:Kind:
HDFS_DELEGATION_TOKEN, Service: 10.70.33.7:8020, Ident: (HDFS_DELEGATION_TOKEN
token 14676 for gss2002)
2017-01-23 10:29:17,438 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logAllUserInfo(1780)) - +UGI token:Kind:
HDFS_DELEGATION_TOKEN, Service: 10.70.33.7:8020, Ident: (HDFS_DELEGATION_TOKEN
token 14676 for gss2002)
2017-01-23 10:29:17,438 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logAllUserInfo(1780)) - +UGI token:Kind:
HDFS_DELEGATION_TOKEN, Service: 10.70.33.6:8020, Ident: (HDFS_DELEGATION_TOKEN
token 14676 for gss2002)
2017-01-23 10:29:17,438 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logAllUserInfo(1780)) - +UGI token:Kind:
HDFS_DELEGATION_TOKEN, Service: 10.70.33.6:8020, Ident: (HDFS_DELEGATION_TOKEN
token 14676 for gss2002)
2017-01-23 10:29:17,438 DEBUG kms.KMSClientProvider
(KMSClientProvider.java:getActualUgi(1061)) - using loginUser no KMS Delegation
Token no Kerberos Credentials
2017-01-23 10:29:17,438 DEBUG kms.KMSClientProvider
(KMSClientProvider.java:getActualUgi(1061)) - using loginUser no KMS Delegation
Token no Kerberos Credentials
2017-01-23 10:29:17,438 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logPrivilegedAction(1767)) - PrivilegedAction
as:dn/[email protected] (auth:KERBEROS)
from:org.apache.hadoop.crypto.key.kms.KMSClientProvider.createConnection(KMSClientProvider.java:524)
2017-01-23 10:29:17,438 DEBUG security.UserGroupInformation
(UserGroupInformation.java:logPrivilegedAction(1767)) - PrivilegedAction
as:dn/[email protected] (auth:KERBEROS)
from:org.apache.hadoop.crypto.key.kms.KMSClientProvider.createConnection(KMSClientProvider.java:524)
2017-01-23 10:29:17,439 DEBUG security.UserGroupInformation
(UserGroupInformation.java:getTGT(898)) - Found tgt Ticket (hex) =
Client Principal = dn/[email protected]
Server Principal = krbtgt/[email protected]
Session Key = EncryptionKey: keyType=18 keyBytes (hex dump)=
0000: 3E 58 9C C0 36 40 0F F2 F1 BB E7 A8 4B C7 EC 89 >[email protected]...
0010: 96 32 E3 28 B1 47 36 D0 99 DE C9 5E 28 7F 8F 48 .2.(.G6....^(..H
Forwardable Ticket true
Forwarded Ticket false
Proxiable Ticket false
Proxy Ticket false
Postdated Ticket false
Renewable Ticket false
Initial Ticket false
Auth Time = Mon Jan 23 09:11:28 EST 2017
Start Time = Mon Jan 23 09:11:28 EST 2017
End Time = Mon Jan 23 19:11:28 EST 2017
Renew Till = null
Client Addresses Null
2017-01-23 10:29:17,439 DEBUG security.UserGroupInformation
(UserGroupInformation.java:getTGT(898)) - Found tgt Ticket (hex) =
Client Principal = dn/[email protected]
Server Principal = krbtgt/[email protected]
Session Key = EncryptionKey: keyType=18 keyBytes (hex dump)=
0000: 3E 58 9C C0 36 40 0F F2 F1 BB E7 A8 4B C7 EC 89 >[email protected]...
0010: 96 32 E3 28 B1 47 36 D0 99 DE C9 5E 28 7F 8F 48 .2.(.G6....^(..H
Forwardable Ticket true
Forwarded Ticket false
Proxiable Ticket false
Proxy Ticket false
Postdated Ticket false
Renewable Ticket false
Initial Ticket false
Auth Time = Mon Jan 23 09:11:28 EST 2017
Start Time = Mon Jan 23 09:11:28 EST 2017
End Time = Mon Jan 23 19:11:28 EST 2017
Renew Till = null
Client Addresses Null
2017-01-23 10:29:17,555 INFO DataNode.clienttrace
(DataXceiver.java:requestShortCircuitShm(468)) - cliID:
DFSClient_NONMAPREDUCE_-1687232963_147, src: 127.0.0.1, dest: 127.0.0.1, op:
REQUEST_SHORT_CIRCUIT_SHM, shmId: 7de3b3475df3d2cee241e9a91ee83271, srvID:
0bb43433-8195-44fa-a76b-333e779542bf, success: true
2017-01-23 10:29:17,557 INFO DataNode.clienttrace
(DataXceiver.java:requestShortCircuitFds(369)) - src: 127.0.0.1, dest:
127.0.0.1, op: REQUEST_SHORT_CIRCUIT_FDS, blockid: 1073781194, srvID:
0bb43433-8195-44fa-a76b-333e779542bf, success: true
> KMSClientProvider does not work with WebHDFS and Apache Knox w/ProxyUser
> ------------------------------------------------------------------------
>
> Key: HADOOP-13988
> URL: https://issues.apache.org/jira/browse/HADOOP-13988
> Project: Hadoop Common
> Issue Type: Bug
> Components: common, kms
> Affects Versions: 2.8.0, 2.7.3
> Environment: HDP 2.5.3.0
> WebHDFSUser --> Knox --> HA NameNodes(WebHDFS) --> DataNodes
> Reporter: Greg Senia
> Attachments: HADOOP-13988.01.patch, HADOOP-13988.02.patch,
> HADOOP-13988.patch, HADOOP-13988.patch
>
>
> After upgrading to HDP 2.5.3.0 noticed that all of the KMSClientProvider
> issues have not been resolved. We put a test build together and applied
> HADOOP-13558 and HADOOP-13749 these two fixes did still not solve the issue
> with requests coming from WebHDFS through to Knox to a TDE zone.
> So we added some debug to our build and determined effectively what is
> happening here is a double proxy situation which does not seem to work. So we
> propose the following fix in getActualUgi Method:
> {noformat}
> }
> // Use current user by default
> UserGroupInformation actualUgi = currentUgi;
> if (currentUgi.getRealUser() != null) {
> // Use real user for proxy user
> if (LOG.isDebugEnabled()) {
> LOG.debug("using RealUser for proxyUser);
> }
> actualUgi = currentUgi.getRealUser();
> if (getDoAsUser() != null) {
> if (LOG.isDebugEnabled()) {
> LOG.debug("doAsUser exists");
> LOG.debug("currentUGI realUser shortName: {}",
> currentUgi.getRealUser().getShortUserName());
> LOG.debug("processUGI loginUser shortName: {}",
> UserGroupInformation.getLoginUser().getShortUserName());
> }
> if (currentUgi.getRealUser().getShortUserName() !=
> UserGroupInformation.getLoginUser().getShortUserName()) {
> if (LOG.isDebugEnabled()) {
> LOG.debug("currentUGI.realUser does not match
> UGI.processUser);
> }
> actualUgi = UserGroupInformation.getLoginUser();
> if (LOG.isDebugEnabled()) {
> LOG.debug("LoginUser for Proxy: {}",
> actualUgi.getLoginUser());
> }
> }
> }
>
> } else if (!currentUgiContainsKmsDt() &&
> !currentUgi.hasKerberosCredentials()) {
> // Use login user for user that does not have either
> // Kerberos credential or KMS delegation token for KMS operations
> if (LOG.isDebugEnabled()) {
> LOG.debug("using loginUser no KMS Delegation Token no Kerberos
> Credentials");
> }
> actualUgi = currentUgi.getLoginUser();
> }
> return actualUgi;
> }
> {noformat}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
