[
https://issues.apache.org/jira/browse/HADOOP-8726?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13443247#comment-13443247
]
Daryn Sharp commented on HADOOP-8726:
-------------------------------------
Comments:
# {{UGI.getLoginUser}} should call {{UGI.addCredentials}} instead of
duplicating the logic of that method.
# {{getCredentials}} should return a copy of the {{Credentials}}. See more
below.
# A few nits on the style and consistency. Should add a space around one of
the "!=", and use a cuddled "if".
Regarding {{getCredentials}}: The existing {{getTokens}} is returning an
immutable list prevent the caller from directly tampering with the UGI's
tokens. {{getCredentials}} must also return a copy to avoid leaking tokens
into the wrong UGI. Ex. Let's say I want to get the tokens from one UGI, add
more tokens, and then use those with a new UGI. With the change in this patch,
the original UGI will now also contain the new tokens only intended for the
new/other UGI. You'll probably need to add a private
{{getCredentialsInternal}} that fetches from the {{Subject}}, and the public
{{getCredentials}} returns {{new Credentials(getCredentialsInternal())}}.
> The Secrets in Credentials are not available to MR tasks
> --------------------------------------------------------
>
> Key: HADOOP-8726
> URL: https://issues.apache.org/jira/browse/HADOOP-8726
> Project: Hadoop Common
> Issue Type: Bug
> Components: security
> Reporter: Benoy Antony
> Assignee: Benoy Antony
> Attachments: HADOOP-8726.patch, HADOOP-8726.patch
>
>
> Though secrets are passed in Credentials, the secrets are not available to
> the MR tasks.
> This issue exists with security on/off.
> This is related to the change in HADOOP-8225
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
